The Mastercard and Visa decisions to move the liability shift for EMV migration at the fuel pump from October 2017 to October 2020 created an additional fraud-concern period for credit unions.
“The unique challenges facing the retail petroleum industry in upgrading their outside pay-at-the-pump systems to EMV have been an active part of the EMV migration discussions over the last year within the U.S. Payments Forum and its Petroleum Working Committee,” Randy Vanderhoof, director of the U.S. Payments Forum, said. “Given the migration challenges for implementing EMV in the petroleum environment, Visa’s and Mastercard’s modification of the liability shift dates will be beneficial to the retail petroleum industry and the U.S. chip migration.”
In its announcement, Mastercard said, “EMV compliance for fuel merchants with Automatic Fuel Dispensers brings significant regulatory and implementation challenges. Over the past months, we have had extensive discussions with fuel merchants, issuers, acquirers and other stakeholders regarding these unique challenges.”
In its statement Visa acknowledged, “The fuel segment has its own unique challenges, which we recognized when we first set the chip activation date for automated fuel dispensers/pumps two years after regular in-store locations. We knew that the AFD segment would need more time to upgrade to chip because of the complicated infrastructure and specialized technology required for fuel pumps.”
Visa acknowledged there has been great progress with EMV migration in the U.S. More than 1.7 million merchants representing more than a third of storefronts now accept chip cards; with 388 million Visa chip cards issued. “We are already seeing a 43% reduction of counterfeit fraud at chip-enabled merchants.”
The Visa statement added, “An important element of our study has been that fraud rates at fuel pumps are relatively low, approximately 1.3 percent of total U.S. payment fraud.”
Nevertheless, fraud at the pump is a concern.
Rancho Cucamonga, Calif.-based fintech and payments company CO-OP Financial Services, which serves many credit unions, said it is not surprised that Visa and MasterCard moved the liability shift dates for AFDs. “In most parts of the world, EMV took 10-plus years to implement,” Michelle Thornton, director, product development for CO-OP, said.
“Today, less than 40% percent of merchants are EMV-capable and we understand that AFD presents unique challenges. CO-OP will continue monitoring suspicious AFD transaction activity and, as we do all suspicious card activity, determine what tools and additional monitoring strategies we can use to minimize and reduce AFD fraud on behalf of our clients.”
Chole Casber, Product Manager for Des Moines, Iowa-based payments processor TMG, which also serves many credit unions, advised, “EMV as a technology standard is in place to provide consumers with built-in security as they make card-present transactions. Pushing the timeline on execution of this standard at the nation’s self-serve gas pumps is concerning, even frustrating, for the credit unions and banks that today carry the fraud liability burden on those transactions.”
Casber recognized the complexities surrounding the shift for merchants in the fuel dispensing industry. “However, continuing to delay the shift only subverts the intention of the migration. We expect it will only amplify the fraud attacks on this particular segment, leaving financial institutions in an even more difficult place than they are today.”
TMG Fraud Prevention Manager Ashley McAlpine noted, “TMG’s fraud team has seen a large increase in fraud originating from automated fuel dispensers. That’s largely because the installation of skimming devices on these terminals is so easy.”
McAlpine provided a few reasons why:
1. Often, the keys used to access the inside of an AFD are universal. “Get a hold of one and you have access to literally thousands of units.”
2. Skimming devices in ATMs have to work off battery power, so they only last a few hours. “In AFDs, on the other hand, fraudsters hook skimming devices directly into the power source of the terminal. Without time restrictions, fraudsters can walk away from an AFD skimming job with a lot more mag-stripe data than they could get at an ATM.”
3. Adding to the amount of time these skimmers have to siphon data is the fact gas station employees are not as practiced as ATM servicers on checking for tampering.
