ALEXANDRIA, Va. -- What began as a plan to push convenience-store dispensers to EMV compliance has become a drawn-out, expensive and complicated problem for stores selling gasoline. Visa, Mastercard and other card companies managing EMV eventually pushed a 2017 deadline further back to 2020 when Conexxus and other industry advocates illustrated the burden the liability shift was placing on retailers. But retailers are faced with a maze of regulations and an estimated $7 billion in costs to bring the entire U.S. retail petroleum market to EMV compliance. Considering these challenges, many have found it difficult or downright impossible to comply.
More than a year since the extension was announced, where is the industry on its path to EMV compliance at the pumps? It depends.
The premise behind meeting the October 2020 deadline for outdoor security seems simple enough. Retailers must upgrade their dispenser and point-of-sale (POS) equipment to reduce fraud in the forecourt or be held liable for fraudulent activity that occurs because the dispenser has not been upgraded. The issue is that complying with the liability shift is anything but simple.
Russ Haecker, EMV business manager for Dover Fueling Solutions (DFS), Austin, Texas, estimates that there are more than 350,000 dispensers in the United States that still need to be upgraded to EMV. (See “What Does EMV Stand For?” below.)
“DFS completed a lot of hardware upgrades over the last few years, getting customers hardware-ready to launch. The last step is upgrading their dispenser payment applications to a version that supports EMV when their point-of-sale systems are ready,” he says.
Eric Bagden, director of retail solutions, North America, for Gilbarco Veeder-Root, Greensboro, N.C., says about 40% of retailers have EMV-compliant hardware on the forecourt, and most of them have the POS hardware in place. Among the top 200 largest retailers, he estimates that more than 50% have upgraded the hardware in place. Bagden says about one-third of Gilbarco’s Passport POS install base have production forecourt EMV software available, with several retail brands in field trials right now.
In 2017, after the outdoor liability deadline was extended to October 2020, the momentum slowed. “Many fuel retail customers decided to wait and push off the financial investment until sometime closer to the new deadline,” Haecker says. “We had big plans for what would happen within the two years after the original deadline, but that all changed very suddenly with that regulatory shift.”
One effect of the extended deadline is that some retailers revisited what may have been initial, rushed plans to upgrade, and then revised them, Bagden says. Many of Gilbarco’s larger customers who had been considering upgrade kits to meet that shorter deadline now are weighing upgrading the dispenser.
“ ‘I can spread my spend out over a couple of years so I can afford to put in a lot more new equipment,’ ” he says of their reasoning. Given the rescheduled deadline, some retailers assume the deadline will move again and have decided to delay upgrades. “I don’t think it’s going to work,” says Paul Kern, solution manager for payment firm NCR, Atlanta. “I have no reason to believe, based on my conversations with the various processors and the card brands, that there will be a delay.”
Haecker has also heard from DFS’s sales team and distributors about some retailers’ wishful thinking on another deadline reprieve. “Some distributors are telling us they’ve got single-site operators who are very scared of the potential chargebacks they could face if they don’t upgrade,” says Haecker, who calls rumors of another deadline extension “absolutely false.” “It’s a big mixing pot across the country in terms of what fuel retailers believe is going to happen, but the liability shift is coming in October 2020.”
The Rubber Meets the Road
For some retailers, upgrading to EMV is simply a nonstarter. The switch can be expensive, tedious and painful. And he says they may reason that technically, the EMV upgrades are not a mandate. But Linda Toth, director of standards for Alexandria, Va.-based Conexxus, says that’s not a good plan either.
“No, it’s not a [card-brand] mandate, but it’s a common-sense mandate,” she says. “As more and more EMV solutions are deployed, fraud will migrate to the path of least resistance—in this case, the sites that aren’t EMV-compliant.”
Haecker agrees. “As the U.S. makes this transition to EMV, those sites that haven’t done so are going to leave themselves open to potentially large chargeback fees and fraud scenarios,” Haecker says. “As the pool of outdoor non-EMV payment terminal shrinks, those left who haven’t upgraded will become targets for that kind of criminal activity.”
Bagden calls this the “biggest learning” from other countries’ transition to EMV—and it will create pressure for some of the late-moving retailers. “You had early movers—first 20% of sites—ease into the upgrade at their pace,” he says. “Once you started hitting critical mass, people said their fraud number kept going up. They get a lot more urgency to being upgraded so they’re not the last ones to be upgraded. You saw it in Canada and Europe. I would expect the same thing in the U.S.”
Toth also points out that U.S. consumers are growing used to EMV. “Now that we have EMV chip cards and consumers are used to inserting their cards at various grocery stores, drugstores and everyday shopping experiences, they have come to understand and believe that EMV transactions are more secure, and so they’re going to be questioning the places that aren’t EMV-compliant,” she says.
