Visa Eases up on Triple DES Deadline in Face of ‘Migration Challenges’

Visa Inc. has “relaxed enforcement” of the July 1, 2010, deadline for petroleum retailers to install software that meets the so-called Triple Data Encryption Standard (also called 3DES or TDES) in response to requests from the major oil companies, including ExxonMobil, the card network said in a statement released this week.

While the July 1 deadline remains in effect, “Visa will provide some flexibility regarding non-compliance fines for certain acceptance segments, but will continue to encourage full compliance as quickly as possible by working closely with acquirers in managing the TDES migration plans,” Visa said in the statement.

A petroleum industry trade publication has reported that ExxonMobil sent a letter to jobbers stating that Visa has given ExxonMobil-branded retailers until Dec. 31 to upgrade their point-of-sale systems. Shell, ConocoPhillips, and BP also reportedly had requested extensions.

A Visa spokesperson wouldn’t specifically discuss any requests for extensions of deadlines from petroleum retailers. But Visa “has heard feedback from acquirers and merchants that there are migration challenges in some merchant categories,” according to the statement.

To continue to accept PIN debit, many fuel retailers have to replace existing payment-processing equipment to comply with the PCI PED Standard, which requires Triple DES encryption to protect keypads in automated fuel dispensers, as well as point-of-sale card terminals located inside the stations’ convenience stores. Triple DES software encrypts the PIN when entered into the keypad so it cannot be read even if captured by a skimming device.

But fuel-pump manufacturers have been slow in getting new, PCI-compliant automated dispensers with PIN pads into the market, creating a shortage of equipment that delayed implementation. The leading U.S. manufacturers of fuel dispensers—Greensboro, N.C.-based Gilbarco Inc. and Dresser Inc.’s Austin, Texas-based Dresser Wayne, focused initially on developing Triple DES applications for new pumps in January 2009.

Retrofit kits for older pump models didn’t begin appearing until the spring of 2009.

An estimated 750,000 to 800,000 automated fuel pumps in the United States are equipped with card readers and PIN pads.