News

Triple DES and the small c-store

April 24, 2005

If you own an independent convenience store, the last thing you want to worry about is ensuring your ATM is Triple DES compliant. Even the name "Triple DES" sounds incomprehensible to folks on the periphery of the financial transactions world.

Triple DES is the requirement set by MasterCard and VISA for ATMs that tie into their networks. Briefly, it stands for the shift from one round of data encryption for ATM PIN entry to three rounds.

The most recent deadline for Triple DES compliance was April 1, which many smaller operators missed. But the deadline has been extended to December 2005 (and to 2006 for some).

This story and all the great free content on ATM Marketplace is supported by: WRG

Dennis Baker, an ATM distributor who works with Pittsburgh-based Giant Eagle grocery chain and about 50 independent retailers, said most c-stores can still make the deadline if they start now.

Bryan Stewart, president of ATM equipment provider ATM Express Inc., agreed.

"Most of the sales guys who work for the distributors don't talk with the c-stores after the equipment is sold, and many of those c-stores don't know what's expected of them," said he added.

And that makes them vulnerable.

Buyer beware

According to Baker, smaller retailers may be taken for big bucks when it comes to buying upgrade kits.

"People who run mom-and-pop stores are more interested in selling their groceries and just surviving than worrying about whether their ATM is compliant," Baker explained. "For most of them, the ATM is just an afterthought."

Tammie Kuhn, director of sales and marketing for Ohio-based ATM manufacturer and processor WRG Services, said most independent c-stores have older ATMs that will need to be upgraded or replaced to comply with Triple DES requirements. But the owners of those stores are relying on third-party companies that offer to help before they consult their processors.

"Most mom-and-pops aren't aware of the extension for Triple DES, and these companies are trying to scare them into upgrading their machines before they need to be upgraded, or they're just trying to flat-out sell them new ATMs without acknowledging the fact that some of those ATMs can be upgraded," said Baker, a WRG distributor.

Dave Eager, WRG's general counsel, said third party companies target smaller retail operations. "Basically, it's a tactic to drum up business, and some of these mom-and-pops may be scared into buying kits or signing deals," he said. "But if they enter into an (upgrade or replacement) agreement with an outside company, they would be breaching the contract they have with their current processor, and that could get them into some legal trouble."

Eager's advice: "Any c-store owner who receives information for Triple DES upgrades needs to contact their current processor to be sure they can comply with the requirements by the compliance date."