News

Refurb shops see upgrades in their DEStiny

Most refurb shops expect to do a healthy business in upgrading ATMs to meet Triple DES requirements mandated by MasterCard. Some shops are also experiencing an uptick in new equipment sales as their customers adopt a 'better to be safe than sorry' attitude.

September 4, 2003

At Bear Financial Equipment, Ed Hovan usually sells one brand new ATM for every 10 refurbished machines.

But in recent months, the president of the LaGrange, Ky.-based refurb shop has noticed a dramatic change in the equation. "During the past three weeks, I've sold 14 new ATMs and only two refurbs," he said.

While companies sometimes hire consultants to help them explain such shifts in sales patterns, Hovan doesn't need a flow chart or a market analysis. "It's Triple DES," he said, attributing the change to financial institutions fearful that not all older ATM models can be upgraded to meet MasterCard-mandated requirements to run Triple DES encryption.

ATM networks and processors don't have to use Triple DES for PIN-based transactions until April 1, 2003, and the final "drop dead" date for compliance isn't until April 1, 2005.

But MasterCard began requiring newly-installed ATMs -- including those that are relocated -- to be Triple DES capable beginning last April. In its Global Deposit Access Operations Bulletin, No. 3, dated March 29, 2002, MasterCard defined Triple DES capable as "capable of processing Triple DES at the point of interaction."

Hovan said his customers, primarily credit unions and community banks who purchase full-function ATMs, "want to make absolutely sure they've got something that will work" and satisfy MasterCard requirements.

The confusion is understandable, Hovan said, despite the fact that Triple DES upgrades on popular fourth-generation ATMs such as NCR's 5600 series and Diebold's i series will likely be uncomplicated and relatively inexpensive fixes.

Cost of compliance

Depending on the make and model and the type of processor in the machine, Hovan estimated an upgrade could cost as little as $2,000. In a worst-case scenario, he said, a customer could end up paying as much as $8,000 for a complete upgrade.

Hovan said the upgrades required for Triple DES may narrow the price gap between new and refurbished ATMs.

"Where you could get a refurb for about half the price of new, that won't necessarily be the case anymore. It will probably be more like 25 percent," Hovan said. "A lot of banks will think on that."

Customers in the best position, as far as upgrades are concerned, are owners of fourth- or current-generation ATMs with BTP processors, said Woody Alderman, president of Georgia-based Atlanta Computer Group. That fix would entail moving to a Pentium-level processor, adding an EPP (Encrypting PIN Pad) and installing the necessary software, Alderman said.

Henry Dorfman, executive vice president of ATM Exchange, agreed that customers whose ATMs have BTP processors will experience far less financial pain than those with STP processors.

"You're probably looking at a minimum of $5,000 to convert machines with an STP processor a CTP processor and then another $1,500 to convert to Triple DES," he said. "For a credit union in Nebraska doing 175 transactions a month, that kind of an upgrade is not going to pay for itself this decade."

Dorfman believes that up to 60 percent of his customer's ATMs have STP processors. "In many cases (the BTP processor) was offered as an upgrade not as a standard option," he said, "so you had machines sold as recently as last year with a STP processor."

While EPPs are available from both Diebold and NCR, neither manufacturer has begun providing the software necessary for complete upgrades, Hovan said. This is contributing to what he calls a "customer quandary" on whether to buy new machines, upgrade existing equipment or some combination of the two.

Firmware need not apply

Like Hovan, Jon Erpelding, president of Bloomington, Minn.-based refurb shop NuSource Financial, has experienced an uptick in sales of new equipment. However, he expects it to be temporary.

"Right now, (customers) are scared and they're buying new to be safe," Erpelding said. "When they become aware that they can purchase a refurb model that is Triple DES compliant, I think the fear will go away."

Erpelding said that some of his customers have begun pulling their third-generation, firmware-based machines such as NCR's 5000 series and Diebold's 9000 series and replacing them with fourth-generation models.

He believes that pending Triple DES requirements, as well as changes that may be required to comply with the Americans with Disabilities Act (ADA), will boost the popularity of workhorses like the NCR 5600, which has been a mainstay of the refurb business for several years.

"We're still selling a ton of those," Erpelding said. "Who knows how far a PC-based 5600 can take you? In theory, you can just keep upgrading those to take you wherever you need to go."

What's the alternative?

Alderman said he expects to see third-party alternatives to the manufacturers' upgrade kits before the April 2005 Triple DES deadline. "Problems create opportunities for people who can figure out creative ways to solve them," he said. "I think you'll have alternatives to the upgrades that are currently being deployed."

ATM Exchange hopes to sell one such alternative, called the DES Wizard, although the company is still waiting for MasterCard's approval.

Dorfman said that his company obtained exclusive distribution rights to the DES Wizard, which is manufactured by Thales e-Security. It has been utilized for PIN encryption in Latin America for several years, he said.

In contrast to the EPPs produced by the ATM manufacturers, in which the security modules where encryption takes place are located just behind the keypad, Dorfman said the DES Wizard's security module is connected to the keypad via two tamper-resistant, reinforced cables.

Even with an EPP, Dorfman said, the PIN is -- briefly -- in the clear. "There's still a gap of some kind. Whether it's a half-inch long or 12 inches long, what does it matter?"

Dorfman objects to the EPP because of the cost it will add to the keypad, which he said is one of the most oft-replaced parts on an ATM. "When your $100 keypad wears out, do you really want to be stuck for the whole (encryption) device? That's kind of like saying every time your car runs out of gas, you need a new engine," he said.

In addition to the need for network approval, Alderman said another possible snag to third-party encryption products like the DES Wizard may occur if manufacturers balk at providing service for ATMs outfitted with such devices.

No big whoop

Despite all of the angst over Triple DES, none of the four refurb shops have fielded many customer questions on pending changes to the ADA that will likely require deployers to add audio capabilities to their ATMs.

Dorfman said ADA is not as immediate of a concern to most deployers because of its relative uncertainty in relation to Triple DES. No deadline has been announced, and it's possible that some ATMs may not have to make immediate changes. "It's under the radar," he said.

Included In This Story

---

Diebold Nixdorf

As a global technology leader and innovative services provider, Diebold Nixdorf delivers the solutions that enable financial institutions to improve efficiencies, protect assets and better serve consumers.

Request Info

Learn More