HOUSTON—While the most important and far-reaching ATM liability shift deadline arrives next year, one payments expert cautions that waiting too long to upgrade to EMV-ready machines can be costly—in terms of lost fraud chargebacks and crooks zeroing in on outdated technology.
“Although there hasn’t been a lot of buzz about EMV switchovers at the ATM, this is going to be something that credit unions will want to pay close attention to as we move toward the October 2017 final liability shift deadline for all networks,” said Gary Walston, co-founder of Dolphin Debit.
The first ATM liability shift deadline recently arrived (Oct. 21), established by the MasterC\card and Shazam networks. Walston believes credit unions did not pay a great deal of attention to that deadline, and he is cautioning them not to take the same stance on the final liability shift deadline next year, established by Visa.
Low-Key Transition
“Part of what has kept this ATM transition low key is that there is no law, no mandate, nor any network requirement that credit unions have to meet with their ATMs as far as EMV is concerned,” said Walston. “It’s simply a transfer of liability for fraud,” the same situation issuers faced in 2015.
Walston acknowledged that with the issuer liability shift deadline in 2015, many credit unions did not rush to convert their entire card base to EMV, thinking that since card issuers have always carried the liability for fraud, they did not feel a great deal of pressure to convert.
Gary Walston
But Walston cautions CUs not to make that same assumption with the ATM liability shift deadlines, since they bring with them some additional fraud exposure that did not come with the card deadline.
“There is one important distinction that credit unions need to be aware of—when it comes to ATMs, once liability shifts a credit union will be considered the acquirer for non-member usage of the ATM, or foreign transactions,” said Walston. “That creates some exposure for the credit union that it didn’t have previously.”
Walston explained that as with the October 2015 liability shift deadline, ATM liability falls on what is considered the weakest link in the payments chain.
“So liability will shift to the ATM owner when a chip card is used at an ATM that has not been upgraded for EMV transactions. If the card used is still mag stripe only, the issuer will retain the liability, just as they do today,” he said.
Fewer Concerns
Walston said that the October 2016 ATM liability shift deadline brought with it less concerns for ATM owners than what’s coming next year.
“For the moment, the number of transactions at issue in light of the Mastercard and Shazam network liability shift is limited to transactions that route to those networks,” Walston said. “Most issuers participate in more than one network. So, the vast majority of foreign transactions will route through a regional network, reducing the number of transactions exposed to the current liability shift.”
But in 2017, the risk exposure will grow for those that don’t make the switch, as more credit unions and more banks convert their machines. Walston warned that crooks will zero in on the old ATMs.
“Because EMV cards offer increased security, that will change fraudsters’ tactics,” he said. “As they try to take advantage of duplicated cards while they still can, they are going to be looking—as burglars do— for the ‘unlocked door,’ which is what the non-EMV ATMs represent.”