Extending the EMV deadline: Compliance remains a priority
The COVID-19 pandemic led to card schemes announcing that the date for the EMV liability shift will be put back to April 2021, but this does not mean gas stations should stop thinking about compliance
As we have discussed in several articles previously, 2020 pre-COVID-19 was set to be a transformative year for the US gas station industry, most notably due to the liability shift for fraudulent transactions not authorised via chip and pin.
The consequences of the deadline, including the significant cost of upgrading payment terminals but also potentially of con-compliance, and the forced de-branding of independent gas stations that chose not to upgrade, had the potential to reshape the entire US gas station landscape. But then the pause button was hit; the arrival of the COVID-19 pandemic and its impact on economics and supply chains among other factors led to the gas station industry calling for a further delay to the deadline, and in early May the card schemes announced that the liability shift would be put back until April 17th, 2021.
On the face of it, this seems like a huge win for gas stations that were struggling to comprehend how they would meet the deadline (and whether it even made financial sense to do so) before the COVID-19 outbreak. But, in reality, there is still plenty of work to do and not an inexhaustible amount of time to complete it in. For this reason, the extension to the deadline does not mean EMV compliance should be any less of a priority for gas stations in 2020.
The impact of COVID-19
Before the onset of COVID-19, there was already significant concern that the industry was well-behind where it needed to be with regards to the deadline. In a survey conducted by Conexxus in 2019, 70% of gas station owners said they had zero EMV-enabled sites. 80% of owners said that they planned to install EMV-capable terminals at their pumps at some point in the future, but only 42% said that expected to meet the deadline. So, in short, 58% of the industry expected to miss the deadline well over a year in advance of the deadline.
And the impact of COVID-19 has only pushed EMV compliance further down the list of priorities for gas stations. Selling essential items in the convenience store, providing gas to first responders, and managing the realities of an economic downturn during a period where staff shortages and other increasing costs are ever more problematic has meant that at-pump EMV compliance simply isn’t on the majority of agendas currently.
Even for those few gas stations that can still stay focused on integrating at-pump EMV, there are supply issues hindering progress. The technicians needed to upgrade systems are in short supply, and in some states technicians have been banned from taking on new projects outside of repairing down pumps. New construction is proving more challenging, and this compresses available timeframes even further. Manufacturing equipment for installation and verifying software was also severely knocked off schedule, and offices processing inspections and permits were closed.
The need to remain focused
For all these reasons, the announcement of the delay was a welcome relief for gas stations. But this should not mask the fact that a huge percentage of the industry would have missed the deadline without the interruption of COVID-19. Not moving early enough was the main reason or this, either due to assuming that delaying until the last minute would still leave time to comply or because of financial concerns. In some cases, this meant worrying about the high cost in general, in others it was an acknowledged lack of understanding of the risks involved of non-compliance compared to the cost.
Increasingly, leading up to the October deadline, there was an acknowledgement that the risk of non-compliance is very real and cannot be ignored. The impact of a wave of chargebacks could be catastrophic for businesses, and those that don’t implement EMV at the pump not only run this risk, they also become even greater targets for fraudsters as their competitors solidify their at-pump security, compounding their issues further.
Counterfeit fraud, where the perpetrator uses a stolen or cloned card to make a payment, is currently increasing 23% year-on-year and may surpass $450m annually by the end of 2020. This would be a huge cost to bear for a potentially lower number of merchants that would be targeted by fraudsters as the majority integrate chip carder readers that are significantly more difficult to scam.
But this is no guarantee that gas stations will not return to being complacent, or remain so, when it comes to meeting the deadline now that it has be extended. For example, some gas stations that have traditionally seen little or no counterfeit fraud to-date may believe that the financial investment of being EMV compliant outweighs the risk of not doing so, and will come to regret this decision as fraudsters actively search out and flock to gas stations that are not EMV enabled.
Where plans that were put in place pre-COVID-19 have ground to a halt, a focus on EMV compliance cannot relapse. Those that failed to plan sufficiently before the announcement of a delay must take the opportunity to focus on how to achieve compliance before the April 2021 deadline.
In normal times, gas stations might expect for an EMV at-pump upgrade to take somewhere in the range of four to six months from site survey to installation. But as we emerge from the pandemic manufacturers, supply chains, technicians, and inspections might all be backlogged with requests, meaning that this tie period may end up being longer. In order to comfortably meet the new deadline, not letting compliance fall off the radar today is imperative.
This article was originally published in PetrolPlaza.