Gasoline retailers have three years to upgrade their pumps to accept EMV chip-based payment cards, but most are having a difficult time convincing themselves the cost to do so will be worth it.
The major card brands have set October 2015 as the EMV liability shift date for retail merchants, but fuel companies have two extra years during a smart-card migration to convert the numerous pumps involved.
Two years ago, the National Association of Convenience Stores reported the average card fraud costs at fuel pumps at each store was about $700 a year, but their Payment Card Industry security standards costs were going up to about $2,000 a year. A 2013 report tallies fraud costs for the industry at about $250 million a year.
And given the average cost of EMV conversion of between $6,000 and $10,000 a pump, the fuel industry faces an expensive overall risk environment.
"It's probably the worst business case that exists in the retail industry," said Steve Mott, principal of BetterBuyDesign, a Stamford, Conn.-based consulting firm. "What the card brands are trying to do to secure America is really costly for these small guys at convenience gas stations."
Fuel retailers basically aren't sure what to do regarding payment acceptance methods, Mott said. To consider an EMV conversion, as well as Near Field Communication in different forms, and mobile or Bluetooth low energy options, a fuel retailer could be staring at upgrades of up to $200,000 at a pump, Mott added. "But whether it is $2,000 or $20,000 or $200,000 per pump for each of those pumps, nobody is seeing a return on investment for it."
The EMV conversion started in Europe in the early 2000s, with liability shifts for retailers in 2005 and 2006, and for ATMs and gas pumps in 2008.
Essentially, all gas pumps in Europe now have EMV terminals. Smart card provider Gemalto announced this week it was issuing the first branded EMV smart cards to the AS24 unit of French fuel company Total Group. AS24 has a network of EMV terminals at 750 fuel stations across 27 countries.
Gemalto said the partnership with AS24 illustrates how convenience store retailers can convert their private label portfolio to EMV as part of the migration.
But it all starts with having the terminals prepared, something European retailers have been working on for the past decade.
"We may have three years before we have to go to the automatic fuel dispensary engagement with EMV, but I just think it is still cost prohibitive," said Bill Deichler, a payments industry expert and former payments manager for Murphy Oil USA fuel company.
Deichler has long stated that EMV at the gas pumps will be an expensive venture, one many fuel companies will approach slowly, even with the extended 2017 liability shift timeline.
Murphy Oil plans to be complete its EMV migrations inside convenience stores by Oct. 1 of 2015, but will upgrade EMV at the pumps on a "replacement basis or new site basis," Deichler said of his former company's strategy.
As the October 2017 liability shift date nears, fuel companies will likely examine which geographic areas are posing the most fraud problems, and concentrate on those first to reach compliance, Deichler added.
"Murphy was estimating that it would cost $20 million to $25 million to make the whole chain EMV capable at the pump," Deichler said. "That means you are looking at about a 10- to 15-year payout on fraud numbers. It makes no sense."
Basically, fraud would have to get a lot worse for gas station owners to perk up to the thought of an EMV conversion, said Tim Sloane, director of emerging technologies advisory services for Boston-based Mercator Advisory Group.
"Everyone expects that fraud to go up as EMV gets more consistently rolled out, and gas stations are still accepting mag-stripe," Sloane said. "So those that don't have EMV will have to accept that pain."
Still, one large gas station franchise told Mercator that it was going to cost $6,000 per pump to send a technician out to prepare it for EMV acceptance, Sloane said. "If that is accurate, you can understand why a fuel company would be slow to go after EMV."
Other payment technologies are coming into play as well, so fuel retailers will certainly be open to ideas about mobile payments that could leapfrog EMV in the two years before the liability shift, Sloane said.
"A broad-based open network at a gas station is going to take a long time to develop, but there is already the possibility that tokenization technology might better enable gas stations to upgrade without having to touch every pump," Sloane added.
Use of a Bluetooth low energy tag on the pump as a way to pass payment credentials, but never a personal account number, might be a strategy for gas stations to implement, Sloane said. "It could help reduce costs, but it is far off and helps only those using mobile devices to pay."
EMV expense would be especially problematic for gas stations that already rely on a less expensive payment method to allow them to offer customers discounts at the fuel pumps.
Decoupled debit, linked to a consumer's checking account, remains a popular choice for gas stations looking to cut expense through automated clearing house payments.
Gulf Oil/Cumberland Farms, for example, operates SmartPay decoupled debit, giving consumers 10 cents off at the pump.
Chevron and Shell stations report using the Visa Transaction Advisor technology that allows it to flag an odd purchasing pattern at the unattended pump, forcing the consumer to go inside the convenience store to complete the purchase. The strategy is that a fraudster is not going to take a chance on completing a transaction with a fraudulent card at the retail POS.
For now, fuel retailers at least have a little extra time to formulate a strategy, one that could still be categorized as "wait and see."
"No one is going to send you to jail for not having EMV," Mott said. "You accept the fraud for a while and wait to see what technology comes out at the pump."