Where EMV Spells Headache

With almost 18 months to go, the petroleum industry is having a hard time with a crucial EMV deadline. Not many gas stations are expected to make it. Here’s why.

It’s halftime in the runup to the October 2020 deadline set by Visa Inc. and Mastercard Inc. for gas stations to install in-pump EMV card readers, and the latest line on whether the industry will reach full compliance, or only a portion will, is: pick ‘em.

What’s even more worrisome for Visa and Mastercard, which have already extended the petroleum industry’s deadline for EMV compliance by three years, is this: If full compliance is not reached, handicappers refuse to predict what percentage of stations will be EMV-compliant come October next year.

The penalty for non-compliance is the same as it was for other retail businesses in the past: liability for chargebacks will shift to the out-of-compliance party.

Currently, about 30% of all gas stations in the United States are estimated to have EMV card readers, to be testing them, or to be starting to install, according to industry experts. Of that segment, just 1% to 2% are considered to be EMV-complete, or ready to go, says Cory Schlegel, director of product development for the Quantum Petro service at Jacksonville, Fla.-based payments-technology provider Sound Payments. The service provides a cloud-based EMV retrofit kit for fuel pumps.

That’s a strong indicator a substantial portion of gas stations won’t be even close to compliant by the deadline.

A Touchy Subject

The glacial pace at which the industry is moving, even after the deadline extension, is attributable to myriad factors. Two of the biggest hurdles, according to industry experts, are cost and a paucity of certified EMV solutions.

Cost is a prickly subject, especially for independent station owners, who often have older pump technology and a limited IT budget. The average cost to make a single fuel pump, which typically has four nozzles, EMV-compliant ranges from $25,000 to $30,000.

That toll can jump as high as $40,000, depending on features station owners want to add, such as integrated loyalty, fleet card, and third-party marketing/discount programs, fuel-industry experts say. By comparison, a fuel-pump replacement with a bare-bones EMV card reader runs about $20,000.

With an average of four pumps per station, station owners are looking at $80,000 to $160,000 to upgrade, on average—more for larger fueling depots.

While station owners affiliated with major brands typically receive financial incentives from the oil companies for industry-mandated upgrades, mom-and-pop independents don’t. That makes it harder for small-station owners who are not experiencing a lot of fraud to justify expensive pump upgrades, says Josh Smith, chief executive and founder of Gas Pos, a North Little Rock, Ark.-based provider of EMV retrofit kits for fuel pumps.

With gas margins at their lowest level in years, around 2 cents per gallon, it can take a decade or longer for small-station operators to recoup their return on investment, Smith says.

Another overlooked cost factor comes into play if a station must break ground to remove the pump, which opens a big can of worms.

“Once ground is broken, there is environmental testing and other building codes to comply with, and that gets costly,” says Sound Payments’ Schlegel. “If a station owner has to replace his fuel-storage tanks after breaking ground, it could run millions of dollars.”

Such unanticipated costs could put station owners out of business, industry experts say.

Another big issue is that many payments processors are still testing their in-pump EMV software prior to certification. Currently, there is only one commercially available EMV application for in-pump cards, with a few more in the beta phase, says Schlegel.

Why so few? The problem is attributable to the welter of applications for payments processing in the petroleum industry. Processors have different applications for specific oil company brands, pump manufacturers, makers of in-pump card readers and PIN pads, connections to back-office networks, and combinations of all of the above. The result: a bottleneck in bringing solutions to market.

“There just aren’t certified solutions available for every combination of equipment at this point,” says Linda Toth, director of standards for Alexandria, Va.-based Conexxus Inc., a technology standards body for convenience stores.

Indeed, NCR Corp., which makes in-pump card-reader hardware and applications, says its work with pump manufacturers and processors has resulted in 27 different applications that must be certified.

“The sheer number of configurations requires a lot of certifications,” says Paul Kern, product management director, payment services for NCR.

Once a processor has developed its application, pump makers must certify it to ensure compatibility with their electronic payment system, which connects the pump to the processor. Next, major oil companies must certify the application for their affiliates, as in-pump card transactions will run over their networks to a processor.

Standing Pat

While all the involved parties are reportedly talking with one another, the parley has not, so far at least, sped development of in-pump EMV solutions.

