EMV's delay at the pump could greatly improve security

With Visa and Mastercard extending their EMV compliance deadline to 2020 for fuel pumps, EMV is less likely to overshadow anti-fraud technology that is faster and more practical to implement.

Fuel stations may not even feel they need the extra security EMV provides four years from now, especially compared to the costs of an upgrade that could require disrupting business and ripping up concrete.

As such, it is not surprising both major networks on Dec. 1 extended the EMV liability shift for chip cards on automated fuel dispensers from Oct. 1, 2017 to Oct. 1, 2020. It is welcome relief for fuel station operators, who questioned the business case for EMV when considering that counterfeit fraud at gas pumps represents only 1.3% of total payment fraud, according to Visa.

"It's a very small percentage of overall fraud, but we do have to keep an eye on it," said Jason Oxman, CEO of the Electronic Transactions Association. "The rest of the retailers are going to migrate to EMV, and the question is whether criminals will decide that fuel stations are the place to go now."

gas pump card payment
"paying for gas, small DOF. Other images from this series:"
aabejon/Getty Images

Software-based anti-fraud tools like Visa Transaction Advisor and Mastercard's Decision Intelligence card verification and risk-scoring tools are helping reduce that fraud by 54%, according to Visa. The availability of these products makes the timing of the liability shift extension even more helpful because there is no significant fear that waiting will equate to a massive surge of fraud.

For the past four years, independent and corporate fuel stations have been more concerned with crunching their own numbers to determine the business case for converting to EMV with the previous October 2017 deadline in mind.

Even though the National Association of Convenience Stores estimated fraud costs at fuel stations were about $700 a year, the station owners also faced the rising cost of compliance with the Payment Card Industry data security standards; the NACS estimates such costs to be about $2,000 a year.With those numbers in mind, the thought of converting each pump to EMV — at an estimated cost between $6,000 and $10,000 — simply was not adding up, regardless of the liability shift time frame.

And that's where mobile advancements are coming into play, with the liability shift extension providing some new life into technology that was once seen as a bridge to EMV but could now have a more lasting effect on card security at the pump.

Terminal providers like Verifone have already been pushing technologies that add various digital and mobile features for gas station operators considering the upgrade to EMV.

Among its latest options, NCR is providing its fuel station clients with the option to simply add its NCR Optic platform with touchscreen technology for EMV acceptance and bar-code based mobile payments; this upgrade would not require breaking concrete and building new pumps.

And ExxonMobil has added Apple Pay to its Speedpass mobile payment app, which allows users to activate a pump and pay for fuel from their mobile device.

"Obviously, the fraud prevention there is huge [with Apple Pay] and we're going to see more fuel stations using the mobile payment options," Oxman said. "It all gives the station operators added incentive to upgrade their pumps."

Still, four years from now, independent fuel station operators will be going through the same cost-benefit analysis they are formulating today to determine if EMV is worth the effort, said Julie Conroy, research director and fraud expert with Boston-based Aite Group.

"If it is a station in the middle of Kansas, they might take their chances because they are not seeing a lot of fraud occurring," Conroy said. "But others will be actively targeted if they do not upgrade."

Those stations tend to be in port cities like Miami and Los Angeles, where criminals bring in trucks with "fuel bladders" and fill those up using counterfeit cards, Conroy said.

"Then they turn around and sell that fuel down at the ports," she added. "Those stations have some significant fraud occurring, in some cases up to $300,000 to $400,000 per year."

The thought of absorbing that type of fraud cost is the main reason large fuel corporations have been lobbying hard for extra time for the EMV conversion — even though they would be passing the EMV upgrade costs down to the owners and operators of the stations, Conroy said.

Regardless of how merchants approach payment acceptance at automated fuel pumps between now and October 2020, the new deadline acknowledges there are more challenges with EMV conversion at a gas pump than with countertop terminals, which had a deadline of October 2015.

"EMV compliance for fuel merchants brings significant regulatory and implementation challenges," Mastercard spokesman Seth Eisen said in a written statement. "Over the past months, we have had extensive discussions with fuel merchants, issuers, acquirers and other stakeholders regarding these unique challenges."

In its statement, Visa said: "Based on the current issues fuel merchants face and the critical long-term need for the industry to adopt chip as a solution for counterfeit fraud, we believe these changes are a balanced and manageable way to ensure a successful migration to chip."

Whatever fuel station operators decide, the extra time will allow them to consider upgrades that go beyond the scope of EMV rather than fast-tracking an upgrade that focused only on chip-card acceptance.

"We applaud both Visa and Mastercard for doing this, recognizing the unique challenges faced by fuel station merchants in migrating to EMV acceptance capabilities," Oxman said. "It is the right thing to do and the right time to do it."

The U.S. Payments Forum, formerly the EMV Migration Forum, has been active in monitoring the conversion to chip cards since networks first established liability shift timelines more than four years ago.

The concerns of fuel operators have been "an active part of the EMV migration over the last year with the U.S. Payments Forum and its Petroleum Working Committee," said Randy Vanderhoof, director of the forum, in a statement issued to media outlets.

"Given the migration challenges for implementing EMV in the petroleum environment, Visa's and Mastercard's modification of the liability shift dates will be beneficial to the retail petroleum industry and the U.S. chip migration," Vanderhoof added.

For reprint and licensing requests for this article, click here.
Network rules EMV Mobile wallets Retailers Visa Mastercard
MORE FROM AMERICAN BANKER