With network mandates that ATMs be Triple DES compliant in 2005 and many vendors reluctant to upgrade models long in tooth, many financial institutions believe their oldest machines have been given a death sentence.
But two ATM service companies hope to grant those machines a reprieve with devices designed to make them capable of running the new encryption standard.
Cincinnati-based ATM Exchange developed 3DES Plus after vendors announced they wouldn’t support models like NCR's 5000 series and Diebold's 1060 and early 1000 series.
"(Those models) are a core part of our business, so of course we want to continue to support them," said Dave Parlin, the company’s president.
3DES Plus works by instructing the encrypted pin pad to enter "secure" mode and store a cardholder’s PIN. The EPP creates a "substitute" PIN and passes it to the ATM processor; the actual PIN never leaves the EPP. The 3DES Plus processor resets the EPP to transmit other data in the clear.
The product retails for $1,950 and is designed to work on most NCR and Diebold models.
ATM Exchange is working with both MasterCard and Visa to obtain approval for its product.
Euless, Texas-based Pi Systems developed a similar product, 3DES Fix. While Pi Systems believed its customers would mostly be owners of older ATMs, company president Sabrina Turner fields inquiries from owners of machines that are just 3 to 5 years old.
"Some of them are being told they'll need a new processor, more memory and a new monitor. So they're looking at upgrades that are going to cost upwards of $10,000," she said.
3DES Fix's software follows states sent by the processor, enabling the control module to determine whether the EPP should be in Triple DES or clear text mode. The module converts all DES ATM messages to Triple DES before sending the message to the network processor.
3DES Fix costs $3,500. It is designed to work on most NCR and Diebold machines and Fujitsu's 7000 series.
Several transaction processors, including eFunds, have certified 3DES Fix, Turner said.
Alan Falconer, SVP of consulting firm Paragon Data Services, said the products "are certainly creating a stir."
But, he asked, "If machines using these things start rejecting PINs, whose responsibility will it be? The manufacturer likely wouldn't stand behind it, and I doubt if Pi Systems is going to start issuing service contracts."
Rob Evans, director of industry marketing for NCR's Financial Solutions, agreed that ongoing support is an issue. "Will you have one guy for the keyboard/encryption device and another guy for everything else?" he said.
Both companies are recruiting independent ATM service companies to install and service their products.
