Americans are whiners.

This was my grudging conclusion after a recent four-day visit to the UK, during which I took a crash course in the British ATM market by meeting with representatives of a dozen or so companies there.

Knowing that the UK market faces the same deadline for conversion to Triple DES encryption as the States, coupled with a similar deadline to convert magnetic stripe cards to chip cards, I assumed that I would encounter plenty of negativity when I asked about this regulatory double whammy.

After all, many conversations about Triple DES in the U.S. never advance past the "why do we have to do this" stage, and those that do tend to focus on the difficulties of conversion or how to get a variance.

Ann All

Maybe it was nothing more than the famous British reserve, but what I heard in the UK was assurances that all involved understood the importance of boosting the security of the payments system, along with cautious optimism that the 2005 deadlines for Triple DES and EMV (the international chip card standard, named after its creators, Europay/MasterCard/Visa) would be met.

A bit easier in the UK

Ron Carter, product marketing manager for Thales e-Security, a provider of host security modules (HSMs) among other security-related products, said that most UK banks chose to focus first on compliance at the host level.

"That's the big important one to get," Carter said. "At the end of the day, they will take it out to the terminal level as well."

In addition to the fact that most UK banks drive their own machines -- which gives them more direct control over compliance issues -- the fact that there is just one network in the country will facilitate conversion. That network, LINK, has been a major driver in moving ATM deployers toward action. And it doesn't hurt that the UK has far fewer ATMs -- about 40,000 in contrast to the U.S.'s more than 350,000 -- and deployers.

Still, that doesn't minimize the cost and complexity of the effort.

Simon Rubin, NCR's vice president of marketing for EMEA (Europe/Middle East/Africa), estimates that Triple DES conversion efforts have cost the UK ATM industry about 25 million pounds ($40 million) in the past six months, with more to come in 2003. According to the UK's Association for Payment Clearing Services (APACS), conversion to chip/PIN will cost banks and retailers an estimated 1.1 billion pounds (about $1.7 billion U.S.).

These efforts will quickly pay for themselves, however, considering that the UK's fraud losses for 2002 are expected to total 430 million pounds (about $686 million U.S.).

Chip/PIN combo

As an added fraud deterrent, the UK will combine chip with PINs at the point-of-sale, an alien concept until now because of prohibitive telecommunications costs. Currently, many retailers offer cash back at the point-of-sale with just a card and a signature (!). With chip cards, however, PIN verification will reside in the chip itself, so authentication can occur offline.

UK card issuers and acquirers first began discussing the need for improved card security in 1995. Annual fraud losses on UK-issued cards had grown from 45 million pounds (about $72 million U.S.) in 1989 -- the year that marked widespread acceptance of credit/debit -- to 83.3 million pounds (about $133 million U.S.) in 1995.

In 1999, UK issuers began rolling out chip cards, with a goal of converting the payments system -- including POS terminals and ATMs -- to accept them by 2005. According to APACs, more than 38 million chip cards are already in circulation.

The cards feature both a chip on the front and a magnetic stripe on the back; magnetic stripes will both serve as a "back-up" if PIN authentication via chip fails and allow cardholders to use their cards in non-chip countries like the U.S.

Next stop, U.S.?

How long will the U.S. continue to rely on the magnetic stripe for card security? An intriguing question, considering that many other parts of the world -- especially in Europe and Asia, where fraud losses have been growing at a rapid clip -- are fast tracking their plans to convert to chip.

"If the whole world except the U.S. goes to chip, guess where the fraud will be?" asked Thales e-Security's Carter. "The criminals will migrate to where it's easiest."

Bank of America announced at the recent Cartes show in Paris that it intends to issue a chip card within 18 months. In her address at the ATMIA Summit in San Diego, Calif., last month, NYCE executive vice president Susan Zawodniak, opined that just one more major card fraud incident, like the high-profile case of ATM skimming in New York City earlier this year, would be enough for U.S. networks to begin pushing for chip. (See related story Skim skam man)

If and when that happens, perhaps the U.S. should look to the UK's example of grace under pressure.

And while sticks are generally far more effective than carrots when it comes to compliance, chips do offer the possibility of offering multiple applications on a single card, including loyalty programs (coveted by retailers, whom all in the industry agree will likely be the holdouts when it comes to conversion).

In fact, Martin Macmillan, chief executive of Level Four Software, believes that ATMs would be an ideal distribution platform for loading applications onto cards, at least partially because queuing is likely to be less of an issue at ATMs than in busy retail checkout lanes. "You could even print out coupons at the ATM," he said.

(For more on my visit to the UK, check this space next week.)