Article

Is MasterCard's EMV policy both a blessing and a curse?

Although it's another step toward adoption in the U.S., the timeline has some worried.  

September 22, 2011 by Kim Williams — Reporter, NetWorld Alliance

Following Visa's announcement last month that it plans to push the migration to EMV contact and contactless chip technology in the U.S., MasterCard countered with its own proclamation.

On Sept. 1, MasterCard announced that it will extend its existing EMV liability shift program for inter-regional Maestro ATM transactions to ATMs in the U.S effective April 19, 2013.

While most agree that the U.S. transition to EMV is no longer a matter of if but when, many industry players wonder if the 19-month timeline is too ambitious.

“I think that most people have come to accept the fact that an EMV-like mandate is ultimately coming to the United States, but stakeholders are still very confused by the exact dates and specific requirements,” said Sam M. Ditzion, CEO of Boston-based ATM industry consulting firm Tremont Capital Group.

According to MasterCard, the effort reinforces the company’s commitment to high-level security standards and consumer demand for global acceptance.

"To be clear, we are not mandating that U.S. ATMs must accept EMV cards. Rather, we are saying that if a chip card is presented at an ATM that does not accept a cross-border transaction, then the liability shift occurs," said Seth Eisen, senior business leader, U.S. Markets Communications, MasterCard Worldwide.

It may be a small step in the total adoption of EMV in the U.S. since it's only the Maestro Network, but according to Aite Group Senior Analyst Julie Conroy McNelley, it's definitely addressing something that is hurting the FIs today.

"As we have done research over the last six months or so, the survey responses we receive from banks consistently say that their biggest causes of pain are debit card CPP [common point of purchase] and corporate account takeover," McNelley said.

McNelley said that ATM skimming is a huge contributor to banks' debit card losses, and she believes the EMV announcement will go a long way toward that.

"The timeline was a little surprising to me, particularly with the capital expenditure required to upgrade to facilitate this. That's a blink of an eye in bank time. The estimates I've heard are that it's somewhere between $2,000 and $4,000 per machine," McNelley said.

MasterCard's announcement specifically targets inter-regional transactions, so U.S. banks won't necessarily be beneficiaries, however, this first phase could pave the way for a more comprehensive U.S. plan, once ATM owners go through the costs of upgrading to facilitate EMV.

“MasterCard’s 2013 liability shift establishes an extremely ambitious timeline, one that I suspect a large percentage of deployers simply won’t be able to meet,” Ditzion said.  “Deployers will need to weigh the upgrade costs against the unknown liability incurred by fraudulent transactions.”

Manufacturers, such as NCR Corp., with a presence overseas have expressed a readiness for the transition, having the software and architecture already built into many existing models. Bob Tramontano, vice president of marketing for NCR Financial Services, doesn't think the transition will be as painful as some may think.

"We believe that depending on the pace and sequencing that customers want to pick up that we'll be able to help ease the pain and offload some of the work to us, either to upgrade the units or to enable via software the capabilities they may already have on the unit," Tramontano said.

Contactless vs. chip-and-PIN

The announcement focused on contact cards, whereas the Visa announcement was aimed at contactless. According to McNelley, a lot of card issuers are saying that contactless is really their focus.

"Contactless can facilitate EMV as well, and they're [issuers] looking at mobile as the next wave and wanting to have technology that can enable that," McNelley said. "I think what this means in the long run is that ATM owners are going to be looking at separate upgrades because there's not a lot of inventory out there of contactless ATMs."

Tramontano agreed that EMV is a slightly different scenario in the U.S. because of the contactless trend.

"Depending on which version of requirements you're looking at, it adds a different layer of compliance. I think that the technology to do both is there, and the approach to do both is appropriate," Tramontano said. 

For more information on this topic, visit our EMV research center.