Gas stations get reprieve on EMV deadline from Visa, but will that suffice?

Visa’s the first card company to push back the October deadline for U.S. gas station EMV compliance, but that’s just one of a mounting set of challenges petroleum merchants are facing because of the coronavirus.

Gas stations were originally supposed to be EMV compliant by October 2017, but that was pushed to October 2020 to accommodate the complexities of updating or replacing fuel pumps. They will now have until April 2021 before Visa imposes a fraud liability shift for non-compliant stations. Mastercard, Amex and Discover have not yet changed their deadlines, but have typically aligned themselves with Visa's timeline.

Visa's easing was reported by industry trade groups — the card brand did not issue a formal statement as of Monday morning and did not return a request for comment.

“We’re happy they’ve decided to do something,” said John Drechny, CEO of the Merchant Advisory Group. “But we’re still going to have a lot of stations that won’t be EMV ready, even in April. The market would have preferred a much longer delay.”

Bloomberg News

The virus has hit gas stations with several major problems. Stay-at-home orders have halted travel, so there are far less people buying gas, hitting revenue streams. And while gas stations are not among the merchants that have had to shut down, the crisis has hurt supply chains, staffing and logistics. And when lockdowns are eased, volume will increase quickly, putting renewed demand on the hardware that gas stations are expected to rip out and replace.

Given these challenges, it’s simply too hard for gas stations to manage a massive hardware upgrade at scale now, even with six extra months, Drechny said.

“The stay-in-place orders are making it hard for the people who would fix the terminals to get out to the terminals,” Drechny said. “So there’s not a good environment to get IT people out for projects.”

MAG is one of several groups that have pushed for EMV gas station deadline extensions, citing the safety of staff and overall economic hardships due to the coronavirus. The card companies had initially pushed back against those requests, with Visa the first to relent. Mastercard, Amex and Discover did not return requests for comment on Monday morning.

It would not be surprising if the other major card brands quickly followed suit since they often move quickly to ensure consistency. Both Visa and Mastercard left the Libra cryptocurrency project within a couple of hours of one another, and the brands also work together to support a universal payment experience for online payments.

The EMV gas station migration has taken about four years longer than other merchants, due to the complicated upgrades. Most gas stations in the U.S. are tied to convenience stores and a small percentage are owned by gas companies. That makes it harder to absorb the $6,000-per-pump upgrade at scale.

There are about 150,000 active fuel sites in the U.S., according to the National Association of Convenience Stores. “That upgrade involves a large capital investment, so paying for those changes will be a major issue for some businesses in the current economic climate, and any short term investment is probably not a priority,” said James Crawshaw, a fraud analyst at The ai Corporation.

There’s also an international supply chain issue, as some U.S. gas stations use pump hardware that’s manufactured in China and other overseas markets.

“We’ve had members tell us there’s been delays in these parts for several months, so they can’t do testing and installations now for EMV pumps,” Drechny said. “There’s also no way to monitor and test the installations to see how they are performing.”

Even before the coronavirus hit, the petroleum industry's EMV migration was suffering from delays and cost concerns, causing a move to alternatives such as payments from in-car voice assistants and mobile wallets.

Any delay, or a lack of an upgrade to EMV at gas stations, will result in an increased fraud risk, according to Crawshaw.

“Any retailers who cannot or do not invest in upgrades may be hit harder, as fraudsters will likely exploit them first,” Crawshaw said.

Other merchant categories — including the convenience stores that operate alongside fuel pumps — faced an October 2015 deadline for EMV compliance.