75%--Amount counterfeit fraud dropped in March 2018 compared to September 2015 for merchants who have completed the chip upgrade
Still, some retailers are hesitant to make the change, and as a result, they may already be subject to the liability shift. For instance, if someone from outside of the U.S. uses an EMV card at a pump that does not include a chip reader and becomes a victim of fraud, the retailer could be liable for that fraud.
Also, if specific locations experience excessive fraud—Toth says “excessive fraud” is relative to each location—that location could be moved into the liability shift immediately. Retailers in areas popular with tourists should be especially careful, she says.
One obstacle facing retailers who decide to postpone upgrades is a shortage of installation technicians. “There’s just simply not enough technicians to complete the all upgrades that have to be done out there between now and the deadline,” Haecker says. “If all the fuel retailers were ready tomorrow and we put every service technician to work, they simply couldn’t finish by the deadline. So there’s a definite bottleneck that will build as retailers hold out and the October 2020 deadline approaches—and those that wait may not make the deadline.”
Kern concurs. “There’s going to be a backlog of getting equipment installed, shipped and in place,” he says. “There’s going to be a really high demand for techs, probably in the next 18 to 24 months.”
Bagden believes the tight labor market could also stymie technicians’ availability. “I don’t think we’re going to run out of technicians to where you literally can’t book one, but you may be booking a technician farther out into the future than is optimal for your plans, and you’ll end up paying a lot more for the visit.” he says.
One Retailer’s EMV Path
A few retailers have gotten a head start on the liability shift. In November 2017, a Wake Forest, N.C., site belonging to Holmes Oil Co. became the first ExxonMobil-branded location to process an EMV transaction at the pump. The payment took place on Gilbarco’s FlexPay POS on an Encore 700S dispenser, over the First Data network.
For Chapel Hill, N.C.-based Holmes Oil, which is an ExxonMobil and Valero distributor and has 27 Cruizers Convenience Marketplace c-stores, being among the first retailers to upgrade its dispensers to EMV was a natural step. The retailer had already planned to replace the “extremely old” dispensers at the Wake Forest location. And, with its headquarters near that of Gilbarco, Holmes Oil had helped pilot many of the dispenser and POS manufacturer’s newest technologies.
“From the retailer’s point of view, No. 1, it’s a security shift that’s going on,” says Nick Peters, information technology director for Holmes Oil. “If you get EMV deployed and enabled as quickly as possible, you prevent skimming, and hopefully other factors and push them off. It’s not that they’re going to stop. They’re just going to find a retailer that hasn’t done these upgrades yet. You’re just trying to mediate the risk and force the risk onto somebody else.”
Second, customers are coming to expect enhanced security in this age of data hacks and breaches.
“Consumers are starting to get more educated, and actually starting to take notice of retailers and business operations that actually pay attention to make security first or [are] security focused,” Peters says. In choosing new pumps, Holmes Oil had “creature comforts” in mind—along with EMV capability. The retailer wanted larger screens to expand advertising at the pumps. And it also wanted near-field communication (NFC) capability, which would allow contactless payment.
“The reason we did that is because what we don’t know is going to happen with EMV,” says Peters. He cites a survey conducted by Foster City, Calif.-based Visa Inc. that found five years after Canada implemented EMV in the store and on the forecourt, 52% of adults said they regularly used contactless payment. Meanwhile, 48% of POS transactions in December 2017 in Canada were contactless, vs. only 1% in the United States.
“No, it’s not a [card-brand] mandate, but it’s a common-sense mandate.”
“If you looked at dispensers a couple years ago, we were shipping practically 0% in the U.S. with NFC,” says Bagden. Today, more than 40% of dispensers shipped by Gilbarco are NFC-ready. “What you’re starting to see is more retailers want to make sure they are future-proofing,” he says, noting the shift toward contactless cards, Apple Pay and Samsung Pay. “Most retailers … don’t want to touch the dispenser again, so they might as well buy [NFC] now even if it’s a small percentage of their transactions today.”
“Mobile payments are just as secure as EMV chip reading technology but can provide a better motorist experience,” says Haecker. “Up to and after the 2020 deadline, I think we’re going to see more, larger retailers adopting mobile payment technology as more fueling customers demand the ability to pay with their phones and wearables.”
For now, however, Holmes Oil and other U.S. retailers must continue to cater to the majority of consumers who use magnetic-stripe and chip cards. And unfortunately, U.S. consumers are so habituated to the dip mag-stripe transaction at the fuel pump that EMV may prove somewhat disruptive at first.
