Nine EFT Networks Approve a Triple-DES Retrofit for ATMs

Nine electronic funds transfer networks have now approved a $1,600 retrofit kit from a Cincinnati-based ATM refurbisher and servicer for use in ATMs on their systems. The kit, called 3DESPlus, allows ATM owners to upgrade existing machines to make them comply with new security requirements from the bank card companies for the encryption of personal identification numbers. The networks' approval is necessary before ATM deployers can install the upgrade. The ATM Exchange, the company that is marketing 3DESPlus, says some 90% of the installed base of 380,000 ATMs in the U.S. need to be retrofitted or replaced to comply with the so-called triple-DES requirement. The nine networks certifying The ATM Exchange's product are: eFunds, Lynk, Fiserv Southwest, Fiserv EFT/CNS, Columbus Data Services, Metavante, NYCE, NETS, and Shazam. The company also says testing has been completed at two other networks, Elan and Visa DPS, with final approval pending. These network approvals come weeks after Visa International gave the device a so-called Class B certification (Digital Transactions News, July 7), certifying that it meets the card company's technical security requirements, including those for so-called triple-DES encryption of PINs. Class B covers the numerical keypad for entry of personal identification numbers as well as the display screen and manufacturer's firmware, which is the code controlling the ATM's security functions. Visa's lesser Class C designation covers only the encrypting PIN pad, or EPP. The ATM Exchange is selling the device for $1,600, regardless of volume, to third-party ATM servicers and other re-sellers, which in turn apply any markup the market will bear. The ATM Exchange, which is a reseller itself, lists the item at $1,950. Installation runs about $250. By contrast, a new ATM with built-in triple-DES capability would run more than five times as much. David T. Parlin, president of The ATM Exchange, says the potential market for the retrofit is about 33,000 devices. The ATM Exchange introduced its retrofit kit to offer ATM owners a less costly alternative to swapping out their installed base of machines for new ATMs meeting the new standards. The new product, which incorporates technology from Sagem, a keypad manufacturer, and Thales e-Security, a maker of cryptography products, works in most models made by Diebold Inc. and NCR Corp. Alarmed at the potential for criminals to crack conventional PIN security, both Visa and MasterCard have put in place stringent technical standards for ATMs, point-of-sale terminals, and other so-called PIN entry devices, or PEDs. Among these standards is a new requirement, popularly known as triple DES, calling for a more elaborate encryption protocol for cardholder PINs than has been the case up to now.