Unattended gas pumps would seem to be the perfect use case for EMV's anti-counterfeiting security, but many gas station owners are putting off their upgrades for as long as possible due to hardships that other retail categories don't face.
Because of the various challenges to make EMV payments at the pump a reality, Visa and Mastercard agreed back in late November 2016 to postpone the liability shift for domestic card payments by three years to Oct. 1, 2020. For many gas stations—most of which are independently owned—the switchover isn’t as seamless as plugging in a new terminal.
“There isn’t a lot of movement right now based on the pushback of the deadline and the relatively low level of fraud occurring at the pump. There’s a wait-and-see mentality,” says Marci Gagnon, vice president of business development and operations at AVATAS Payment Solutions, a unit of Cayan that focuses on the energy and service industries.
Three years seems like a long time, but it’s really not with all that has to be done—especially for gas stations that have older pumps. Replacing these could require significant work from a regulatory, environmental and construction perspective. “It’s really not a lot of time when you consider all the steps and processes it may take to implement the new technology,” she says.
A fractured fuel industry
There were 152,995 total retail fueling sites in the United States in 2013, the last year measured by the now-defunct National Petroleum News’ MarketFacts. Convenience stores account for roughly 80 percent of the motor fuels purchased in the U.S., and only a tiny fraction of these stores are owned by the major oil companies. This means the bulk of the stations are independently owned, according to data from NACS, the association for convenience and fuel retailing.
Given this landscape, it’s not surprising that gas stations are at inconsistent stages of EMV adoption. The process is akin to what happened in the broader retail industry, with large-scale merchants paving the way for EMV ahead of smaller businesses.
But we are starting to see a trickle of movement.
In June, Gilbarco Veeder-Root announced what it says is the first EMV gas pump transaction to be successfully processed in the U.S. at a 49 Fuels site in North Carolina. Gilbarco has also publicly announced an agreement with a number of other retailers to upgrade their pumps to support EMV.
Many gas stations are in the process of testing and certification, while others are holding off a bit to make multiple upgrades at once. Pumps last about 15 years, so they want to incorporate as much new technology as possible in one rollout, according to Randy Vanderhoof, executive director of the Secure Technology Alliance. Gas stations are also adopting encryption technology and mobile wallet acceptance. “It will be more expensive to go back in and update those systems later,” Vanderhoof says.
Meanwhile, none of the small and mid-size independent gas stations seem to be very concerned about EMV compliance today, according to George Csahiouni, co-founder and managing director of TransMerit Merchant Services, an ISO. “They know that it’s going to be something that they need to deal with down the road, but the business owners are kicking the can down the road,” he says.
Fuel for thought
Certainly, there are hurdles to rolling out EMV, which is one of the reasons the card brands agreed to extend the liability shift deadline. For many gas retailers, there’s no sense of urgency, given that fraud rates at fuel pumps are relatively low—approximately 1.3 percent of total U.S. payment fraud, according to Visa data.
That—contrasted against with the steep cost of upgrading—is a major sticking point. In 2014, widely published figures estimate the cost of upgrading an individual pump to EMV to be between $6,000 and $10,000. For gas stations, it’s a big challenge to implement EMV because the pumps themselves may need to be ripped out of the concrete to replace not only the hardware but the older wiring.
Legacy slow-speed wires can't support EMV transactions, even if the pump itself could be more easily updated or retrofitted. The cost of upgrading would then be compounded by the loss of business during the upgrade process.
“To me, this is more of a business issue than it is a technical issue. How expensive is it going to be to upgrade, and if I don’t upgrade, what will my fraud costs look like?” says Jack Jania, senior vice president of strategic alliances for Gemalto, an international digital security company based in Paris.
Jania expects the corporate-owned stations will shift to EMV first, but whether or not most meet the new deadline remains to be seen. The bigger companies have more resources and the technical know-how as well as the financial wherewithal to do this.
“It’s no different than a mom-and-pop laundromat trying to convert to EMV. They don’t have all the resources that bigger companies do,” he says. “If you’re a fuel station that has high fraud rates, the financial liability is such that eventually you will convert."
To justify the expense and hassle, some gas stations are looking for other options that allow customers to pay securely. One of the technologies being explored is handling payments in the center of the island, as opposed to at the pump itself, according to Gagnon of AVATAS. Another possibility is for gas stations to require customers to pay for their fuel in the store, though that’s not such a consumer-friendly option. Even mobile payments, which more gas stations are deploying, don’t replace the need to implement EMV. Roughly 40 million people a day buy gas, according to NACS, and not everyone is willing to use a smartphone instead of a card, Gagnon says.
