December 2019

Feature

Ready or Not

Ignoring the deadline for EMV at the pump could be costlier than upgrading. Don’t sit this one out.
Jerry Soverinsky

A Speedway commercial launched earlier this year promoted neither gasoline nor in-store products. Rather, the 30-second spot focused on something far less tangible for consumers: infrastructure.

“At Speedway, we’re always looking out for you,” the voiceover begins as a car parks next to a fuel dispenser. “That’s why we invest in industry-leading technology, like our fast and secure pumps …”

“SECURE PUMPS” implores a graphic superimposed over a closeup of the fuel dispenser’s card reader.

“… equipped with state-of-the-art card readers with the latest advances in credit card security to keep your information safe at thousands of Speedway locations. Which means when you fill up here, you know Speedway’s got your back.”

NEARLY 3,000 LOCATIONS is emblazoned across a map of the United States, ubiquitous coverage that reinforces the messaging.

“So, you can get what you need and get on your way.”

It’s a testament to our times that a TV commercial promotes neither products nor services but rather security. The substantial business accomplishment of implementing Europay, Mastercard and Visa (EMV) capabilities at automated fuel dispensers (AFDs) more than a year ahead of the October 1, 2020, deadline is certainly bragworthy.

Completing EMV deployment at 3,000 stations is a notable achievement when only 13% of site owners/operators surveyed by Conexxus in July 2019 reported full EMV deployment at their fuel islands, and only 42% indicated they will be ready by the October 2020 liability shift. (The total survey population represented 26,284 retail sites.) Other responses point to a less-than-enthusiastic embrace of EMV compliance:

  • Nearly 70% of those surveyed indicated they had zero sites deployed
  • 17% of those reporting no sites deployed were undecided about implementing it
  • 9% indicated the rollout was complete for less than 25% of their sites
  • 25% did not know when they might be ready

What’s more, for outdoor-contact EMV, none of the major oil/fuel distributors surveyed had certified solutions ready for deployment from all their vendors.

Plan on a minimum of four to six months for implementation.

That Was a Fast Three Years

Why the sharp disconnect? It’s not as if the deadline has been a secret. October 1, 2017, marked the original deadline for AFD terminals to be included in the Global EMV Liability shift applying to American Express, Discover card, MasterCard and Visa transactions. Those retailers that had not updated their equipment to accept EMV cards by that date would be liable for the cost of chargebacks.

In early 2017, we wrote about the challenges convenience retailers faced in complying with the original deadline. The card brands, acknowledging deployment backlogs, offered an extension to October 2020.

“We knew that the AFD segment would need more time to upgrade to chip because of the complicated infrastructure and specialized technology required for fuel pumps,” Visa noted in a statement in 2017. “Furthermore, five years after announcing our liability shift, there are still issues with a sufficient supply of regulatory-compliant EMV hardware and software to enable most upgrades by 2017 … Given our discussions with merchants, clients and partners, Visa has decided to delay the U.S. domestic AFD EMV activation date from October 1, 2017, to October 1, 2020.”

MasterCard followed suit with its own announcement, to the relief of NACS and its members.

“We applaud the card brands who have recognized the significant challenges petroleum retailers face in implementing EMV,” said Gray Taylor, executive director of Conexxus. “We have worked well together to identify these challenges, and we believe that all parties see these challenges as jointly shared. Work and advocacy, over the past several years, within the various trade groups and the press has served to inform all stakeholders of the reality petroleum retail faces.”

Projected Quarterly Liability per Site Through 2022

Source: Conexxus survey data; www.conexxus.org

To Comply or Not Comply …

Returning to our earlier question in referencing the Conexxus survey results: Why the sharp disconnect?

A September 2017 PaymentsSource article speculated that “[f]or many gas retailers, there’s no sense of urgency, given that fraud rates at fuel pumps are … approximately 1.3% of total U.S. payment fraud,” citing Visa data. And when weighed against the “steep cost of upgrading” a pump to EMV ($6,000 to $10,000, according to the article), it “is a major sticking point.”

The rationale persists today, according to Linda Toth, director of standards for Conexxus, who presented “EMV: Can You Afford Not to Upgrade?” at this year’s NACS Show. Referencing the 17% of survey respondents who were undecided about whether they would pursue EMV compliance, “the cost of upgrades and the risk not justifying the expense were the No. 1 [reasons they were not fully committed],” she said.

“We’re going to analyze what that risk is going to be and help you understand why … that’s not a good reason,” she said. To start with, “We are looking at potentially $451 million for our industry annually in counterfeit fraud outdoors at the AFD,” Toth said. To understand the implications post-outdoor EMV liability shift, one must first understand the various types of credit card fraud.

EMV Preparedness

Conexxus survey June 2019
88 responses representing 26,284 sites

*Respondents could choose more than one reason

Who Pays for What?

There are two chargeback scenarios: one where the card used was lost or stolen (about 10% of chargebacks), and one where the card is counterfeit (about 90% of chargebacks).

Chargebacks Today
In the former, the retailer pays for that fraud today; whereas in the latter, the bank is responsible.

Chargebacks Post-October 1, 2020
After the EMV liability shift has occurred, if the retailer is in non-compliance, in both scenarios, the retailer pays for the fraud. Conversely, if the retailer has deployed EMV, the retailer will not be responsible for any counterfeit fraud. With some card brands, retailers also will be covered for lost and stolen card fraud.

