ATMs are an important component of the move to EMV chip payment technology in the U.S.
In the past, ATM owners in general didnt have much incentive to move to chip technology for fraud prevention. ATMs always-online authorization, coupled with the use of a PIN, and relatively stronger security, have historically resulted in lower levels of fraud compared to the retail point of sale.
Today, there is more of an incentive with the rapid increases in ATM fraud rates from magnetic stripe skimming, combined with PIN capture via shoulder-surfing, pinhole cameras and false fronts. Additionally, MasterCard and Visa have published fraud liability shift dates that directly apply to ATM owners. Some debit networks, too, have implemented liability shift dates; ask the network(s) supported about their policies. If ATM owners do not change to chip technology by the designated dates, they could risk taking on additional fraud liability.
For those reasons, many ATM owners are now starting to plan or are in the midst of ATM transition plans and/or implementation. There are many considerations and requirements for EMV migration at the ATM.
One of the first steps in the ATM transition to EMV is to take a detailed inventory of your current ATM fleet. Begin by determining the makes and models of ATMs and the firmware/software in use on those ATMs. With this information, you can decide whether you can upgrade current ATMs, or if you will need to replace them.
Some terminals in the field today have equipment (such as chip readers) and software upgrades available so that the ATM can be made EMV compliant. If upgrading ATMs, be sure to allow time in the project schedule for getting budget approval and for ordering and installing the required new parts or devices.
Other terminals in the field are older and EMV-related parts cannot be obtained, or the cost to upgrade to the required components is too expensive compared to the cost of replacing the ATM. If your ATMs fall into this category, they will be need to be replaced with models that support EMV. When replacing an ATM, you should also think about physical changes needed in the immediate surrounding area. For example, replacing through-the-wall ATMs may mean remodeling at the branch in order to accommodate terminals with different dimensions. Its important to plan for such changes in your project plan and budget.
ATM owners have an opportunity during EMV transition to re-evaluate the supported types of ATMs (manufacturers and models), and the number and location of ATMs in the network. For every unique ATM type an acquirer supports, there are direct costs (e.g., equipment purchase price, third-party service agreements, vendor maintenance agreements and certifications) as well as associated costs (e.g., a test lab with representative terminals, in-house expertise, development that is specific to each terminal make and model). When evaluating those costs, institutions may determine that the cost of replacing some terminals is offset by the savings realized by supporting fewer terminal types.
ATM owners are responsible for multiple levels of certifications. The payment networks also have requirements that are designed to test functionality that is important to those networks, and ensure that EMV data is handled correctly by the terminal and the network as per the networks specification. Those certifications will not cover all types of testing that an ATM owner, acquirer or issuer will need to perform. Regression testing, new feature testing, specific EMV testing, performance testing, volume testing and stress testing may be needed before certifying with a payment network. Certify the exact ATM configuration and software that will be used in production; therefore, internal testing should be completed before initiating formal certification with the networks. It is likely that ATM vendors have already obtained all EMV approvals, and that the network certifications will be completed by the ATM processor.
Customer experience is another critical aspect of the EMV transition, and ATM providers should first consider if/how the ATM experience will change for customers using a magnetic stripe card versus those using a chip card; on-us customers versus off-us customersand whether ATM transactions will be acquired as EMV transactions for all cardholders (including on-us) or just off-us cardholders; and customers using a motorized card reader versus a dip card reader
If there is a low volume of chip cardholders transacting on the ATM fleet, you may want to work with the application providers to limit customer experience impacts to those customers using a chip card while not impacting magnetic stripe card users. By adopting that strategy initially, the customer base will not be impacted until they are issued chip cards.
Once you determine that the impact on chip cardholders is no longer acceptable, a different approach may be needed. For ATM owners with motorized card readers in their ATM fleet, this approach will be transparent with regards to how the card is managed throughout the customers session, because the card stays in the ATM device as long as necessary to communicate with the embedded chip.
ATM owners with dip card readers in their ATM fleet may use one of two options: The dip card reader can be configured to clamp down (i.e. hold onto the card) at initial card insertion. If the reader detects that the card is a chip card, the reader will continue to hold the card until the transaction is complete. If the reader does not detect a chip, the card will be released so that it may be withdrawn and the magnetic stripe data can be read to begin the transaction. An alternate approach for dip readers is the double dip method. This approach allows all customers to dip and remove the card, enabling the application to read the magnetic stripe data to determine if the card being used is a chip card (via the Service Code). Customers using chip cards are then prompted to re-insert their card. At that point, the dip card reader will clamp down (i.e., hold on to the card) for the duration of the transaction. Customers will then need to be notified when to remove their card.
Switching to EMV is a large and challenging project. Every ATM owner and operator will undoubtedly have unique needs. To comply and avoid taking on additional fraud liability, ATM owners and operators should begin planning their transition as soon as possible. I encourage each ATM owner-operator to work closely with vendors, processors and payment network representatives to ensure a smooth transition to EMV.
Randy Vanderhoof serves as director of the EMV migration forum.
