Visa is believed to be considering postponing or at least easing some of its costly new security deadlines for dispensers.

At issue is whether the credit card company will delay requirements that marketers adopt a new encryption standard for PIN numbers on debit, known as Triple DES.

Currently, marketers must install new encryption devices by July 1, 2010 if they want to continue accepting PIN debit at the pump under Visa's new Payment Card Industry (PCI) standards.

Some refiners believe that that the current credit squeeze and equipment installation backlogs could lead Visa to push back the deadline by two years, to July 1, 2012.

Alternatively, Visa may opt to ease up on enforcement of a 2010 mandate, although majors consider that option less likely.

Visa is expected to make an announcement within the next month on which path, if either, it will take. Visa did not respond to a request for comment by presstime.

"We're all waiting to hear what Visa will do," says a marketing exec with one major. "People just aren't in a position to get the money right now, even if they want to get loans to comply."

Some oil companies are trying to help marketers scare up funds to start complying with multiple new PCI requirements. Shell, for example, has launched a program that offers marketers the ability to claim up to $500 in co-op funds per site for new software, or a 1ct/gal payment spread over two years.

While majors say they would welcome any such move by Visa, some are concerned that a postponement might give marketers an excuse to procrastinate further on PCI compliance.

"Retailers must realize that there will still be other PCI rules that they'll have to follow, so they shouldn't use any postponement as an excuse to put things off for too long," says one official.

Some marketers have been toying with the idea of not accepting debit cards at the islands in order to shave their PCI costs.

The most-talked about idea involves disabling PIN debit at dispensers. That would mean that customers who use a check card that can be processed as a debit or credit card would be forced to push the "credit" button on the pump for the sale to go through. The driver using a pure debit card would not be able to pay at the pump at all, but would have to go into the store to pay for fuel.

Alternatively, some marketers wonder if it would be possible to accept PIN debit at just one dispenser, slapping a decal on the pump to warn customers that they can only use their debit card at that dispenser, as first reported (OE 03/23/09).

The National Assn. of Convenience Stores says it would welcome any move by Visa that would give c-store operators more time to make "a reasoned assessment" as to whether the costs of upgrading to the new encryption devices at dispensers are worth the investment to keep PIN debit at the island. It is "a hard decision given the rising costs of PIN-debit transactions," NACS spokesman Jeff Lenard said.