The latest in a parade of deadlines has arrived in the ongoing transition of the US payment card market to EMV technology. Effective October 21, MasterCard requires that all ATM machines be EMV-enabled for processing. Non-compliant transactions will still process as before, ensuring minimal consumer disruption, but in any cases of counterfeit card fraud, the loss exposure now shifts to the non-compliant party. This rule change is very similar to last fall’s higher-profile “liability shift” at the point of sale (POS).
Much like the continuing conversion at retail POS terminals, the ATM change will not feature a single “big bang” cutover as industry survey data indicates that just over half of US ATMs will be EMV-ready by year-end. The equivalent liability shift for Visa ATM transactions won’t take effect until October 2017. Nonetheless, experts agree that most of the heavy lifting should be completed in time for the MasterCard deadline.
One might think that, in the words of noted Canadian Rapper Drake, “If you’re reading this it’s too late.” However, this is not necessarily so. While, ideally, your EMV migration plan should be well underway because longer delays directly translate to greater fraud exposure, there are testing solutions that can help you streamline the process.
The US is different (again)
When most countries moved to EMV years ago, ATMs were migrated prior to POS terminals – making the US a unique implementation case. Not only is the US joining the EMV club later than others, but it also has approached the POS exposure before addressing risks at the ATM.
Fraudsters constantly seek the soft underbelly to perpetrate their schemes, so not surprisingly, we have already seen an increase in ATM fraud in the US since last fall’s point of sale deadline. This is in addition to the sharp rise in criminal tactics, such as skimming, that have increased in recent years.
Absent steps like EMV, it’s reasonable to expect ATM fraud exposure to continue to increase and for fraudsters to concentrate their attacks on the shrinking number of non-compliant ATMs. Perhaps most troubling, a full twenty percent of ATM operators reported that they do not expect to be EMV compliant by year-end 2017, even after Visa’s deadline. The exposure for those in that group could be particularly significant.
Don’t get left holding the bag
Issuers have intensified their efforts to distribute chip debit cards in advance of October 21 to ensure they’re not left holding the liability bag. One of my colleagues reported receiving new cards from two separate financial institutions (one MasterCard, one Visa) within the past week alone. Of course, when fraud does occur, the monetary loss from the fraud itself is only the tip of the iceberg. Issuers must also deal with unhappy consumers, for whom they serve as the first point of contact regardless of where fault actually lies. Additionally, both issuers and ATM operators are looking at costs related to exception handling and remediation that often exceed the direct monetary loss itself.
The party’s not over
If you’re worried the fun will be over once ATM machines are addressed, don’t despair. The deadline for EMV-enablement of automated fuel dispenser (“pay at the pump”) terminals is October 2017, and this may be the costliest and most complex conversion of all. The fuel industry has been angling for an extension, but to date, the card networks have resisted in providing relief. It’s safe to assume that any investment in enhanced payments testing solutions will find no shortage of opportunities for ongoing use.
For More Information: Paragon’s webinar outlines some of the next generation tools, such as VirtualATM, available to make the testing process both more effective and efficient for issuers and ATM operators alike.