ATM EMV and Compliance
75% of ATMs not converted to EMV before deadline
Source: www.atmatom.com
Why? Well, some call it the “curse of the POS terminal,” where nearly two years after the 2015 POS liability shift, fewer than 50% of merchants have upgraded their POS terminals to EMV. For a number of reasons, many of these procrastinators have yet to be burned by chargebacks.
From Triton ATMatom with permission.
by: Daryl Cornell –Less than a month before the VISAATM liability shift deadline, you would think we would be in the midst of a frantic, last-ditch effort to upgrade or replace all remaining non-EMV ATMs. Well, you would be wrong. Instead, we hear crickets. To be clear, we are talking about another 75% of all ATM transactions which will be at risk for fraud chargebacks in less than a month (MasterCard’s 25% share of ATM transactions has been at risk for nearly a year). So why the lethargy here? Is “ATM-ageddon” real or just more fake news? Here are the latest estimates on the ground, along with some likely outcomes later this year:Banks and IADs have largely completed their ATM EMV upgrades. While there are exceptions at the local level, banks are for the most part ready for the final ATM EMV liability shift on October 1. Of the roughly 125,000 bank ATMs in the U.S., estimates are that over 110,000 will be EMV ready this October. The remaining non-EMV ATMs are owned by banks which tend to be smaller and who don’t view themselves as fraud targets. In addition to banks, it looks like more than 75% of IAD-owned ATMs will be EMV ready by October. This equates to roughly 135,000 EMV-capable ATMs out of a total estimated IAD population of 175,000. The remaining 40,000 or so IAD ATMs will present more of a challenge. Some are not upgradeable. Many are in low-transaction or low-margin sites which may be culled. While contracts may call for merchants to bear the expense of EMV upgrade, these provisions have proven difficult to enforce. Hard decisions will need to be made by IADs on these non-EMV ATMs regarding risk assumption, upgrade in conjunction with contract renewal or outright removal. The jury is still out on the level of retail ATM contraction we will see here.Merchant-owned ATMs are NOT EMV ready. It is the estimated 200,000 merchant-owned ATMs which are the real wild card in the looming liability shift deadline. Currently, fewer than 20% of these ATMs are estimated to be EMV capable. That leaves some 160,000 merchant-owned, non-EMV ATMs exposed to both fraud and chargebacks in little mor than a month. Why? Well, some call it the “curse of the POS terminal,” where nearly two years after the 2015 POS liability shift, fewer than 50% of merchants have upgraded their POS terminals to EMV. For a number of reasons, many of these procrastinators have yet to be burned by chargebacks. These merchants argue that it makes perfect sense to take a “wait and see approach” before upgrading or replacing ATM hardware. Plus, the gas deadline, originally scheduled for this year, has now been extended to 2020. And there’s always a chance for a last minute ATM reprieve, right? Perhaps, however we are talking about cash, combined with persistent, sophisticated criminals and mag stripe fraud totaling $ billions annually. Whether these non-EMV ATMs will be turned off or whether IADs, sponsor banks and processors allow merchants to play “liability shift Russian roulette” will ultimately determine the number of merchant ATMs still operating after October.
ATM contraction is still a likely outcome. Clearly the stakes are high when it comes to liability shift on non-EMV ATMs. Mag stripe ATMs will probably still total over 200,000 at the onset of the VISA liability shift. Unlike POS, retail ATMs and their cash are high-value targets for fraudsters. Will VISA and the other networks blink and continue to absorb fraud losses at non-EMV ATMs? Will IADs be able to rely on contract provisions to protect them from those chargebacks which do flow? Is the liability shift risk worth the reward at these generally low transaction sites? While the answers to all of these questions will determine the degree of contraction, it would appear that there will be far fewer retail ATMs in operation in the U.S. by early 2018 – as many as 40% fewer.
Finally, given the 60-90 days it takes chargebacks to wind their way through the system, we could see a fair amount of coal in merchant stockings this Christmas Season.
PostCounter: 112
