Article

Torching mom and pop

With the major card schemes looking to offload up to $6B in annual card fraud beginning this year, the EMV risks to 'mom-and-pops' will grow exponentially.

May 21, 2015

by Daryl Cornell, CEO, Triton Systems 

Small businesses gone, flushed, buried. Families sobbing on camera as the American dream is snatched away, allegedly by greedy banks, heartless credit card schemes and uncooperative ISOs.

Congress mobilizes and hearings begin to determine how to protect the poor small merchant constituent from fatal financial harm. A dueling battle of headlines ensues as banks scream, "We told you so!" and "You've had five years to prepare!" Merchants plead ignorance, banks, MasterCard and Visa mobilize to protect their reputations and the blame gets pinned on ...

ISOs?

How likely is it that ISOs and IADs will be caught in the liability shift crosshairs and thrown under the bus beginning this October? Unfortunately, it's increasingly looking like that could be the case.

In the absence of a U.S. EMV mandate, and with merchants either unaware of or unconcerned about liability shift, we have seen very little small merchant movement towards EMV.

In general, ISOs and IADs have been consumed with planning and upgrading their own terminals. And while larger merchants are in many cases upgrading for EMV, it may already be too late for the small merchant given the current liability shift deadlines as follows:

POS liability shift — After Oct. 1, 2015, all card present fraud at the POS will be shifted to the "non-EMV link in the chain."

On the merchant side, estimates run as high as 70 percent of independent business owners who have no idea that in seven months they will be responsible for fraud on their non-EMV POS terminals.

The latest surveys also show that more than 70 percent of card issuers will be EMV compliant by year-end, and processors claim that they will be ready. This means that it will probably be early 2016 when we see the first highly publicized merchant liability shift claims.

While much of the POS card present fraud will be relatively lower dollar transactions, up to ninety days of cumulative chargebacks can ratchet up those claims significantly. This is when the fireworks start.

ATM liability shift —After Oct. 1, 2016 (MasterCard), and Oct. 1, 2017 (Visa), non-EMV ATMs will be charged back for card fraud when a customer's EMV card "falls back" to magnetic stripe.

This is perhaps the most worrisome of the three chargeback scenarios as ATMs dispense cash and are the highest profile targets for fraudsters with cloned cards and harvested PINs.

Many merchants own their ATMs, which are often serviced by IADs. Failure to upgrade an ATM to EMV may expose the owner to devastating, six-figure chargebacks as we saw recently in Canada.

Unless the IAD, the processor, or the sponsor bank makes the decision to deny magnetic stripe transactions following liability shifts, we will almost certainly see merchant chargeback carnage.

Gas liability shift — Oct. 1, 2017 is the date after which non-EMV gas pumps will be charged back for fraud when a customer's EMV card "falls back" to magnetic stripe.

Non-EMV gas pumps will also be high-profile targets for fraudsters, as incidents of internal and external card skimming at the gas pump have continued to grow.

As with ATMs, newer gas pumps can be upgraded fairly easily for EMV, while older pumps may require wholesale unit replacement.

However, unlike ATMs, many gas pumps are connected to back-office systems that also must be upgraded or replaced — not an inexpensive proposition, and one likely to be ignored by many small merchants at their own financial peril.

According to NACS, nearly 60 percent of all convenience stores that sell fuel in the U.S. are single-store businesses. Nearly all of these stores also have POS devices at the counter, and many own their own ATMs.

With MasterCard, Visa, American Express and Discover looking to offload as much as $6 billion in annual card fraud beginning this year, the EMV risks to "mom and pop" will grow exponentially. EMV ignorance, liability shift denial, and a lack of financial resources to upgrade terminals means that many of these small businesses will be torched.

This article has been republished from the Triton blog, atmAToM, with permission from Triton.

Included In This Story

---

Triton Systems

Triton FI based products • NO Windows 10™ Upgrade • Secured locked down system that is virus/malware resistant • Flexible configurations - Drive-up and Walk-up • Triton's high security standards • NFC, anti-skim card reader, IP camera and level 1 vaults are all options • Triton Connect monitoring • Lower cost

Request Info

Learn More