Risk vs. Benefit Analysis

According to major card brand reporting as of September 2019, counterfeit fraud at outdoor fuel dispensers reached $299 million last year. With an average 23% increase year over year, that equates to a projected $367 million in fraud this year and $451 million in 2020. “That’s huge,” Toth said. “Those are the numbers that the banks have been absorbing on our behalf, and that’s going to all switch to the retailer that doesn’t upgrade.”

ROI if $55,000 cost per site is paid in cash

Source: Conexxus survey data; www.conexxus.org

Toth projects that liability for non-compliant stores, using the $451 million annual fraud estimate, results in $12,860 per store in 2021 and $31,396 in 2022. For those who upgrade their sites, assuming a $55,000 cost per site financed over seven years at 8% interest, the chargeback savings are substantial: $2,296 in 2021 and $20,832 per year from 2022–27, totaling $127,285. The savings are more substantial for those who pay cash for the conversion, tallying $146,233.

“This is huge,” said Kara Gunderson, POS manager and PCIP of CITGO. “This is the first time that we’ve actually seen some pretty good numbers on this.”

Getting Started

Should you decide to upgrade your AFDs (and NACS hopes that you do), the time is now, Toth said, noting the number of requisite steps, some of which rest on the availability of a shrinking pool of technicians.

“There’s a process for this and it’s going to take time,” said Jim Linton, vice president of Folk Oil Company, who has successfully deployed outdoor EMV at their sites. “Plan on a minimum of four to six months for implementation.” As a first step, Linton said to assess the software for your outdoor card readers. “Is it available and ready?”

If not, Gunderson advises against playing the waiting game. “Do your hardware upgrades now. And then your downtime will be much less when you just need to upgrade your software.”

When it comes to hardware, Linton said to decide whether to replace or upgrade with a retro kit. “Meet with your local distributor and form a plan,” which will include implementing business broadband at your forecourt.

“Next, order those dispensers or retrofit kits,” Linton said. “I can't emphasize enough how important it is to schedule knowing that you’ve got a lot of lead time involved … because as we get closer to that deadline, technicians are going to be in demand.”

Liability for non-compliant stores results in $12,860 per store in 2021 and $31,396 in 2022.

Involve your internal IT staff in the process, Linton said, and then consult with your dispenser distributor to schedule a technician for each location. “Technicians are in short supply,” Toth said. “One of our colleagues went and looked through the job openings and found 700-plus fuel technician job postings last month. So clearly there’s a shortage.”

Toth cited lead times to schedule technicians at up to eight weeks in some places, “and that’s only going to get longer as more and more people implement EMV.”

As the implementation process unfolds, expect the unexpected, Linton said. “There’s going to be some downtime, so be patient.”

Next, make sure that the technicians follow your implementation and installation guides: “Your IT staff should study them along with the technician that’s doing the installation,” Linton said. “Everybody likes to cut corners now and again, but it’s important in this process not to do so.”

Recognize that post-deployment, the user experience will be different for both your customers and staff, he advised. “The payment process at your dispenser will be … different for your cashiers and customers. So, train your cashiers, show them how it works. And put up a sign on the dispenser telling the customers that you’ve done something different.”

Finally, “understand that there are going to be hiccups,” Linton said. “When there’s downtime, [be prepared] to get other things done within the store because you might be down a full day.”

ROI if $55,000 cost per site is financed at 8% over 7 Years

Source: Conexxus survey data; www.conexxus.org

Best Practices

As you navigate the deployment process, Linton offers some best practice considerations to minimize frustration. “First, I would encourage you to avoid Fridays and holidays,” he said. “If there’s a problem on a Friday and you go into a weekend, then you’re dealing with it all weekend.”

Next, “following that implementation guide is very important,” he said, emphasizing adherence to prescribed guidelines. “Spend the time to do individual site surveys before ordering pumps,” he said, ensuring that when you place an order, you’re getting what’s needed for each location.

After the technician has completed the upgrade but before leaving the site, “test and verify that everything is working like it’s supposed to at each dispenser,” he said. While most technicians “can’t wait to get out of there when it’s four o’clock, pay to have the technician hang around for an extra hour because that’s generally when things go wrong.”

Still on the Fence?

NACS and Conexxus hope that you appreciate the value proposition of upgrading your AFDs, and Toth underscores what’s at stake by revisiting the risk analysis conclusion.

“Waiting to upgrade could cost you $201,000 per site over the next seven years,” she said. “I can’t stress enough … can you afford to wait, and can you afford the financial impact?”

Another Option?

Should retailers decide not to upgrade their AFD card readers while seeking to avoid fraud liability, there’s perhaps another option: Accept only mobile payments at pumps. “Allowing customers to pay quickly through an app on their mobile phone is an alternative to the costly EMV upgrade,” wrote Balance Innovations in “How Will Gas Stations Respond to the 2020 EMV Deadline?,” though it comes at a convenience concession: Customers who don’t want to download a mobile payments app will need to go inside the gas station to pay on an EMV-compliant terminal.

Jerry Soverinsky

Jerry Soverinsky is a Chicago-based freelance writer and NACS Magazine contributing writer.