TAMPA, Fla.—The Mastercard ATM liability shift arrives Oct. 21, and one expert says it’s time credit unions that have not upgraded to chip-enabled machines begin doing so.
Lou Grilli, director of payments strategy at CSCU, advised credit unions to make the switch not simply because the Mastercard deadline is here, but to prepare for Visa’s ATM liability shift in a year, which involves more debit cards and can lead to even greater fraud exposure. He also recommended that when changing out ATMs it’s worthwhile to consider upgrading machines to include more convenience features, such as envelope-free deposits.
Grilli reminded that while the Mastercard’s liability shift is not a mandate, with it comes greater potential for fraud losses for those that don’t meet the deadline. ATM acquirers will bear the liability for fraud committed at ATMs that have not been EMV-upgraded—that is, ATMs not capable of reading and processing chip cards—when a Mastercard-branded card is used.
Grilli acknowledged that the transition can be expensive and takes from nine to 12 months to perform an upgrade. But he noted that if the credit union has not yet started the transition, there is still time.
“The liability shift in this case is only for Mastercard-branded cards. And the type of cards almost solely used at ATMs are debit cards,” said Grilli on CSCU’s The Payments Review blog. “There are roughly 110 million Mastercard debit cards issued in the Unites States of which approximately 40% will have been reissued as chip debit cards by the end of the year. So while the big EMV liability shift last year impacted debit and credit cards, for every brand—Visa, Mastercard, AmEx, Discover—at every merchant POS location (approximately 14 million), this liability shift is much smaller in scope. It impacts approximately 43-million cards used at approximately 400,000 ATMs.”
Grilli said to keep in mind that the liability shift addresses only counterfeit card usage.
“This means that the ATM owner will bear the liability in the case where a fraudster has obtained the mag stripe data from a legitimate chip card and created a counterfeit card with the mag stripe data of the good card, obtained the PIN, and used it at an ATM,” he said. “Counterfeit fraud at bank and credit union owned ATMs rose 174% from the first four months of 2015 versus the same period the year prior, according to data provide by FICO.”
Grilli also noted that the new chip-capable ATMs do not prevent skimming, which has been rising dramatically in the U.S. as crooks turn to old-school methods to steal card data as EMV takes hold in this country.
While Grilli suggested it is time now for all credit unions to move to upgrade their ATMs, he acknowledged that the decision is also based on the credit union’s tolerance for risk versus the cost for upgrades.
“But the more complete answer is that the migration to EMV is inevitable, for credit and debit cards, for merchant terminals, and for ATMs,” said Grilli. “It’s true that the liability shift in October 2016 does notrepresent the sea change that last year’s caused. But Visa has a similar liability shift in October 2017. And Visa has about two-and-a-half times more debit cards than does Mastercard. Moreover, by the time the Visa liability shift occurs next year, the percentage of debit cards that will have been reissued as chip cards—shifting fraud liability to the ATM owner—will be closer to 80%. And given the nearly year-long project to complete the upgrades—assuming the project hasn’t already been kicked off—now would be a good time to analyze traffic and usage patterns of your current fleet of ATMs, determine which ATMs are end-of-life and which are worth upgrading, assess ATM hardware/software vendors as well as ATM servicing vendors, and even look at if there are better locations for your ATMs.”