“Address, maybe,” say some in the industry, “Resolve, definitely not.”
The Maestro liability shift date will be the first enacted ATM deadline in the major card brands’ roadmaps for EMV migration in the United States. The next ATM deadline — for all remaining MasterCard products — does not take place until Oct. 1, 2016. The shift for Visa products occurs even later, in October of 2017.
The ATM Industry Association petitioned MasterCard to align its Maestro deadline with the October 2016 date while the NAC focused on protecting small operators, devising a three-part solution with MasterCard:
- All Maestro transactions will be blocked at ATMs that averaged no more than one Maestro transaction per month in 2012. MasterCard has said this represents approximately 80 percent of U.S. ATMs.
- The same Fraud Rules Manager that will block Maestro transactions at low-activity ATMs will decline potentially fraudulent transactions at the remainder of ATMs. It will also measure activity against a 2012 baseline and block any ATM where fraud increases.
- A complementing Fraud Control Shield program will be rolled out across Maestro card-issuing FIs in Europe, using similar metrics to identify and decline potential fraudulent ATM transactions on the issuer side.
Since the NAC-MasterCard announcement, several industry experts have weighed in with ATM Marketplace to express concerns about a solution they consider incomplete and inadequate. Following are their thoughts on the announced plan:
Mike Lee, CEO of the ATM Industry Association
This is a palliative rather than a solution. We are still in the dark as to why the ATM is being targeted for an early and premature EMV liability shift, which seems misaligned to both liability shifts in retail and the milestones announced by Visa.
Suzanne Galvin, head of product strategy and management at Elan
Regarding the MasterCard announcement, we are pleased with their ability to minimize fraud, however the question exists around the impact to acquirers of the … excluded devices, coupled with customer experience and brand implications.
Our preference would have been a deadline extension to enable all players to appropriately support this EMV requirement.
Susan Napier, CEO and chairwoman of FTSI Inc.
While MasterCard’s “real world” plan will mitigate some of the risk associated with the April 19 Maestro liability shift, it doesn’t remove all risk.
For the 80 percent with a low volume of Maestro transactions, simply blocking transactions may upset customers. For the 20 percent with a higher volume that will not automatically block transactions, if fraud happens despite the Fraud Rules Manager, the acquirer is still liable.
Financial institutions still need to actively move forward with hardware and software upgrades to become EMV compliant.
Sam Ditzion, CEO of Tremont Capital Group
This exemption will be a big relief to the owners of 80 percent of the nation’s ATMs with fewer than one Maestro transaction per month that were not going to be able to credibly justify the large expense to support EMV.
That said, the remaining 20 percent of ATMs — which are largely located in highly trafficked tourist areas and were always the high risk locations anyway — will not be able to support EMV by next Friday and therefore face potentially frightening consequences because of the liability shift.
While MasterCard’s fraud prevention tools sound helpful in offsetting some low-hanging fruit risk, disturbing levels of fraud risk remain and the tools by no means solve the problem, as, if they did, a liability shift wouldn’t be forced on acquirers and MasterCard would guarantee the tools’ efficacy.
David Tente, executive director for ATMIA US
MasterCard discussed the use of [Fraud Rules Manager and Fraud Control Shield] with me last September as their solution for assuaging ATM operators’ concerns about the upcoming liability shift.
And in conversations as recent as February, [MasterCard] indicated that lab testing was demonstrating a reduction in fraud of up to 85 percent, as they continued to tweak their fraud “rules.”
Even if these lab results translate faithfully to the real world, it still leaves ATM operators vulnerable to significant individual losses.
This announcement does not represent anything new in the way that MasterCard is responding to valid concerns about the ATM liability shift, or change any of the consequences. It is simply PR spin, intended to obscure the fact that ATM industry interests are once again being subrogated [to] those of merchants and issuers.
The ATM Industry Association does not accept this “arrangement” as a substitute for meaningful changes to the current EMV roadmap. We again call on MasterCard to align the first ATM liability shift date with the first retail liability shift date in October of 2015.
Absent that, since ATM operators would be forced to accept liability for Maestro transactions, they should also be allowed to accept or decline those transactions at their own discretion.