Friday, April 18, 2014
The NAC reported on April 7, 2014, the day before Microsoft stopped its support for XP, that its discussions with the three biggest manufacturers of independent, nonbank ATMs in the United States concluded that virtually all ATMs managed by ISOs and other nonbank entities do not run on XP. The consequence of this information is that ATM ISOs remain unaffected by the XP support end date, NAC said.
The Green Sheet reported in January 2014 that the XP support end date meant that ATM ISOs would have to upgrade ATMs to other supported operating systems, like Windows 7 or 8, to keep them secure from fraud. The reasoning went that XP-based ATMs would be subject to more fraud because Microsoft would not be issuing new security "patches" to shore up future vulnerabilities in the OS.
However, that report appears to be partially incorrect. It is still true that bank-operated ATMs may be vulnerable to more fraud because most of those ATMs, in fact, do operate on XP. But for ATM ISOs, such is evidently not the case.
Bruce Renard, Executive Director of the NAC, said the information the association received from the three largest suppliers of nonbank-affiliated ATMs – Nautilus-Hyosung, Genmega/Hantle and Triton – was that those ATMs employ Windows CE, not XP.
Renard noted that Microsoft continues support for CE, which is designed for embedded systems and is licensed by Microsoft to original equipment manufacturers, such as ATM manufacturers. ATM ISOs are thus off the hook on this issue and do not have to incur the expense of upgrading their ATMs to newer systems.
"The manufacturers knew the situation well," Renard said. "This is one cost that will not have to be borne by the ISOs/IADs [independent ATM deployers]. Between the costs they incurred with the ADA [Americans with Disabilities Act] implementation and now with EMV [Europay/MasterCard/Visa] migration, they needed and deserved a little break."
Renard explained that most of the media covering the ATM industry "missed the boat" on the XP issue. Reports that 95 percent of all ATMs in the United States use XP were factually incorrect, he said. "It may well be 95 percent of the bank ATMs," he stated. "But they never really looked at, or talked to, the ISO/IAD side of the business. And, of course, we [the nonbank ATM sector] now have most of the ATMs in the U.S."
Renard noted that the elimination of XP support is still an issue for banks. He said that manufacturers of ATMs for banks, such as Diebold and NCR, "have these issues because they use XP. And so, lots of the bank machines appear to be exposed with this. … The independents seem to be in better position than the banks when it comes to the loss of XP support."
Renard was pleasantly surprised to discover through dialogue with the independent ATM manufacturers and other research that almost three out of every four ATMs in the United States are independently operated, which works out to almost 300,000 out of approximately 430,000 total ATMs.
"And, the trend for domestic ATM deployment continues," he said. "I think the banks have realized that providing off-premise ATM services is not their bailiwick. It's a 'messy' business from their perspective." By messy, Renard means servicing the machines and handling paper money.
Renard added that ATMs are the "bread and butter" of ISOs/IADs that manage ATM networks of units placed in malls and other nonbank retail locations. "Basically, we do it better and more cost effectively," he said.
Editor's Note:
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
