TALLAHASSEE, Fla.-The first deadline in the U.S. payments migration to EMV has passed, and while the risk to most CUs may be small for non-compliance, experts say it's a risk credit unions should evaluate if they choose not to comply.
As part of the U.S. migration to EMV, largely driven by Visa and MasterCard liability shift deadlines, April 19 was the date set by MasterCard for ATM Maestro acquirer processors to support EMV chip card transactions. The deadline applies only to MasterCard-branded debit cards issued by overseas banks and used at U.S. ATMs. If the ATM owner does not comply, counterfeit fraud liability shifts to the ATM transaction acquirer.
Published reports and sources have estimated these transactions represent roughly 1% of all U.S. ATM transactions, or 60 million swipes a year.
"This is the first of the ramping up for EMV," said Mansel Guerry, president and CEO of Credit Union 24. "My advice is that if the credit union cannot clearly say how this deadline impacts them, it needs to pull the management team together, elevate this, and give it a sense of importance."
Jim Pettitt, director of ATM security for Diebold, North Canton, Ohio, urged credit unions not in compliance to assess their interregional Maestro risk. "Yes, this is just step one, and the exposure may not be that great for many credit unions. We are talking about interregional transactions, fraudulent transactions, MasterCard transactions, and the country in which the issuing bank resides has to be participating in the liability shift. There are many factors. But risk is risk."
Where To Start
A good place to start evaluating the risk, said Barney Moore, senior portfolio consultant at CSCU, Clearwater, Fla., is determining how many interregional Maestro transactions have been conducted at the CU's ATMs. "ATMs need to be included in credit unions' EMV implementation plans and may need to be re-prioritized based on their individual risk exposure."
MasterCard, too, is helping to minimize fraud risk, pointed out Moore, making adjustments in the implementation of its April 19 policy.
"MasterCard intends to block any interregional Maestro transactions at U.S. ATMs that averaged no more than one Maestro transaction per month during 2012. This is estimated to cover 80% or more of all ATMs in the U.S. and will be accomplished through a MasterCard fraud prevention tool, Fraud Rule Manager, which will also be used on the remaining ATMs in the U.S. to prevent fraudulent transactions on interregional Maestro transactions. MasterCard has stated that if they detect fraud occurring above some level of historical baseline, they will selectively block transactions at individual ATMs."
Diebold's Pettitt emphasized a longer-term perspective. "When we get to 2016 and 2017, (EMV-capable ATMs) become normal operating procedure. So credit unions have to prepare for this shift. It's inevitable. They should begin planning for this now."
To do that, credit unions need to begin raising their level of education around the overall EMV migration timeline put in place by Visa and MasterCard, continued Pettitt. "Pay attention to what other entities are doing, specifically the network processors, and initiate discussions with partners, whether they are terminal vendors or the networks."
Don't Kick The Can
According to what Diebold has gathered from its interactions with the CU community prior to the April 19 date, not many credit unions are in compliance with the deadline-but the company believes the switchover to EMV-capable terminals is clearly on CUs' radar. During a recent webinar education series for Diebold's clients, of which credit unions were a large contingent, questions from an audience poll indicated many were still in the learning phase regarding ATM conversions to EMV capability.
"Many financial institutions are still trying to understand all of this," said Dean Stewart, senior director of self-service product management at Diebold, adding that most of the interest Diebold is seeing from clients switching to EMV-capable ATMs has been from large banks. "We expect credit unions soon to ask our sales people about obtaining EMV readers and other things they need to make the conversion, like Windows 7 and other upgrades. We expect to see a lot of activity from credit unions in 2014."
CU24's Guerry reminded that the credit union does not want to "kick this can down the road. You don't want to wait until near the 2016 and 2017 required change deadlines to take any action. At minimum, make your exposure assessment today. CU24 is addressing the U.S. conversion to EMV, and we now have a calendar and timeline in place. Credit unions don't want to turn a deaf ear to this. Having been a former credit union CEO, I know when NCUA examiners come calling, and they begin picking you apart, they will know by the third question if you paid attention to this deadline."
MORE@CUJOURNAL.COM
Subscribers can read related stories by going to www.cujournal.com and typing the following headlines into the search function:
Slow Adoption of EMV Being Blamed For Increase In Credit, Debit Fraud
Gear Up For EMV, Or Run Risk Of Losing Interchange
EMV Cards Are Coming Soon To A Wallet Near You
Learn About EMV Before Trying To Implement It
TMG: EMV Deadlines Are Guidelines, Not Mandates
