Upgrade or die: ATMs must update their systems by April, otherwise no more security support

Did you know that there are more than 420,000 ATMs in the U.S.? Mind-boggling, I know, but what’s really shocking is the fact that nearly all cash machines run on Windows XP, an operating system that’s 12 years old.

Well, this is the year Microsoft is putting its foot down. As of April 8, all ATMs must update their operating system, as this is the date Microsoft has declared it will stop offering tech support and security patches to these machines.

The only ATMs excluded from this mandate are those using a stripped-down, super-basic version of XP known as Windows XP Embedded. For these machines, which are less susceptible to viruses, Microsoft will continue to provide support until early 2016.

The rest though, will move over to Windows 7, an OS that was first offered in October 2009. 

To say the ATM network is a bit jumbled would be an understatement. Networks range from one-offs in convenience stores to national banks that operate thousands of terminals. Regardless of who owns what, all machines are expected to meet this deadline, or otherwise find themselves at risk of no longer being in compliance with industry standards.

Aravinda Korala, chief executive officer of ATM software provider KAL, told BusinessWeek.com that he expects only 15% of bank ATMs in the U.S. to be on Windows 7 by the April deadline. “The ATM world is not really ready, and that’s not unusual,” he says. “ATMs move more slowly than PCs.”

Microsoft is expected to sell custom tech support agreements that extend the life of Windows XP-supported ATMs, but the cost of this program is expected to rise quickly, multiplying by a factor of five in the second year according to Korala. JP Morgan Chase has already agreed to a one-year extension to give them the extra time they need to update all of the machines in their vast nationwide network (they’re expected to start converting over to Windows 7 in July).

Wells Fargo, meanwhile, has said that the company is working with Microsoft and ATM manufacturers to upgrade its machines.

The upgrade of the machines isn’t an exact cost, but estimated to be somewhere around a few hundred dollars if its parts are in decent shape; if components need updates in order to support Windows 7 (think of the antiquated one-off machines found in delis, stationery stores, etc.), that cost could balloon well into the thousands.

As for those that simply ignore the deadline and don’t receive the updates / upgrades necessary? The good news is that the ATM will continue to work just fine. The bad news: the machine will be more susceptible to malware and other attacks (customer balances are safe under the standard protections banks offer to ATM users against fraud).

It should be noted that this is not an unfamiliar story for the ATM industry — the industry faced a similar deadline back in 2000. Then in 2002, all machines had to meet new encryption standards, followed by a mandatory upgrade in 2011 for all ATMs to support audio technology that complies with the Americans With Disabilities Act.

So, the industry can handle this sort of pressure — it’s just how quickly they react has yet to be seen.

Story via businessweek.com