Gas Pumps Must Upgrade to Chip Readers by October
The gas retailer industry has lost an appeal to extend its delay of implementing chip card readers at all of the nation’s gas pumps.
If you’re an American, it’s likely that you have used a chip card recently. Since their introduction in 2015, chip cards, or EMV cards, have increased in popularity. According to Visa, over 80% of storefronts in the United States now accept chip cards, with 72% of all Visa-branded cards, as of June 2019, being chip cards. Chip cards are responsible for 99% of the nation’s payment volume.
There is, despite this, a place where you are unlikely to see a chip card reader. Fuel pumps continue to use “swipe-and-read” magnetic readers in the US. This is largely due to the fact that there are not enough readers and technicians available to do the job, the gas retail industry says. Estimates to fully do the job for the nation’s 153,000 gas stations ran over $3.9 billion.
Visa and Mastercard took pity on the gas retailers, exempting them from the mandate to retailers to upgrade their payment systems to EMV. After five years, however, the credit card companies are done waiting. Mastercard and Visa have rejected a request to extend the deadline for implementation. For the nearly 70% of gas stations that have no EMV readers installed and the 9% that have EMV readers installed in less than 25% of their sites, this represents a major concern once the exemption expires in October.
“There’s going to be quite a surprise come October,” Laura Townsend, senior vice president of the Merchant Advisory Group, said in an interview with the Los Angeles Times. “Folks that have been trying to transition to EMV will be unable to because of things outside their control. But they will bear a significant increase in losses either come October or shortly thereafter because we know fraudsters will find the weakest link.”
EMV — originally named after the three companies that wrote the standard: Europay, Mastercard, and Visa — introduced solid-state data drives that are embedded into the actual cards. This effectively made the card a smart device, able to interface with the credit card companies’ servers and verification software.
Along with the customer’s PIN or digital signature, the system is thought to effectively negate the possibility of “card cloning,” where a hacker would obtain one’s card information and use consumer-grade magnetic encoders to produce a clone of a customer’s card. EMV also cut back on the possibility of clerk theft of credit card data, as it eliminated the need to hand over one’s card to the clerk for the sake of signature comparison.
Due to gas pumps relying on magnetic readers, hackers have found them to be tempting targets to install portable readers or skimmers on. “As long as the magnetic stripe readers are in place, fuel dispenser merchants are becoming an increasingly attractive target for advanced threat actors,” Visa said in a security alert issued in November. EMV cards do not transmit private card data. Instead, they negotiate with the card company server to obtain a unique transaction code. The code cannot be reused.
While upgrading a single reader can cost a gas station up to $1,200, not upgrading could be more expensive. The credit card companies extended to retailers additional liability protection as part of the EMV program: If a chip card was used on either a chip card or a non-chip card reader and a fraudulent charge occurred, the liability for the charge would be the card companies and not the retailers. In October, however, the card companies are slated to drop non-chip card readers from this promise. The gas stations would be personally liable for all fraud that occurred due to their refusal to upgrade.
This may force some gas stations to end “pay-at-the-pump,” opting for customers to pay at the cash registers. As the various fuel companies must certify the chip reader software before installation, it is unclear how many gas stations will be in compliance before October.
“The payment standard-setting process needs to be more open,” Anna Ready Blom, director of government relations for NACS, a trade association for the convenience-store industry, said to the Los Angeles Times. “Retailers and technology companies should have been part of the planning and decision-making on chip cards from the start. If they had been, rather than Visa and Mastercard making all the decisions without understanding them fully, we wouldn’t be in this mess.”