SAN FRANCISCO and PURCHASE, N.Y. -- Following discussions with merchants and other parties, Visa and MasterCard both announced Dec. 1 that they are extending their deadlines for convenience stores and other gasoline retailers to install Europay, MasterCard and Visa (EMV) technology to process the new chip-based credit cards and debit cards at the pump.
In October 2015, the liability for fraudulent transactions from inside the store shifted from Visa and MasterCard to the retail location. The same liability shift takes place outside at the fuel dispensers Oct. 1, 2017.
As reported in a McLane/CSP Daily News Flash, Visa is moving its automated fuel dispenser (AFD) EMV activation date from Oct. 1, 2017, to Oct. 1, 2020. MasterCard followed suit with its own announcement also pushing its AFD EMV date back from 2017 to 2020 ...
“While we remain committed to moving businesses to chip technology as quickly as possible, we are also constantly monitoring industry progress and attempting to proactively address marketplace realities and known challenges wherever possible,” San Francisco-based Visa said in a blog post. “Some of these challenges were anticipated as we embarked on the migration to EMV chip and others are unique to the U.S. because of the complexity of the environment and regulatory requirements that do not exist anywhere else.”
The company said, “We believe we have reached a balanced conclusion for providing needed, additional time to merchants while continuing to push forward with the migration to chip. During this interim period, Visa will monitor AFD fraud trends closely and work with merchants, acquirers and issuers to help mitigate any potential counterfeit fraud exposure at AFDs. We will also continue to work with fuel merchants, certification vendors and software suppliers to ensure EMV chip migration efforts continue. … Based on the realities of the current issues fuel merchants face and the critical long-term need for the industry to adopt chip as a solution for counterfeit fraud, we believe these changes are a balanced and manageable way to ensure a successful migration to chip.”
The EMV liability shift at ATMs will not change and will take effect as planned Oct. 1, 2017, Visa said.
MasterCard Inc., Purchase, N.Y., issued the following statement Dec. 1:
“In 2012, we announced a roadmap in which all parties who use the MasterCard network – merchants, issuers, acquirers and others – would move to EMV chip technology. This approach was centered on a series of liability-shift milestones built as incentives to move the U.S. payments market to a chip-enabled environment.
“Over the past four years, we have worked together to deliver on that road map, reinforcing and delivering what consumers expect--a safe, secure and convenient way to pay. We have remained steadfast in this approach because driving safety and security in the payments ecosystem is a priority.
“EMV compliance for fuel merchants with [AFDs] brings significant regulatory and implementation challenges.
“Over the past months, we have had extensive discussions with fuel merchants, issuers, acquirers and other stakeholders regarding these unique challenges. Today, MasterCard is modifying the automatic-fuel-dispenser liability shift date from October 2017 to October 2020. This decision applies only to automated fuel pumps.
“We are committed to EMV chip technology as the best and most effective solution for combating counterfeit card fraud. It is a priority for MasterCard to ensure consumers can confidently shop anywhere, any time. We will be working closely with our fuel partners, station owners, industry associations and third-party vendors to ensure a smooth transition to EMV.”
Industry experts weigh in
“Between technical glitches, long processing times and lack of PINs, the card industry has badly mishandled the rollout of EMV overall. We hope they will use this delay to get it right for gas stations. Without PINs, chip cards provide only half the security they’re capable of. We hope by the time they are adopted at gas stations, the card companies will finally agree to put security ahead of profits and make PINs standard on all chip cards,” J. Craig Shearman, vice president for government affairs public relations for the National Retail Federation (NRF), told CSP Daily News.
“The unique challenges facing the retail petroleum industry in upgrading their outside pay-at-the-pump systems to EMV have been an active part of the EMV migration discussions over the last year within the U.S. Payments Forum and its Petroleum Working Committee. Given the migration challenges for implementing EMV in the petroleum environment, Visa's and MasterCard’s modification of the liability shift dates will be beneficial to the retail petroleum industry and the U.S. chip migration,” said Randy Vanderhoof, director of the U.S. Payments Forum.
“We are still sifting through the details, but the announcement appears to not clearly delay liability in retailers who experience higher fraud rates or those accepting foreign issued cards; so we don’t see this announcement as a true game delay, but a bit of breathing room to work out the challenges,” Gray Taylor, executive director of industry technical standards group Conexxus, told the National Association of Convenience Stores (NACS).
The major credit-card companies came together in 2004 to deliver their first combined set of data-security rules known today as their Payment Card Industry (PCI) standards. In May 2016, the PCI Security Standards Council published version 3.2 of its data-security standard, which addresses growing threats to the security of customer payment information. Retailer compliance to those evolving rules over the years foreshadowed the shift in fraud liability that came with EMV.
Debit routing changes
In mid-November, NACS, the Petroleum Marketers Association of America (PMAA), Retail Industry Leaders Association (RILA), Food Marketing Institute (FMI), National Grocers Association (NGA), National Retail Federation (NRF) and other groups sent a letter to Visa executives in response to the Federal Reserve’s declaration that the technical specifications and rules provided to merchants as part of the EMV migration violate federal law.
The letter addresses the Nov. 2 declaration made by the Fed that no payment-card network can directly or indirectly force retailers to deploy a technology or enforce a rule that inhibits merchant routing choice.
In late November, Visa modified and clarified existing debit network routing rules to help merchants and acquirers better understand implementation options related to the adoption of EMV chip technology in the United States. The modifications and clarifications follow new guidance recently issued from the Fed and address a Federal Trade Commission (FTC) inquiry.
Visa said it would no longer require that consumers using a debit card in EMV chip-card readers be presented with a screen forcing them to select either “Visa Debit” or “U.S. Debit.” Visa Debit transactions are routed over a network owned by Visa, and it usually requires the consumer to use a signature to approve the transaction. U.S. Debit transactions go over the retailer’s choice from up to a dozen competing networks that charge merchants less but provide more protection by allowing the use of a PIN.
Industry groups welcomed Visa’s announcement that it will no longer use EMV technology and rules to steer debit-card transactions to its own processing network.
Easing of EMV
Last summer, Visa and MasterCard both eased up on their certification requirements, essentially shortening the time it took processors and equipment providers to certify their EMV infrastructure. They also took measures to ease the blow of fraud liability for retailers.
Addressing growing concern over the prolonged EMV certification process and the chargebacks merchants have been receiving since the October 2015 liability shift, Visa in June 2016 simplified testing requirements, allowing acquirers to “self-certify,” meaning it gave greater discretion to determine the appropriate level of testing required to ensure a merchant’s solution is ready. The strategy is based on the idea that the acquirer is most familiar with its merchant partner’s system.
This move and others may reduce testing and certification timelines by as much as 80%, according to Visa.
To allow the certification process to catch up with the market, Visa also announced new chargeback remedies that will run through April 2018. As of July 22, 2016, chargebacks under $25 that are due to U.S. counterfeit fraud are no longer charged back to merchants. Visa will block those chargebacks and, as of October 2016, it also limits issuers to charging back 10 fraudulent counterfeit transactions per account. After that point, the issuer assumes liability. Visa estimates these two changes cut chargeback transactions to merchants by 40% and chargeback dollars by 15%.
“This is pretty big news for our space,” a source whose company focuses on c-store automation, speaking on condition of anonymity, told CSP Daily News at the time. The source said the moves raised questions about steps Visa may or may not take on the October 2017 liability shift date for in-pump point of sale.