EMV smart-card migration preparations in the U.S. will take on a more serious tone when the responsibility of covering fraud losses begins to shift.
The first such liability shift in the U.S., albeit a fairly small one, takes place April 19 when MasterCard requires that ATM owners and operators be capable of accepting internationally-issued EMV Maestro cards.
In late 2011, MasterCard announced the Maestro card deadline for ATM operators, citing pressure from European issuers about potential fraud incidents in the U.S. The card brand followed that announcement a year later by establishing an Oct. 1, 2016 deadline for ATM operators to accept all MasterCard EMV products.
MasterCard casts the April 19 date as a "milestone that each ATM operator and acquirer would address based on their individual priorities," according to a prepared statement the Purchase, N.Y. card brand provided.
"The liability shift program is not the end goal, but instead a tactic toward the end goal of preventing fraud by giving all parties a stake in applying the highest level of security," MasterCard adds. "We are satisfied with the current progress, including our work with several banks, non-banks and processors that will upgrade their systems either before or shortly after April 19."
The ATM Industry Association, a trade group, says it needs clarity on some of MasterCard's expectations.
The ATMIA is trying to get MasterCard to clarify how the ATM operators can be prepared to accept the Maestro EMV cards on a specific date, while network rules do not allow the ATM to deny individual brands from transactions, says David Tente, executive director of the U.S. chapter of the ATMIA.
"If you have to upgrade for one card, you have to upgrade for all of them," he says. "The Maestro card is bundled in with those rules," making it hard for an ATM owner to consider an upgrade that may accept only Maestro EMV cards now and others later.
"Wells Fargo has already said they are not upgrading their ATMs at this time, and I'm not aware of any other banks preparing for this, and I talk to a lot of them all of the time," Tente says.
Even though this particular liability shift does not represent a lot of U.S. transactions, maybe 1% overall, it is still addressing potential fraud and making ATM owners liable who previously were not, says David Albertazzi, a senior analyst and ATM expert with Boston-based Aite Group.
"The deadline will affect banks, merchants and ISOs that own ATMs," Albertazzi says. "In the past, the issuing bank was liable, but now a bank with ATMs that is not a card issuer is going to have liability."
Nearly two months ago, the National ATM Council Inc. requested that MasterCard extend its April 19 deadline, mainly because the industry was still debating the development of a common code for EMV debit transactions. A spokesperson for the council was not available for comment.
Visa recently released its EMV deadlines for ATM transactions, opting for a sequence of dates, with an April 1, 2015 deadline for U.S. third-party acquirer processors and sub-processors to be able to support EMV chip data. That mandate sets the stage for an ATM liability shift on Oct. 1, 2017 for U.S. acquirers and issuers for all ATM transactions.
Sam M. Ditzion, CEO of Boston-based ATM industry consulting firm Tremont Capital Group Inc., says ATM owners have some difficult decisions to make in the coming weeks and months.
"ATM owners can either upgrade their machines, shut them down altogether, break MasterCard's rules and stop accepting Maestro transactions, or roll the dice and take a chance on becoming a victim of fraud, which could have dangerous consequences," Ditzion says.
But there's another catch that ATM owners will find frustrating at this time, he adds.
"Even if all ATM owners wanted to invest in EMV upgrades today, which is not the case, it would be impossible because the necessary certifications and requirements are not yet finalized," Ditzion says.
Diverse stakeholders in the U.S. payments industry have to agree on all of the details, including the common EMV debit code, he adds.
"A delay in the liability shift, in order to allow for collaboration among all networks to find the best possible solutions and unified timeframe, seems like a mutually beneficial compromise for all stakeholders involved," Ditzion says. "EMV is extremely technical and complex, and rushing its implementation could end up costing the industry far more than people are anticipating."
Despite all of the concerns, Albertazzi says one key factor cannot be changed.
"The U.S. is one of the last countries to do an EMV conversion, and this [April 19 deadline] represents the first liability change step, so there is some motivation to do it," Albertazzi says.