Banks understand the fraud risks associated with ATM banking. That’s why many have upgraded their automated teller machines to accept the new EMV chip-enabled ATM cards.
The new technology protects both consumers and banks. MasterCard set the EMV enabled ATM deadline for Oct. 1 of this year, while Visa’s deadline will happen in October 2017. EMV stands for Europay, MasterCard and Visa, who created the industry compliance standards for chip-enabled cards and the technology used to authenticate chip-card transactions.
Since the MasterCard deadline has passed, that means banks that have not upgraded to the new chip-enabled ATMs could be on the hook if fraudulent transactions occur with their customers chip-enabled ATM cards, according to Leah Garrett, vice president of debit card and fraud with Centennial Bank in Lubbock, Texas, which holds about $750 million in assets. A shortage of ATM technicians has made it more difficult for some banks to meet the deadline, she added.
“If a cardholder claims fraud, and they have a chip-enabled card, the bank is now liable for that fraud,” Garrett said. If the ATM is certified EMV chip compliant and the card being used is not, she said the credit card issuer would be responsible for any loss.
Many outdated ATMs do not have the right processor or memory requirements to support the new EMV kernel needed in the ATM machines, according to a paper published by ATM Marketplace. When customers use EMV enabled ATM cards, the EMV-ready software kernel inside the machine allows the communication that authorizes users and processes transactions.
Costly upgrades
Since older ATM machines may not support the new EMV technology, banks must make the decision to either upgrade or replace ATMs to meet the new EMV industry compliance standards. Depending on the number of ATM replacements, along with the various electrical modifications, lighting and security upgrades on the premises, banks may face sticker shock when they upgrade the machines, according to Carolyn Baker, executive vice president and chief financial officer with Centennial Bank in Lubbock, Texas.
“We’re replacing four ATMs in our fleet of 13,” she said. “Some of our other machines only needed a slight upgrade.”
The cost for new machines depends largely on the bank’s vendor relationship, how many machines are being purchased and the number of features on the machines, Baker said. In some cases, banks will receive trade-in discounts; however, if they claim an obsolescence write-off it could increase their costs, she said.
“For a community bank, they’re looking at about that $30,000 price range for each machine, plus taxes and install,” Baker said. Keep in mind, these are just “basic machines with cash dispensing and no bells or whistles,” she added.
Some banks want nothing to do with owning an ATM because it offers bleak profit margins unless machines are located in high traffic areas, according to Ronnie Miller, president and CEO with Community National Bank in Hondo, Texas, which holds just under $200 million in assets.
Compliance concerns
In addition to EMV technology compliance, Miller said there also are ATM compliance regulations that banks cannot ignore. Those include meeting Americans with Disabilities Act compliance, which he said “adds a tremendous expense in getting these machines compliant.”
Banks also face new cybersecurity regulations.
“Now there’s some talk that suggests you may need new software to detect skimming devices that hackers put on these machines,” Miller said. “It’s a constant aggravation to make sure all of your ATM machines are compliant and functioning.”
Miller said these are just a few reasons why the bank decided to lease ATMs instead of owning them. He said it’s a better alternative for their banking operations because it saves a lot of headaches and is less costly. He said the bank spends about $3,600 per month for all five leased ATMs.
“Our responsibility for our ATMs is that we provide power and security and the cash loading of the machine,” Miller said. “Everything else falls on the owner of the machine which is why we chose the leasing route, because now the [compliance] responsibility is no longer ours.”
Miller said Outsource ATM, the bank’s ATM management vendor from Cypress, Texas, is responsible for keeping Community National Bank ATMs up-to-date with compliance regulations and making technical fixes when there’s a machine breakdown.
Security standards
Because of operating system changes, encryption devices, plastic card industry requirements and pin pads, banks are required to make additional investments in machines that generally offer low return on investment, according to Paul Albright, vice president of sales with Outsource ATM.
Convincing banks to give up control of their ATM machines and let someone else take responsibility has been an uphill battle, Albright said. But he said that is starting to change, especially if vendors can prove their use of industry best practices to secure bank data.
“We’re operating that ATM on a completely different communication network, a virtual private network, to provide secure transmission of encrypted messages from the ATM,” Albright said.
Banks that opt to lease instead of own ATMs are wise to review the liability clauses in the contract, Miller said. “Having an indemnification clause in the contract indemnifies the bank in the event the vendor violates some patent or patented process and the bank gets sued,” he said.
Freelance writer Elise Oberliesen contributed to the writing and research of this article.
Leave A Comment