EMV Liability Shift for ATMs Starts October 21

EMV Liability Shift for ATMs Starts October 21
Posted: Oct 5, 2016
Comments: 0
Author: Lou Grilli

The Facts and Myths That Every Credit Union Should Know

Another liability shift related to the U.S. adoption of EMV is facing banks and credit unions. As of October 21, 2016, ATM acquirers, whether they are banks, credit unions, third-party or ISO-owned, will bear the liability for fraud committed at ATMs that have not been EMV-upgraded (that is, ATMs not capable of reading and processing chip cards) and a MasterCard-branded card is used. The same concept of shifting liability to brick and mortar merchants who have not upgraded their point of sale terminals took place last October. And like the last liability shift – this is not a mandate. Even with a full 12 months of EMV conversions in the rear view mirror, only 40%-45% of POS terminals have been upgraded. Upgrading ATMs in most cases is even more involved than upgrading POS terminals. According to Credit Union Times, the cost to upgrade an ATM can be up to $3000 each, and the project to perform the upgrade is a 9 to 12 month endeavor. Any bank or credit union that did not start the upgrade project by the beginning of this this year does not have a reasonable chance of meeting the upcoming liability shift date. So is it game over even before starting? Not really.

By the numbers

The liability shift in this case is only for MasterCard-branded cards. And the type of cards mostly (almost solely) used at ATMs are debit cards. There are roughly 110 million MasterCard debit cards issued in the Unites States of which approximately 40% will have been reissued as chip debit cards by the end of the year. So while the big EMV liability shift last year impacted debit and credit cards, for every brand (Visa, MasterCard, AmEx, Discover), at every merchant POS location (approximately 14 million), this liability shift is much smaller in scope. It impacts approximately 43 million cards used at approximately 400,000 ATMs. Keep in mind that the liability shift addresses only counterfeit card usage (not lost/stolen). This means that the ATM owner will bear the liability in the case where a fraudster has obtained the mag stripe data from a legitimate chip card and created a counterfeit card with the mag stripe data of the good card, obtained the PIN, and used it at an ATM. Not that this can’t or doesn’t occur. Counterfeit fraud at bank and credit union owned rose 174% from the first four months of 2015 versus the same period the year prior, according to data provide by FICO. In one extreme case in Japan earlier this year, thieves used 1600 counterfeit cards across 1400 ATMs owned by one major bank to obtain (USD) $13 million in a two hour period. If those cards were chip cards and the ATMs were EMV enabled, that kind of attack could not have happened. But as big as counterfeit fraud at the ATM is, it pales in comparison to the 546% rise in the number of skimming cases at ATMs. Skimming is the installation, by a criminal, of a magnetic read head placed out of sight to capture the mag strip of a card as its being inserted into a card slot, such as ones found at ATMs and gas pumps. The data is stored on memory devices that can be removed by the criminals or read wirelessly by the criminals from a nearby parking spot. The more sophisticated skimmers can go weeks before being noticed while capturing thousands of card data.

Does upgrading the ATM to EMV prevent skimming?

The quick answer is “not really”. If fraudsters install a skimmer to capture the mag stripe, and a camera to capture the PIN, and there’s subsequent fraud for cards that were counterfeited using the skimmed data, the ATM owner is not liable for that fraud.  Unless, however, the fraudster came back to the ATM with a counterfeit card and used it to take money out of the account. It's important to note that the liability shift applies only to counterfeit cards used at an ATM and not for other types of fraud such as skimming or malware attacks on the ATM software, or cyber attacks, etc. And upgrading the ATM to be EMV capable doesn’t necessarily prevent skimmers even though current models do have several anti-skimming features designed to thwart today’s generation of fraudsters.

So, should a credit union upgrade the ATM?

The quick answer this time is “yes”. In the short term the answer is based on the credit union’s or bank’s tolerance for risk versus the cost for upgrades. But the more complete answer is that the migration to EMV is inevitable, for credit and debit cards, for merchant terminals, and for ATMs.  While it’s true that the liability shift in October 2016 does not represent the sea change that last year’s caused. But Visa has a similar liability shift in October 2017. And Visa has about two and a half times more debit cards than does MasterCard. Also, by the time the Visa liability shift occurs next year, the percentage of debit cards that will have been reissued as chip cards (shifting fraud liability to the ATM owner), will be closer to 80%. And given the nearly year-long project to complete the upgrades (assuming the project hasn’t already been kicked off) now would be a good time to analyze traffic and usage patterns of your current fleet of ATMs, determine which ATMs are end-of-life and which are worth upgrading, assess ATM hardware/software vendors as well as ATM servicing vendors, and even look at if there are better (and safer) locations for your ATMs.

If you have older generation ATMs in your network, smart ATMs that allow deposit of envelop free cash and checks, and ATMs that provide additional cardholder services may make sense while upgrading to EMV. In the meantime, check out some steps credit unions can take right now to help reduce fraud at the ATM from this previous thought leadership posting.

Rate this article:
Lou Grilli

Lou GrilliLou Grilli

Lou is the AVP of Product Development & Thought Leadership at Trellance and is responsible for providing leadership to the organization on emerging payments and industry trends, as well as managing the product portfolio.

Other posts by Lou Grilli

Full biography , Contact author

Please login or register to post comments.


Featured Stories