The MasterCard liability shift will go forward next Friday for interregional Maestro ATM cash disbursements in which the card is issued outside the U.S. and the transaction is acquired within the U.S. But not without some critically important updates to the plan. This afternoon, MasterCard, in conjunction with the National ATM Council, is announcing several points of agreement reached by the two organizations that will reduce the fraud risk for the ATM industry and help accelerate the transition to EMV.
Removing risk for most
The centerpiece of the agreement is MasterCard’s plan to segment the ATM footprint in the U.S. and block 100 percent of interregional Maestro transactions at U.S. ATMs that averaged no more than one Maestro transaction per month in 2012. According to MasterCard, this action will cover 80 percent or more of the nation’s ATMs, removing, for the time being, all risk of fraudulent transactions.
Mastercard has not set an end date for blocking, but will monitor the industry’s progress toward EMV enablement.
“The next major milestone in the ATM channel occurs in October of 2016 when liability will shift for all ATM transactions — MasterCard, Maestro and Cirrus,” said Leland S. Englebardt, group head for global network products at MasterCard in an exclusive interview with ATM Marketplace.
“Sometime around the midpoint between next Friday and October of 2016, there will come a time when it stops being about cross-border and it starts being about preparation for 100 percent of the volume. So it will no longer be material to block just those transactions.”
Mitigating risk for the rest
Transaction blocking will be handled through a MasterCard fraud prevention tool, Fraud Rule Manager. In addition to blocking all transactions at an expected 80 percent of ATMs, the program will provide protection for any of the remaining 20 percent of ATMs that have not yet been EMV enabled.
Fraud Rules Manager is an “on-behalf,” rules-based tool that MasterCard developed specifically for the U.S. market. For all cross-border ATM transactions (and only those transactions), the tool will take in data and “decision” any transactions that fall within the parameters of the liability shift.
“And we’ll use that decision capability to prevent fraudulent transactions wherever we detect that a transaction has the characteristics of being potentially fraudulent,” said Englebardt. He said the service will be live on April 19 — the day of the liability shift, and will be active for all U.S. ATMs by default and free of charge.
An anti-fraud enhancement that Englebardt attributed to the dialog with NAC is that for those ATMs in “the 20 percent,” Mastercard will monitor fraud against historical baselines. “And if we detect that the current rate of fraud at those ATMs is exceeding some factor of the historical baseline, we will begin to block on an individual terminal basis at those ATMs as well,” he said.
“The acquirer need do nothing to benefit from this service,” Engelbardt said. “They don’t have any development to do; they don’t have to register. The only activity an acquirer would need to undertake is, if they for some reason decide that they do not want to be part of this service, we’ve published a form in our bulletin that permits an acquirer to opt out of the service. I frankly don’t understand why any acquirer with non-EMV ATMs would want to opt out of the service, but they have that option.”
Protection on the issuer side
In addition to helping to protect acquirers with Fraud Rules Manager, MasterCard will also monitor transactions from the issuer side.
“Clearly one of the major concerns in any market where there’s a liability shift is that, once the liability has shifted, the other side of the transaction will relax all of their protections because they’re no longer liable,” Englebardt said. “MasterCard is working to make sure that does not happen.”
In Europe, where most Maestro cards are issued, the company has been deploying Fraud Control Shield, another “on behalf” service. The program looks at historical patterns of use in card portfolios with respect to cross-border activity and decisions transactions that appear to have the characteristics of counterfeit fraud.
The product has been in use in Germany since last fall, Englebardt said, and MasterCard is rolling it out to at least five other European markets that, along with Germany, represent 90 percent of reported fraud of the type that will be subject to the liability shift.
“So we’re going to be very aggressive and very comprehensive in Europe saying, in effect, to that community that unless an issuer has robust fraud prevention systems that are proprietary that it has developed and put in place and continues to maintain after the liability shift, MasterCard will implement its system on [their] behalf,” he said.
‘Adequate time, reasonable time’
Englebardt emphasized that the genesis of the MasterCard plan had come as a result of a dialog with NAC. On February 14, the organization issued an open letter to the card company asking for an extension of the deadline due to the scope and complexity of EMV implementation, particularly in the U.S.
“We expressed concern to MasterCard as to what to do about this because for all of our sakes, we want to work together to prevent fraud,” said Bruce Renard, executive director of the National ATM Council. “But as a practical matter, there are challenges with actual deployment on the street of EMV in the U.S. at this point.
“So, we’ve worked out this approach that should handle it and give the industryadequate time, reasonable time, working in conjunction with MasterCard to solve whatever the remaining issues are for U.S. EMV and get this thing deployed in a realistic manner, in an effective manner.”
Help for smaller ATM deployers
One aspect of the plan particularly applies to NAC members, most of whom are small or mid-sized IADs and ISOs. For these operators, implementation of EMV represents particular difficulties.
“One of the fruits of this cooperative course of dealing is that we’re going to make all of our knowledge and experience — and frankly, the connections that we have in the industry — and other resources available to NAC members to help them get EMV enabled,” Englebardt said.
With Renard acting as intermediary, MasterCard has pledged to work one-on-one with NAC members to address their issues.
“[This] may include availability of equipment, it may include support from processors, it may include expedited certification for EMV once the hardware and software is installed, and other forms of direct assistance to help them to accelerate their EMV enablement,” Englebardt said. “Because beyond this particular milestone, we’re looking at a long-term roadmap that will lead the United States to the 100 percent EMV on the card issuing side, on the merchant POS side and in the ATM channel.”