“Even though we are working with processors, we don’t drive their schedule,” says Russ Haecker, EMV business leader for Austin, Texas-based Dover Fueling Solutions. “Solutions are being developed and tested, and I expect we will see some announcements about readiness in the coming months, but a lot of station owners aren’t inclined to start moving forward until they know for certain there is a ready-to-go solution.”

Indeed, many independent, multiple-station owners have a hodge-podge of fuel pumps and back-office systems across their locations. That makes it harder for them to upgrade to EMV if they are looking to standardize in-pump POS equipment and a generic EMV solution is not available.

Other complications: a shortage of certified technicians to install EMV card readers and the need to shut down pumps for a day or longer to install new card readers, which costs sales.

Add it all up and it’s a pretty messy situation, according to Smith of Gas Pos. “The mandate to install EMV is well-intentioned, but unlike in brick-and-mortar retail, there are so many endpoints with outdoor card readers that have to be tied together. It’s prompted a lot of station owners to stand pat until there is more clarity,” he says.

Some fuel-industry executives argue the logjam will break later this year as more processors get their solutions tested and certified. That should pave the way for the major brands to begin upgrading their stations in earnest, says Haecker.

‘Hotbeds of Fraud’

But just how far along processors are in developing in-pump EMV solutions is uncertain. The same is true for POS terminal makers.

First Data Corp., one of the largest merchant processors, did not respond to requests for an interview. POS terminal makers Ingenico and Verifone declined interview requests.

Verifone did say, however, it is working closely with all North American dispenser manufacturers to meet the EMV technical requirements ahead of the October 2020 deadline. Visa and Mastercard did not respond to interview requests.

The best bet on which stations will be EMV-ready at deadline? Those affiliated either with a major oil company or convenience-store brand. Both kinds have a strong motivation to be sure their stations are EMV-compliant and soon. Failure risks making their stations magnets for fraud, experts say.

More than 50% of the top 200 oil-company retailers have installed in-pump EMV hardware, says Eric Bagden, director, retail solutions, for Gilbarco Veeder-Root, a Greensboro, N.C-based provider of fuel dispensers and convenience-store technology.

On the c-store side, Speedway, for example, has rolled out EMV at all its locations, but not yet turned it on, says NCR’s Kern.

Independent station owners moving to meet next year’s deadline tend to be in geographic areas, such as Florida, where gas stations are prone to fraud, says Kern. The fraud stems from card skimming at the pump as well as stolen cards.

This trend has raised concerns that independent station owners in areas less prone to fraud may be more willing to gamble by delaying EMV implementation.

“A lot of independent station owners look at the average cost of chargebacks for the petroleum industry and apply it to their business without understanding that there are hotbeds of fraud in the industry,” says Haecker of Dover Fueling Systems. “If they are non-EMV-compliant after the deadline, they will be painting targets on their backs.”

What independent station owners currently experiencing low fraud rates tend to overlook is that criminals can resell gasoline just as easily as fraudulently purchased hard goods, petroleum industry experts say.

Anyone’s Guess

One option that may spark higher adoption of EMV card readers is retrofit kits, which cost a fraction of replacing the entire pump.

“Electronics tend to fail before the pump hydraulics, and when that happens the prevailing thought is to replace the entire pump because it costs the same as replacing the electronics,” which includes screen, card reader, and PIN pad, says Steve O’Toole, vice president for convenience and retail sales at NCR.

While a straight EMV card-reader retrofit can cost about 50% of the cost of a compliant pump replacement, according to petroleum-industry experts, the larger question is whether existing bottlenecks can be resolved in time to prevent an 11th-hour rush before the 2020 deadline. In such a rush, the shortage of technicians would become more acute, experts say.

Nor should anyone bet on getting more time. With Visa and Mastercard granting one deadline extension, another is not expected. “There’s no indication an extension is necessary or that one is coming,” says Randy Vanderhoof, director of Princeton Junction, N.J.-based U.S. Payments Forum.

A related question is whether non-compliant station owners can expect strict enforcement of chargeback penalties for non-compliance once the deadline passes, or at least a brief grace period.

Right now, that’s anyone’s guess.