Finance

Gas stations fight hackers — but they're going to have to pay for it

Hackers are dialing up the heat on gas stations, but business owners are about to start fighting back.

As U.S. retailers continue the nationwide rollout of payment terminals that accept EMV cards, which are chip-enabled debit and credit cards designed to better stamp out fraud, more than 150,000 convenience stores and gas stations will be the next leg of implementation.

Similar to last year's deadline rush to update brick-and-mortar stores' payment systems, it's expected to cause headaches at the pump and at the register when upgrades begin over the next 12 months.

The deadline for installing payment technology is Oct. 1, 2017, but convenience store operators big and small are expected to begin setting up new systems in less than a year as gas stations get ready for the switch.

It's going to cost stations and convenience stores about $6 billion, since upgrading the technology comes with a price tag as high as $17,000 per pump, according to Gray Taylor, executive director of industry group Conexxus. That has the potential to cut into the bottom line of small-business owners, who make up the majority of owners of U.S. gas stations and convenience stores.

"It's an economic calculation for the merchant," said Jason Oxman, CEO of The Electronic Transactions Association. "It's a lot harder to replace a gas pump."

Michele Eve Sandberg | Corbis | Getty Images

Some U.S. retailers, notably small businesses, balked at the fall 2015 deadline to implement EMV technology at points of sale, because the payment terminals were costly to acquire. They run several thousand dollars, depending on the number of card processing machines. EMV stands for Europay, MasterCard and Visa — the three entities that created the new standard for payment processing.

Gas stations and convenience stories will have to remove many pumps entirely to install new technology. Retrofitting existing pumps can cost more than $6,000, Taylor said. While it's expected to cost more than the technology upgrades retailers faced, the loss of gas pumps may create delays for summer drivers next year.

That isn't to say every gas station in the U.S. will be overhauling technology at once. Still other gas stations may opt to delay their EMV card readers until after the deadline's passing making them potentially vulnerable to hackers whose targets are becoming fewer and likely setting them up for greater losses on identity theft.

At the same time they're implementing the EMV chip technology, gas stations and convenience stores will also make the upgrade to mobile payments systems, meaning that they will not have to make any big overhauls in the future to accommodate cardless technology.

Gas stations and convenience stores are some of the last U.S. retailers to make the upgrade to the EMV card platform (some ATMs also have until Oct. 1, 2017, to make the technology switch). Because many hackers have been disrupted by retailers, they have increasingly targeted convenience stores and ATMs lacking the security measures, experts said.

"From a criminal perspective, that window of opportunity is shrinking," said Jared Drieling, business intelligence manager at payment data analysis firm The Strawhecker Group. "There's going to be a rush to get those updated."