The deadline has passed for ATM operators in the MasterCard network to install microchip readers in their machines or accept future liability for fraudulent activity involving chip-embedded cards.

But a Portland Press Herald analysis of MasterCard network ATMs in Portland, Lewiston-Auburn, Augusta and Bangor found that just over 11 percent of machines have been outfitted with the more secure chip readers.

That low percentage leaves too many Mainers vulnerable to ATM card “skimmers” and other methods of ATM fraud, a consumer watchdog group said.

“The 12 percent of Portland ATMs that are now chip-enabled is right in line with other cities around the country – but that is an unacceptably low number,” said Edgar Dworsky, founder of Massachusetts-based consumer watchdog service Consumer World. “Bank customers deserve to have this highest level of security at every ATM they use.”

The slow changeover to chip-enabled ATMs reflects a backlog of orders for the hardware to convert ATMs and the accompanying software upgrades, according to a representative of Maine’s banking industry. Until they are converted, if a bank, retailer or other ATM operator within the MasterCard network fails to install a chip reader, and a fraudulent withdrawal is made using a chip-embedded card, it’s the ATM operator that suffers the loss.

ATMs AND SECURITY

There are two major card processors for ATM transactions in the U.S.: Visa and MasterCard. Visa network ATMs are labeled with the Visa and Plus brands, and MasterCard network ATMs are labeled with the MasterCard, Maestro and Cirrus brands.

MasterCard set an Oct. 1 deadline for ATM operators in its network to upgrade their machines with chip readers or accept liability for future fraudulent transactions involving chip-embedded cards. Visa set its deadline for a year later, in October 2017. The card processors set a similar deadline for retailers to upgrade their point-of-sale systems to chip readers in October 2015.

Historically, Visa and MasterCard have accepted financial responsibility for ATM fraud in their respective networks, but they have argued that it is unfair in situations involving lax security on an ATM owner’s part.

A Press Herald analysis found that:

• Among the 815 Portland-area ATMs in the MasterCard network, only 96 are equipped with chip readers. That works out to 11.8 percent.

• The Lewiston-Auburn area was slightly better than Portland, with 13.9 percent of MasterCard-network ATMs containing chip readers.

• Only 8.8 percent have chip readers in the Augusta area, and 7.8 percent have them in the Bangor area.

Percentages for the Visa network are harder to gauge, although the Press Herald did determine that there are 70 Visa ATMs in the Portland area with chip readers, 39 in Lewison-Auburn, six in Bangor and none in Augusta.

The most prevalent form of ATM fraud involves devices called “skimmers.” According to cybersecurity expert and blogger Brian Krebs of krebsonsecurity.com, a skimmer is a device that is affixed to the card slot of an ATM that surreptitiously reads and records sensitive data from the magnetic stripe of any card inserted into the slot.

A skimmer generally is used in combination with a tiny camera placed somewhere on the ATM that is pointed at the machine’s personal identification number pad. With the card data and the PIN acquired, the thief has everything he needs to make a dummy card and use it to withdraw the victim’s cash.

In June, three men were arrested by investigators from the Cumberland County Sheriff’s Office for allegedly skimming and cloning credit card information around southern and midcoast Maine.

It can take weeks or months for victims of ATM fraud to recover their stolen cash, because card processors generally do not reimburse a victim until after the theft has been fully investigated by law enforcement. That’s a stark contrast from credit card fraud victims, who usually are reimbursed quickly.

However, skimmers don’t work if the card has an embedded chip and the ATM has a chip reader, Dworsky said. Consumers can’t necessarily tell if an ATM has a chip reader just by looking at it, but there are locators on both the Visa and MasterCard websites for finding chip-reading ATMs in any city or town.

“With so many reports of criminals using skimmers to steal ATM card numbers, it is surprising that banks have been so slow in completing upgrades to their systems, whether or not required by the card networks,” he said.

Financial institutions in Maine are working as fast as they can to install chip readers in all of their ATMs, but the process takes time, said Chris Pinkham, president of the Maine Bankers Association.

Chip readers at retailer checkout aisles are relatively simple and inexpensive to install compared with those inside ATMs, Pinkham said. The machines must be opened up and special hardware and software installed by a qualified technician. All of that must occur while security personnel are on hand to ensure no one uses the opportunity to steal money from the disassembled ATM, he said.

Right now, there is a long waiting list for ATM operators in Maine to have their systems upgraded, Pinkham said.

“They’ve ordered them, and they’re in the queue, because of the giant volume of replacement,” he said. “You’ve got a software component and a hardware component, and the back-order is real.”

While the upgrade process continues, consumers in Maine still will be able to use any ATM regardless of whether it has a chip reader installed, Pinkham said.

“That’s a liability standard and not an accessibility issue,” he said.

John Murphy, president and CEO of the Maine Credit Union League, said credit unions in Maine are making significant progress toward upgrading their ATMs with chip readers. In addition, they have been installing anti-skimming devices to thwart fraudsters, he said.

“Over half of our 255 ATMs have already been upgraded and I anticipate that all planned upgrades will take place prior to the October 2017 (Visa) compliance date,” Murphy said.