As we ponder this question, consider the most recent ATM theft in which organized thieves drained more than $45 million dollars from ATMs worldwide in mere hours. By accessing bank databases, cyber-thieves were able to eliminate maximum withdrawal limits on individual accounts, load customer data onto any plastic card with a magnetic stripe (a hotel room key would suffice) and use them to withdraw millions of dollars in cities around the world. Such a scheme isn’t that difficult to accomplish with the magnetic stripe technology we use today.
The good news is that EMV is coming soon to an ATM near you. But “soon”
is a subjective term. Most industry experts agree the primary driver for EMV migration in the U.S. will come from issuers, as they’re the ones tasked with replacing more than a billion mag-stripe credit and debit cards. This won’t be a singular event – but rather an ongoing process, where expired cards will be gradually replaced with EMV chip card technology. The shift will be subtle, and the card-holder may not even be aware of the change.
Before issuers can start providing customers with EMV smart-cards, they need a plan for accepting them at terminals. The first step towards accepting EMV smart-cards at the ATM is typically an assignment of liability:
• MasterCard is the first in the U.S. to publicly declare that if fraud occurs on a transaction initiated through an EMV card on a MasterCard, Cirrus or Maestro network, then the ATM owner will be liable for that fraud if the ATM was not properly equipped to support EMV technology. Visa has also announced dates for liability shifts, and other issuers in the U.S. will soon follow suit.
• In Canada, Visa was first to shift the liability to ATM owners. Within two years, all cards from Interact members (Royal Bank of Canada, CIBC, Scotiabank, Toronto-Dominion Bank, and the Desjardins Group of Credit Unions) featured EMV chip-cards.
While the October 2016 deadline for compliance in the U.S. moves closer, the message is clear: It’s time to get ready for EMV. This shift, which can take up to a year to complete, involves hardware, software and professional services to ensure compatibility on the back end.