By Ray Birch
HOUSTON–Just like when EMV cards rolled out several years ago and credit unions lagged behind banks in converting to chip cards, many CUs are now expected to be late to the game again as the Windows 10 ATM conversion deadline approaches.
And this time around the tardiness could present even more of a threat to credit unions than when they left mag stripe cards in the market for crooks to target, according to Gary Walston. The president and CEO of Dolphin Debit believes hackers will come right after CUs looking to invade the much easier-to-hack Windows 7 driven machines.
No More Support
In January in 2020, Microsoft will no longer support Windows 7, which means the company will no longer send updates and security patches for the operating system, on which the majority of CU ATMs are running today.
“That is the main threat from not converting by the deadline,” said Walston, who believes crooks will zero in on the older software-driven ATMs. “For example, we are all aware of the attacks like jackpotting that occurred earlier last year that came about because criminals attacked older ATMs that didn't have the updates, didn't have the patches, did not have the protections. That made it much easier for the criminals to hack into them.”
Walston noted the 2020 Windows 10 deadline, like the EMV deadline, is not a mandate from the networks, simply a safeguard to keep ATMs updated to protect against the latest fraud threats.
“It’s a gamble the credit union takes—and a bigger gamble as time goes on—if they don’t update their machines,” Walston said.
Walston believes the pace of CU migration from Windows 7 to Windows 10 will be similar to how the movement switched to chip cards saying, “I think it’s going to be a lot like it was with EMV several years ago—they will be late to the game.”
Backlog of Requests
Walston is concerned about a backlog of requests to upgrade machines that could make the wait much longer for those that don’t get moving soon.
“I am not aware of a single processor that has certified Windows 10 on their platform yet,” he said. “At least with our processors, we're still looking at the second quarter before the Windows 10 is even certified. A lot of CUs are now being approached by their ATM support vendors or from the manufacturers of the machines themselves.”
Cost is likely the main issue stalling decisions, said Walston, noting credit unions have the option of upgrading existing machines, buying new ones or outsourcing their fleet. He estimated upgrades can range from $3,500 to $12,000 per unit.
“That's a massive expense,” he said. “My concern is credit unions get locked into that type of order without thinking things through,” he said.
Walston said upgrading may not make sense for older ATMS that are nearing the end of their lifecycle. He noted the lifecycle of an ATM continually shortens with all the updates that are being required in recent years—first Americans with Disabilities Act compliance, Windows 7, EMV and now Windows 10. He said the growing complexity of managing an ATM fleet is driving more credit unions to outsource their machines, a service Dolphin Debit provides.
“We had record growth last year,” he said.
Don’t Rush, But Hurry
While the decision can’t be rushed, Walston again cautioned about waiting too long.
“There could be long lines to get the upgrades completed due to limited resources. And time is already being squeezed as many processors are still in the certification process. There's going to be limits in terms of the actual upgrade kits that are available. There's a limitation on these resources, and that’s not getting into the human element—are there enough technicians out there to physically upgrade all the machines. Do they have enough time if they started today? Bottom line, there's going to be a hangover into 2020 for folks making these upgrades.”
Walston believes many credit unions think January 2020 is still a long way off.
“What we're trying to tell them is you really need to make the decision in the May or June of this year to be able to make sure you get in line and get in the queue to have your fleet upgraded before January,” he said.