Creative solutions
Wayne Fueling Systems has introduced a technology called Wayne Connect, which bypasses the need to rip out the stations' existing wires in the ground to provide high-speed connectivity needed for EMV. A high-speed router in the store handles the heavy lifting at the point of sale, while in-dispenser switch transmits data across the station’s existing wiring.
The technology has been in use for seven years in Canada. In the U.S., it’s currently being used to run marketing and media promotions at the dispenser, but it could also be a viable solution for gas stations with newer pumps that don’t want to rip up concrete and install new cables.
“It’s a way to overcome significant cost to get EMV at your site,” says Tim Weston, technology solutions manager at Wayne Fueling Systems of Austin, Texas.
Wayne is also looking at wireless options for EMV payments. However, wireless technology presents security and reliability challenges, and a workable solution may not be available until later in the year, Weston says. While Wayne Connect meets the high-speed needs of many gas stations, “it’s another choice that will be on the market,” he says.
Gas stations have other options. They can choose to retrofit fewer pumps, given growing consumer demand for connected cars and mobile pay-at-the-pump options. Shell, for example, announced in February that Jaguar will be rolling out 2018 models armed with a new app, “Fill Up & Go,” that interacts with Shell gas pumps. P97 has introduced technology called PetroZone, which currently works with the 2017 Honda Accord and will eventually expand to other connected cars, according to Don Frieden, chairman, chief executive and president of P97.
P97’s technology can also be used with a mobile phone. Consumers drive up to a participating gas station and launch ChasePay or a payment app from a participating oil brand. Consumers will eventually be able to pay using other consumer-facing apps as well, Frieden says.
ExxonMobil’s Speedpass is another mobile pay-at-the-pump option on the market. It allows customers to pay securely with any major credit card, debit card, ExxonMobil Personal Cards, checking account, Apple Pay or Samsung Pay. Customers can also pay for gas using an Apple Watch.
Cumberland Farms, meanwhile, offers a SmartPay app that allows customers to save on gas and earn rewards by funding purchases from a linked bank account.
Despite the growing number of connected car and mobile pay-at-the-pump options, P97's Frieden recommends that gas stations retrofit at least a few of their pumps because not every customer will want to pay this way. Regardless, gas stations should try to find a way to save money on the EMV conversion. “Time and money is really the issue,” he says.
The road ahead
Now that Mastercard and Visa have postponed the liability shift, gas stations have some wiggle room to determine their next steps.
In the interim, ISOs need to work with their customer base to help identify the best technology and acceptance features, says Jania of Gemalto, the digital security company. ISOs should be encouraging gas stations to think about complementary payment options such as contactless, QR codes and Bluetooth Low Energy. “If you’re going to go through the expense of upgrading your pumps, you may as well future-proof them by adding other forms of acceptance beyond contact chip EMV,” he says.
Worldpay has been getting a lot of inquiries from gas stations about what they should be doing, says Chris Francis, vice president of market development at payment processor Worldpay US. Ultimately, some retailers will opt take their chances and not switch over—at least initially, Francis predicts. Some retailers in rural areas may choose to turn off pay-at-the-pump if they feel customers will accept it because it’s too expensive to justify switching over to EMV. “It’s a competitive decision they have to make,” he says.
One important thing ISOs need to know when talking to their clients is that the liability shift delay only applies to domestic card use. If a customer uses a non-U.S. chip card and it’s read as a mag stripe by the gas pump and turns out to be counterfeit, the liability will shift this October from the non-U.S. card issuer to the gas pump operator’s acquirer, a Visa spokeswoman explains.
This could be an issue for gas stations close to the Canadian border, though Melanie Gluck, vice president of mobile and e-commerce at Mastercard, says that cross-border transactions are generally a small minority of the volume at gas stations. “There’s a lot of traffic that goes over and back, but most people don’t fill up right by the border. And people don’t routinely go over the border to gas up,” she says.
As for gas stations being prepared overall, Gluck says the necessary changes vary by location. When the card brands made the decision to delay the liability shift, it was clear “the ecosystem was not ready,” she says.
Whether most retailers will be ready by October 2020 remains to be seen. Gluck says that although the date got postponed, the “vast majority” of gas stations are moving ahead with the multi-year endeavor.
“These are not small projects,” she says.
Of course, even in an EMV world, gas stations will have to be vigilant about the security of their pumps, says Dave King, a senior manager with UHY LLP, a national accounting and consulting firm. The possibility of skimming devices compromising the magnetic strip on cards remains an issue. To protect themselves, he advises clients to teach attendants how to inspect their pumps as part of their shift-end checklist.
Gas stations should have a clear response plan if attendants discover a pump has been compromised, such as alerting authorities and flagging any surveillance videos as evidence. “If there’s no written plan, attendants may not know what to do,” he says.
