ATMs, shops may not be ready for EMV cards

ATMs, shops may not be ready for EMV cards

Experts warn that ATM equipment could run out and merchants won't get EMV equipment certified in time to protect themselves from liability if they don't order their upgraded hardware well in advance of an October 2015 deadline.

Card issuers have mandated that U.S. merchants have equipment that is EMV, or smart-chip, enabled by the deadline or possibly face liability for fraudulent transactions. EMV stands for Europay, MasterCard and Visa, the companies that created the chip standard that's now become dominant globally. Most U.S. merchants and American cards currently use magnetic stripe technology.

EMV experts tell stories about Canadian merchants who didn't heed that country's 2010 deadline -- and paid the consequences. For example, when it came to ATM compliance, "many ignored the first-year deadline and paid the sanctions," said Daryl Cornell, president and CEO of the ATM provider Axis Placement Systems of Delaware. (Sanctions for those who did not upgrade ATMs, for example, were $100 per terminal the first year, $500 per terminal in the second year and, at the end of year three, disconnection from Interac, the organization responsible for creating the network.) "When they woke up in mid-2011, our ATM orders and backlog skyrocketed to over 12 weeks' time," said Cornell.

In one case, the hard 2012 conversion deadline had passed in Canada, and an ATM vendor had not updated his machines to process EMV cards. Identity thieves quickly learned his machine was vulnerable and still using outdated software. Bringing multiple cards, they withdrew more than $100,000 and disappeared. Because it was past the deadline for the Canadian liability shift, the merchant was on the hook for the entire sum of stolen money, according to Shaun King, executive vice president in charge of Triton's U.S. EMV conversion.

"The horror stories [from] Canada were that the bad guys aren't just carrying one card. So when they find a machine that's not EMV compliant, they would basically just clean out an ATM," said King.

If we were to compare the U.S. demand for EMV ATM machines against Canada, which replaced and upgraded 90 percent of its machines, 300,000 ATMs will need to be serviced - which would put significant stress on production for three to seven years, according to Cornell. Technical assistance would also be strained. One ATM vendor in Canada reported that it took about three visits per site to prepare an ATM for EMV. In the U.S. market, that would mean 1 million service calls, which is "over and above normal maintenance requirements," said Cornell.

Will U.S. merchants be certified in time?

In Canada, the EMV upgrade kits for merchants' point-of-sale systems were also seriously back-ordered from late 2011 through to 2012, Cornell said.

In Canada, "because many waited until the bitter end to upgrade and activate EMV, any issues (technical, service, training) became magnified by the sheer numbers of units activated," said King.

Since the United States is a much larger country, things could get significantly worse than they did in Canada.

Merchants need to update EMV equipment and certify it properly to create a secure network for their customers, ahead of the deadline. "The size and scale of the U.S. market magnify even the smallest challenge," said Patty Walters, senior vice president of EMV Strategy for the payment processing company Vantiv, considered one of the largest merchant credit card and debit processors in the United States. "It is possible, but not likely" that  EMV-debit and credit processing equipment will run out, said Walters. But there are concerns around whether merchants will be fully certified to process the cards by the deadline.

Debit upgrades in question

Yet, despite dire warnings in the U.S., merchants have been postponing the upgrade. They want equipment that handles both debit and credit card transactions, to avoid the cost of future upgrades as EMV operations in the United States mature.

"Because the final debit specs for terminals were just released in the last 60 days, the U.S. market is only now just finalizing all of the necessary requirements that they will then need to certify," said Walters.

Although it is unlikely the October 2015 liability shift will be altered on credit cards, debit card liability remains in question. "There is a lot of implementation that needs to be done," says Paul Tomasofsky, executive director of the Debit Network Alliance. "There's a lot of purchasing of hardware and software and making sure that they work and certifying that things are working correctly, training within the retail offices, training within the financial institutions."

Things are moving forward. Visa and MasterCard have now licensed their common routing mechanisms to debit cards, which will help the conversion, said King of Triton Systems.

Whether it's iPad or debit capability you want, don't be afraid to ask if your new EMV solution has all the options that you are used to. In order to stay savvy, join an organization or industry trade group, such as the EMV Migration Forum, that is up on EMV issues. "Early and ongoing education is essential to your ability to stay ahead of issues; learning from others might save you time and money," said Walters.

Published: June 18,2023