“EMV at the dispenser is kind of a clunky, convoluted process,” Peters says. “When you have trained via behavior and education that mag stripe is where everything is at, the moment you tell a consumer, ‘No, don’t pull out your card,’ it became a huge obstacle.”
For Holmes, it became a surprisingly large obstacle after upgrading its first locations to EMV.
“The consumer is so used to dipping and pulling out their card, then the card won’t come out because the lock’s still in place, then they’re getting prompted to leave the card in but they’re not reading the screen—fun stuff like that is causing heartburn,” says Peters. The first week EMV went live at Holmes Oil’s Wake Forest site, store employees had to repeatedly run out to the pumps to help confused customers.
“If you are going to get serious about this, then prepare,” Peters says. “Train your team at the site, make sure the team knows going exactly what’s going on and what the impact is. I’d even recommend a site visit to a location that has it active so they can see what’s going on.”
Peters recommends communicating the new payment protocol to customers a week or two before EMV is about to go live at a site. For the first week that EMV is live, he advises retailers to dedicate an employee at the pumps at the busiest times to help educate consumers.
Holmes Oil also added informational stickers at its pumps to alert customers to the new security measures, although it had to get approval from ExxonMobil for the special decals.
Currently, Holmes Oil has six locations out of 27 that have been upgraded to EMV. It plans to have all sites that can be upgraded complete by end of 2019. It’s a process that Peters expects to be somewhat painful.
“We’re the only retail industry with two technologies to accept EMV, with indoor and outdoor behavior,” he says. “Because no one paved the way to teach consumers to do that, we’re the ones who have to do that. So it’s going to be painful before it gets way out there.”
No Pain, No Gain
Complying with the liability shift deadline has been slow going and frankly disheartening for some c-store operators. Even Joshua Smith, founder and CEO of Gas Pos, a company based in North Little Rock, Ark., that specializes in EMV-compliant POS devices, is less than bullish on EMV.
“There isn’t really a good ROI (return on investment) on EMV compliance,” says Smith. “ROI might be in 15-20 years on a device that has a five-year life expectancy. I can only imagine their frustration.”
Smith believes that industry resources would be better spent on another form of security. “It’s my hope that in this process, retailers demand point-to-point encryption (P2PE),” says Smith. He does not advocate violating card brand rules or regulations, but contends that P2PE is a sounder investment than EMV and that combining the two is the most secure solution.
Put simply, the two solutions solve different problems. Encryption scrambles credit-card numbers and other payment data on its way to the payment processor, so even if a bad actor manages to get its hands on that data, it is unusable. EMV is simply a more secure version of mag-stripe cards. While mag-stripe cards contain static data that can be replicated repeatedly by bad actors who steal the cards, an EMV card creates a unique transaction code each time it is used that cannot be used again.
But contrary to Smith’s preference, the liability shift is moving forward without P2PE, and the industry has made enough progress that patterns are starting to emerge. Bagden of Gilbarco says the first upgrades tend to take place in states with higher rates of skimming and fraud at the pump, including California, Texas, Arizona and Florida.
“Then, after that, in general I’ve found they’re looking at it regionally—concentrating their resources, region by region, to get it done,” says Bagden.
3.1 million--Number of U.S. merchants accepting chip cards as of June 2018
“Hypermarket and large c-store retailers have been at the front of the EMV upgrade wave,” says Haecker of DFS. Their high-profile, high-volume locations with older equipment are typically getting entirely new dispensers, while other locations are being upgraded with kits. Many smaller and single-site operators, meanwhile, “seem to be holding out” completely on upgrading, he says.
Joe O’Brien, vice president of marketing for Source North America Corp., Addison, Ill., which helps provide EMV upgrades, also sees many retailers doing “the minimum required” to upgrade.
“Major chains and folks with ties to major oils are getting price incentives to upgrade this year, but folks with one to 10 sites are not yet committing to upgrades,” he says. Source North America has advised clients to determine whether their customers are still dependent on credit-card payment vs. smartphones or loyalty programs in store.
“If so, then make the move to EMV at the pump,” O’Brien says, “and do so before interest rates increase so the cost of funding remains reasonable.”
ADD RULE HERE
What Does EMV Stand For?
EMV was originally built for Europe, not the United States. Unlike the U.S., Europe did not have the telecommunications infrastructure to authorize card transactions in real time during EMV’s inception. The chip card was developed so the cards could authorize themselves, says Joshua Smith of Gas Pos. The acronym EMV stood for Europay, Mastercard and Visa in 1999, but since then more stakeholders have joined the group to create EMVCo, the body that maintains EMV specifications.
Today, EMVCo members include American Express, Discover, JCB, Mastercard, UnionPay and Visa.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.