EMV takes hold at ATMs

It’s human nature to put off difficult or time-consuming tasks, or assignments with deadlines far enough in the future you don’t need to address them right away.

For many U.S. financial institutions, EMV (Europay, MasterCard, and Visa) technology falls into that category.

Europe began its move to EMV—which uses embedded computer chips as an extra layer of security against counterfeit fraud—as early as 2004. So card issuers and consumers had several years of experience with EMV cards before a mandated move to EMV in the U.S. got underway in 2015.

Even with that foreshadowing—and with fraud liability shifts for ATMs taking place in October 2016 for MasterCard and this coming October for all other global payment networks—domestic ATM installations haven’t exactly been swift to convert.

A recent ATM Industry Association survey indicates that 58% of U.S. ATMs converted to EMV by the end of 2016, and 79% will make the switch by the close of 2017.

So, one-fifth of all units still will use older technology after the final ATM fraud liability shift. Noncompliance could prove particularly expensive for smaller ATM fleet owners.

“Any ATM operator, regardless of size, will need to re-evaluate its business model due to EMV upgrades,” says Troy Bernard, director of product and marketing at CPI Card Group, who points to polar perspectives on EMV. “On the positive side, operators must ask themselves: ‘If I’m an early adopter of EMV, can I gain share as competitors leave the market, or as international travelers use my ATM because their card issuers won’t permit magnetic stripe-only cash access?’

READ: Key ATM fraud liability shift dates

“On the negative side of the profit and loss equation, operators absolutely will need to factor in the cost to upgrade to EMV, and the continued growth of electronic payments negatively impacting cash payments,” adds Bernard.

Another negative is the fraud/theft liability shift from credit card companies to retailers who fail to protect themselves by converting to EMV-based point-of-sale terminals.

While credit unions have been at the forefront of installing EMV-capable ATM fleets, educating merchants and consumers about the desirability and utility of EMV—and helping them achieve a level of comfort with it—can be a difficult and drawn-out process.

The best way around this obstacle, says Bernard, is pretty straightforward. “One of the key lessons we learned from the retail liability shift is that regardless of how much effort card issuers exert to educate their customers with marketing materials, and how much merchants try to train their cashiers, the best investment is in the technology right at the point of sale,” Bernard says.

“When the clerks and the customer have clear and simple messages to follow,” he adds, “the checkout experience is intuitive and fast, and education occurs much more quickly.”

Next: Unit upgrade costs

Unit upgrade costs

Some experts see no real choice for financial institutions when it comes to ATM fleet upgrades.

“Credit unions absolutely have to upgrade their ATMs, especially if they eliminate teller positions,” says Lou Grilli, director of payments strategy at CSCU. “They have no option but to maintain their ATM fleets.”

Some credit unions have yet to issue EMV chip cards, but the Payments Security Task Force projects 98% of all U.S. cards will feature EMV chips by the end of 2017. “They don’t have to upgrade their ATMs right away, but the Visa deadline looms,” Grilli says.

Cost presents one obstacle to upgrades. The simplest upgrades cost around $3,000 per ATM, Grilli says.

These usually involve a cash dispenser at a third-party, non-credit union location—such as a convenience store or café—that needs a simple card reader swap-out and certification.

CSCU offers a simple cashdispensing ATM tailored to credit union needs for $20,000 per unit. Meantime, an intelligent, credit union-branded machine capable of accepting cash or checks without need for a deposit envelope varies from $60,000 to $100,000 per unit.

“Higher figures factor in the cost of preparing a site for the machines, such as in-wall or side of building,” Grilli notes.

Third-party ATM upgrades must take into account the number of transactions per day necessary to justify an upgrade, Grilli says. Consider a $3,000 upgrade.

“If you charge $1.50 per transaction, you need 2,000 transactions to pay for the upgrade,” he says. “But if an ATM location generates only seven transactions daily, it’s going to be a very long wait before the upgrade pays for itself.”

Fraud liability drives costs

Fraud liability adds another expense.

“A significant amount of skimming goes on in heavily trafficked locations, such as gas stations and convenience stores,” says Grilli. This can affect credit unions that allow members to access their accounts in off-branch locations.

“Some fraudsters set up miniature cameras to track PINs to go along with skimmed magnetic stripe card data,” Grilli says. “In such cases, a credit union that had previously allowed members to use third-party ATMs now forbids them.”

He cites a recent example where a credit union in Portland, Ore., ceased connecting to these ATM locations because of recurring problems with skimming.

“Skimming remains a huge issue,” Grilli says. “Incidences of skimming reached their highest number yet in 2015. Fraudsters typically like to attach skimmers to machines in out-of-sight locations or machines that are idle during nonbusiness hours. On average, a fraudster obtains $33,000 worth of card information from each compromised ATM.”

EMV doesn’t eliminate magnetic stripe reading. In fact, the ATM reads the mag stripe data to determine if it’s a chip card, then reads the chip. For now—and, anti-fraud experts hope, for a long time—a thief can duplicate magnetic stripe data but cannot duplicate the chip.

“EMV, in general, has had a positive effect on reducing fraudsters’ attempts to use counterfeit cards at the point-of-sale,” says Barney Moore, CSCU’s director of portfolio consulting services. “But if the card in question has a mag stripe—Visa or MasterCard—a skimmer can obtain its account number and then go online and use it fraudulently.”

Are debit card transactions increasing to the point that cash will become a rarity?

“Although financial institutions push for people to use debit cards exclusively, cash use is holding steady,” says Grilli. “Millennials and Gen Xers still use a lot of cash.

“ATMs continue to be a source of profit,” he adds. “But if owners haven’t upgraded them, they’re liable for any fraudulent use of card data. Accepting the technology means not having to accept liability for skimming.”

Although credit unions typically pay for ATM units, Grilli adds, they often outsource maintenance to third parties, such as the services CSCU offers.