It's been a busy month for ATM operators in the U.S. preparing for EMV liability shifts from most major card brands, including Mastercard's upcoming Oct. 21 deadline.
ATM operators have been down this road before, dealing with Mastercard's rules on EMV transactions occurring with the international Maestro debit cards as far back as 2013. But awareness and experience doesn't automatically translate to preparation.
Unlike the EMV migration at the point of sale, the card brands' timelines are not in sync. Deadlines for Discover and American Express transactions took place earlier this month, and ATM operators have another year to certify and prepare their units for acceptance of Visa EMV debit cards.
"We did a survey earlier this year that estimated about 58% of operators have the vast majority of their fleets upgraded now," said David Tente, executive director of the ATM Industry Association for the U.S. and Latin America. "Anecdotally, with what we are hearing now, it seems like we will be pretty well aligned with those numbers for the liability shifts."
After these deadlines pass, the party unable to handle chip-card transactions at the ATM becomes responsible for any fraud on those accounts. For the most part, the major bank ATM manufacturers like NCR and Diebold are well positioned for EMV, but independent operators may need more time. Some may have the hardware in place but are waiting on other factors.
Some of that reluctance stems from "the complications and issues that have arisen with the EMV migration itself and the experiences of merchants," he said. "Some folks have been hesitant to turn on EMV until the liability shift makes it necessary."
In addition, some issuers and processors are not ready for EMV, but overall the ATM industry is in better shape than a lot of merchants today, a year after the liability shift took effect at the retail point of sale, Tente said.
It hasn't been an easy task for ATM operators and banks, considering the country has more than 400,000 ATMs and each of these units has to be converted through the hands-on work of a technician.
Still, ATM manufacturers and operators stand to benefit more from adopting EMV than retail stores did.
ATMs may not suffer the malware attacks and breaches that target retail stores, but there has been a rapid increase in magnetic-stripe card skimming to steal credentials at the ATM, said Randy Vanderhoof, director of the U.S. Payments Forum [formerly EMV Migration Forum].
"EMV reduces vulnerabilities because of the volume of chip data being moved through those machines, and it makes the ATM increasingly less of a target," Vanderhoof said.
Cost of compliance
The ATM associations have estimated that the EMV conversion costs per ATM range from $2,000 to $3,000. Getting all of the hardware, software and certification in place at the same time has been as problematic in some cases as those tasks on the retail side. But not nearly as often.
"Once the ATM manufacturers made their kits available for upgrade, they did not run into the same challenges that POS had with running out of stock, or delays in shipments," Vanderhoof said. "They are pretty much keeping up to date."
Those scenarios help make the EMV ATM conversion "move much smoother than what we have seen on the merchant side," Vanderhoof added, noting that there are far fewer ATMs to convert than POS terminals in the U.S.
A significant challenge remains in educating independent ATM fleet operators about the liability shift and what needs to be done to avoid chargebacks. The independent operators generally provide ATMs in grocery or convenience stores, or other outlets not associated with financial institutions.
A major independent ATM manufacturer like Cardtronics is likely on target for EMV conversion, but many smaller operations remain uncommitted or need of more information about the conversion process, Vanderhoof said.
The percentage of bank-owned ATMs ready for the liability shift is in the 75% to 80% range, while independent operators will take longer to upgrade and replace and are likely around 50% ready or less, Vanderhoof added.
Up to 10 percent of these independent retail ATMs may be thrown out instead of upgraded for EMV or they will be wholly replaced because of the move to chip cards, James Phillips, a vice president at retail ATM maker
The different liability shifts, from the Maestro edict in 2013, to the staggered timelines over the next year, have been confusing to ATM operators but have not been an outright deterrent, ATMIA's Tente said.
"We never fully understood why we had the split liability shift dates, but in many respects, aside from different certifications, most operators are looking at being ready for EMV by Oct. 21 regardless of the fact Visa is a year later," Tente added.
Visa provided more time for ATM operators because of the need for technicians to visit each unit. Visa's liability shift of October 2017 lines up with its timeline for fuel pump operators, which face a similar challenge.
To alleviate concerns about ATM units not prepared for EMV in 2013, Mastercard said it would help screen Maestro card transactions in the U.S. through its
Ultimately, only ATMs that had a high percentage of foreign card business were upgraded to handle the EMV Maestro cards in 2013, though the ATM associations expressed concern to Mastercard that the Maestro rule would call for all systems to be EMV ready at that time.
In addition to preparing for the EMV liability shifts, the major
Discussions within the industry have focused on upgrades for PINless ATMs, bar codes on mobile devices to replace cards, and examining biometric authentication options.
"There is always going to be new technology introduced or experimented with, even while in the process of doing upgrades for EMV," Vanderhoof said. "We might see all of that accelerate as we get more advanced technology."
