Fraud , Payments , Payments Fraud
Visa, MasterCard Agree to Give Gas Pumps a Break on EMV Shift Card Brands Made Right Decision, Relative to Fraud at the PumpVisa and MasterCard announced this week that they are pushing their liability shift dates for counterfeit card fraud that results at non-EMV chip-compliant U.S. pay-the-pump gas terminals to October 2020 from October 2017.
See Also: 2016 Social Engineering Report
That news is an early Christmas gift for convenience-store operators and the petrol industry, even though if it leaves issuers on the hook three years longer for counterfeit fraud that might result from a hack or skimming attack at self-serve gas pumps.
But I wonder how much fuss issuers will make about the extension. Counterfeit card fraud at gas pumps pales relative to retail point-of-sale and ecommerce fraud. And despite what we heard five years ago about pay-at-the-pump skimming reaching nearly "epidemic" proportions, we hear much less about it today. That's not to say it's gone away, by any means; but it no longer appears to be a looming epidemic (see Pay-at-the-Pump Skimming: 'Epidemic').
Visa and MasterCard made the right decision to give gas pumps a break on EMV. The question now is, will the three year extension be enough?
Card Fraud at the Pump
In its Dec. 1 announcement about the liability shift delay, Visa notes that fraud rates at fuel pumps account for only around 1.3 percent of total U.S. payment card fraud.
By comparison, the cost to upgrade, and in most cases replace, costly self-serve gas pumps to ensure EMV compliance by 2017 is exorbitant. Gray Taylor, a payments expert who serves as executive director of Conexxus, a convenience store and petroleum industry technology association, estimates it will cost $7 billion for the petrol industry to make the conversion to EMV at fuel pumps in the U.S. That's because a third of the existing pumps will have to be replaced, at a cost of between $3,000 and $7,000 a pump.
Source: ConexxusThat cost is going to be difficult for the industry to absorb, even by 2020, because 80 percent of the petrol industry in the U.S. comprises small, independent operators. "We have long felt that the card brands did not want to start putting small and medium petro retailers at financial risk through an existentially flawed project schedule," Taylor says. "The deadline is simply catching up to the reality we have all - card brands included - known for quite some time."
Visa also acknowledges that the petrol industry is challenged by a number of factors. "We knew that the AFD [automated fuel dispenser] segment would need more time to upgrade to chip because of the complicated infrastructure and specialized technology required for fuel pumps," Visa says. "Five years after announcing our liability shift, there are still issues with a sufficient supply of regulatory-compliant EMV hardware and software to enable most upgrades by 2017."
Relative to the high price, c-stores and gas stations must invest to get their fuel pumps EMV compliant, the incentive to push EMV just isn't there.
"This delay in requiring gas pumps to accept chip cards really makes sense for a number of reasons," says Shirley Inscoe, a senior analyst at consultancy Aite Group. "When Visa introduced their Transaction Advisor, and fraud rates were significantly reduced at gas pumps, it impacted the business case of upgrading to EMV. And that business case was already weak, since financial fraud at gas pumps has never been a huge problem, compared to the expense of having to replace some pumps before they can be upgraded to EMV."
Curbing Pump Fraud
Transaction Advisor, which Visa introduced in August 2014, analyzes and risk scores a card at the time it is swiped, based on data known about the cardholder. At the time it was introduced, Visa marketed it as a way to bridge the gap between the mag-stripe and EMV, by helping to reduce fraud at the pump (see Visa Targets Pay-at-Pump Card Fraud).
Visa this week says Transaction Advisor has been "particularly successful in driving fraud lower at fuel dispensers."
Also this week, MasterCard introduced similar technology through the launch of its Decision Intelligence suite, which uses artificial intelligence to provide issuers with more accurate predictive scoring at the time a card is used for payment.
MasterCard, in its Dec. 1 EMV shift announcement for self-serve fuel pumps, notes that predictive analytics tools, like Decision Intelligence, will assist petrol operations with fraud migration efforts until they are able to make the migration to EMV.
"EMV compliance for fuel merchants with Automatic Fuel Dispensers brings significant regulatory and implementation challenges," MasterCard spokesman Seth Eisen says. "Over the past months, we have had extensive discussions with fuel merchants, issuers, acquirers and other stakeholders regarding these unique challenges. ... We will be working closely with our fuel partners, station owners, industry associations and third-party vendors to ensure a smooth transition to EMV."
So, will the three year extension be enough?
Probably not. Financial fraud expert and Gartner analyst Avivah Litan says 2020 "will be hard for many of them to meet."
But maybe they won't need to. If fraud rates at gas pumps aren't that high, why migrate to EMV at all?