A U.S. shift to EMV smart cards for payments helped by a recent directive from Visa Inc. may not speed up the complicated process of converting thousands of ATMs to accept the new cards, but collaboration between ATM manufacturers and financial institutions to address the change should begin now, industry experts say.
Under Visa’s directive, U.S. merchants have until Oct. 1, 2015, to convert to EMV card acceptance. After that date, the liability shifts to the merchant acquirer from the card issuer if a chip transaction could have prevented the fraudulent purchase (
Because many consumers using EMV cards also will seek cash at ATMs across the country, ATM-manufacturing company executives generally agree that they and financial institutions already should be working to ensure consumers are not negatively affected by the migration.
Indeed, banks and ATM manufacturers should work together to determine what is necessary to have their machines ready, Malon Updike, director of deployment in the Americas at Duluth, Ga.-based NCR Corp., tells PaymentsSource.
“Migration basically comes down to a partnership between NCR and the financial institutions, and it is dictated by several requirements and what protocols the bank has to follow to get an authorization on a card,” he says. NCR provides ATMs primarily to banks and credit unions.
Depending on the size of the bank involved, bank executives must decide whether to convert their ATMs for use with only their signature bankcards, or to establish a set of certification codes to be able to accept all other cards, Updike says.
Besides the technical aspects of converting and testing ATMs for EMV card acceptance, banks also will have to make marketing decisions, Updike says. “Do they reissue all of their cards at once with a mass mailing so everyone has EMV, or do they do it over a period of time?” he says.
Time is not something the banks and the ATM manufacturers have a lot of in terms of being ready for widespread EMV use, according to Ian Kerr, CEO of Charlotte, N.C.-based Level Four Americas LLC, an ATM software and testing provider.
Far more transaction permutations occur with EMV cards compared with magnetic stripe cards, requiring the ATM application and host system to process a much wider range of scenarios, Kerr wrote in a blog recently.
For example, the chip is a computer device that interacts with the ATM and processes data instead a static interface like a magnetic stripe. In the United Kingdom, this triggered a major hardware-replacement cycle because existing legacy IBM OS/2 machines were not capable of supporting the additional cryptographic processing required under EMV, Kerr wrote.
Kerr notes Level Four’s “strongest advice” to banks in its recently issued “Guide To EMV Migration At The ATM” would be for thorough end-to-end testing of the new systems.
The ATM transition to accept EMV cards and the accompanying tests will vary for each financial institution, says Chuck Somers, vice president of ATM Security at North Canton, Ohio-based Diebold Inc. Like NCR, Diebold’s customers also primarily are financial institutions.
“A variety of things can be done in testing, and the bank will determine what kind of test. But they are mostly to ascertain validation of the consumer information,” Somers tells PaymentsSource. “Tests dealing with security purposes are not incredibly intense.”
Without a federal mandate to convert to EMV, it might take longer for U.S. banks than their European counterparts to embrace the change to EMV because of the sheer number of ATM and point-of-sale networks, Somers says.
But a change in who is liable for losses from fraud could speed up the migration process, he says.
“Right now, losses incurred because of fraud are incurred by the card issuer, not the ATM owner or the retail merchant,” Somers says. “If that changed, the banks and merchants would want the more secure method of EMV.”
The European ATM Security Team monitors fraud losses in Europe and has noted a steady decline since the EMV became a European standard. However, the organization does not have a similar counterpart in the U.S., Somers says.
Lachlan Gunn, coordinator of the European ATM Security Team, speculates in his ATM Marketplace blog that, as skimming-related fraud losses continue to fall in Europe, they will surface in other countries not using EMV as criminals seek easier targets, particularly in the U.S.
“The Visa announcement is an important first step for the U.S. market, and it clarifies the technology that merchants, banks and financial institutions can now start to invest in with confidence,” Gunn writes.
With the 2015 deadline in mind, the conversion process in the U.S. will unfold as part of normal capital expense and equipment-upgrade cycles at the banks, as opposed to a quick fix, observers believe.
“This will be a stage-by-stage introduction, and I don’t think EMV acceptance in the U.S. will be so much about fraud detection [with the chip-and-PIN] but more about the rest of the world moving in that direction,” Scott Strumello, associate with London- and New York-based Auriemma Consulting Group, tells PaymentsSource.
With Visa “sort of mandating it,” the banks and ATM manufacturers know they will have to comply eventually because consumers will want to use their Visa EMV cards in the machines, Strumello says.
Gil Luria, an industry analyst with Los Angeles-based Wedbush, contends terminals accepting consumer cards will convert to EMV capabilities as part of a normal upgrade cycle.
“Visa has made sure that EMV is going to happen in the U.S., just like it has in other countries,” Luria tells PaymentsSource. “But they are giving people time to upgrade their payment terminals in a natural cycle over the next four-plus years in order to facilitate EMV.”
Migration to EMV will be a much smaller issue for banks and ATM manufacturers than in the retail sector because it essentially involves replacing only the card-reader module in the ATM, Luria contends.
“In a bigger sense, EMV is a more secure process at the ATM, and an incremental reduction in fraud for the banks will equate to paying for a lot of the cost in new infrastructure,” Luria says.
What do you think about this? Send us your feedback.
