As the U.S. EMV migration continues to move forward, it’s easy to get bogged down in daily implementation details and ignore payments-related trends in other countries. Where will U.S. payments industry stakeholders turn their focus post-EMV? How will industry providers help their customers keep up with the ever-increasing pace of change?
In many regions, EMV is old news. In the U.S., however, it is considered the largest mass-market disruption of the payments process since the introduction of magnetic stripe cards. And the EMV fun isn’t over – it’s simply expanding from the Point of Sale (POS) to the ATM.
Following the well-documented October 2015 liability shift that was the driver behind POS EMV migration activity (which still has a long road ahead), a similar shift is on tap for this coming October. That’s when liability for ATM counterfeit card fraud can potentially be passed from the card issuer to the ATM operator, in accordance with MasterCard’s guidelines. Although Visa’s equivalent liability shift won’t take effect until October 2017, a lot of attention has been focused on MasterCard’s earlier deadline.
The Devil is in the Details
At first, one would think that the ATM transition to EMV would be more straightforward than the POS transition. Americans already know how to “dip” a card at an ATM, they have more chip cards in their wallets now than ever before, and they have experience using those cards at the POS. But with no retail associate on hand to guide them, some consumers may be confused when interacting with an EMV-enabled ATM. The consumer experience can vary based on the capabilities of the ATM hardware and software, and by choices the ATM owner or deployer made during EMV implementation.
Even the process of inserting and removing the card may differ from one ATM to another, depending on factors such as the type of card reader (dip vs. motorized) and whether the ATM attempts to read the chip before it reads the magnetic stripe (or vice versa).
Once the chip card transaction has begun, consumers may be presented with new screens and new choices, such as selecting or confirming the EMV application to use for the transaction. Some ATMs may dispense cash before returning the card; some may do the opposite.
As any systems professional knows, even a seemingly minor front-end change may have significant impacts behind the scenes. Implementing EMV at the ATM is definitely not a minor change. In addition to the possibility that hardware, software and configuration changes may be necessary for some or even all machines in the operator’s fleet, EMV updates require virtually every aspect of the end-to-end process to be touched – not just the ATM itself. The transaction flow between the ATM, core banking systems and external entities, such as processors and networks, must also be tested.
The ATM Times They Are (Still) a Changin’
ATM operators are certainly not immune to changes – their environment has been unbelievably volatile over the past few years. Migrating from Windows XP; supporting the Americans with Disabilities Act (ADA); dealing with end-of-life for popular application software products; and fighting skimming and malware attacks have kept this industry segment very busy. All of these initiatives, and now EMV as well, are compliance- or security-related changes, which cost the organization time and money to implement, rather than revenue-generating enhancements. Upcoming projects which are also likely to be disruptors include tokenization, stronger methods of encryption and support for contactless technology in multiple form factors such as dual interface cards and mobile devices.
In the past, when sweeping system changes were few and far between, ATM operators could perhaps get by with 1980s-vintage tools and manual testing processes. The significant and invasive changes we are now seeing introduce far greater risk of errors, outages and negative experiences that can easily jeopardize relationships between financial institutions, processors, networks and consumers. In addition, QA and ATM testing teams are often insufficiently staffed to rapidly complete these time-consuming, technical projects while continuing to regression test legacy functionality.
A Better Way Forward
Paragon VirtualATM is designed for this type of scenario. It provides a virtual ATM testing environment that simulates an organization’s ATM fleet, facilitates functional testing and offers an easy way to automate regression testing. This opens the testing process to those who lack access to the bank’s physical ATMs – a big plus for organizations with large footprints and/or geographically distributed teams. With automated regression tests running regularly in the background, ATM testers are freed up for more creative tasks such as designing new test scripts. Paragon VirtualATM enables validation of the entire ATM software stack through the XFS layer, making XFS commands and messages accessible that were not previously visible.
EMV is just one step in our collective journey toward more secure, faster payments. With the accelerating pace of technological advances, the life of an ATM development and support team is only going to become more demanding. But with the aid of Paragon VirtualATM, it can remain manageable and become even more interesting.