General Notes About ATM Security

Millions of ATM transactions are successfully carried out every day around the world without problems or interference by criminals and fraudsters. The ATM has been used safely for over three decades and has a proud safety and service record throughout that period.

Only a tiny fraction of criminal incidents occur at ATMs in comparison to the huge volume of usage at the more than 1.2 million ATMs worldwide.

10 ATM FAQs (Frequently Asked Questions)

How big is the fraud problem?
The amount of money diverted from ATM systems in the U.S., for example, is a fraction of the amount of funds processed. It amounts to approximately .05%, or five one-hundredths of one percent by industry estimates.

Is this the industry’s fraud tolerance rate?
There is no tolerable rate of fraud. All fraud is a crime. For 25 years, the industry has continually invested its resources in significantly upgrading the security of its systems in an effort to stay ahead of the bad guys.

What role can cardholders play in reducing ATM crime?
A massive role. It is incumbent on consumers to observe basic safety procedures when using an ATM or ATM card, and to follow the instructions of their card-issuing financial institutions should they suspect that they have become the victim of ATM fraud.

What are the basic safety procedures cardholders should follow when using ATMs?
Consumers should only use an ATM where and when they feel completely comfortable. They should pay attention to the machine before using it. If something appears unusual or unfamiliar, they should use another machine. They should never accept help from strangers at ATMs. They should never disclose their PIN to anyone. They should check that no one is trying to look over their shoulder to observe them entering their PIN. They should also look after their bank cards as carefully as they would handle cash and not leave wallets, purses or any form of personal identification lying around in public places. Finally, customers should check their monthly bank statements closely and report any discrepancies to their bank.

Following these simple guidelines will increase the consumer’s security awareness and reduce ATM crime and fraud.

Is anything being done about ATM fraud?
The ATM industry is aggressively addressing fraud - few in the industry, let alone in the general public, are aware of the extraordinary efforts being made to fight ATM crime and fraud. Consider the following list of initiatives:

ATM Integrity Task Force - The Electronic Funds Transfer Association (EFTA), in affiliation with ATMIA, is publishing recommendations on PIN security; working with the Secret Service and ATM product and service providers.

Global ATM Security Alliance (GASA) - An arm of ATMIA that is organizing international efforts to combat cross-border crime rings. It is working with the Secret Service, Interpol, the Metropolitan Police Flying Squad for New Scotland Yard and major card issuers.

ATM Security Conferences - ATMIA is educating the ATM industry on the most effective ways to fight ATM crime and presenting awards to those who contribute significantly to the cause.

ATM Security Working Group - An organization based in the UK that, among other projects, publishes recommendations for boosting security at freestanding ATMs. (See related story UK's ATM Security Working Group could serve as model for U.S.)

Fair Isaac Card Alert - A service that analyzes millions of daily transactions and identifies suspicious activity in near-real time, then sends a list of potentially compromised card numbers to affected financial institutions. This service has been instrumental in solving many fraud cases, including the high-profile skimming case in New York City. Other companies have similar products.

Modifications are being made to machines by major ATM manufacturers to detect tampering and, in some cases, shut the machine down if fraudulent activity is detected.

Security upgrades to machines include: TDES and EPP Certification, as well as enhanced PIN security and encryption. In addition, new physical security measures are being taken to offer more robust protection to the machine itself.

The financial industry, ATM manufacturers, ATM networks, financial institutions, processors, service organizations and deployers continue to look for ways to upgrade the security of ATM operations. This includes: hardware design, software, operating procedures and network regulations.

A number of companies have developed systems that analyze millions of ATM transactions in real time and identify suspicious activities, which have provided key evidence in prosecuting fraud.

ATMIA’s Sponsorship Resources Task Force is producing detailed best practices for sponsoring independent deployers onto ATM networks.

ATMIA, in affiliation with all sectors of the ATM Industry, is creating a resource center for information related to Rules, Regulations and Best Business Practices for the ATM industry.

Are ATM transactions becoming especially risky?
No. All payment systems are subject to fraud. None are totally foolproof. Currency can be stolen or counterfeited. Credit cards can be skimmed and reproduced. Checks (cheques) can be stolen and cashed, counterfeited, or kited. However, please remember that the consumer is in control of which ATM he or she chooses to use and when.

If anything, ATM transactions, like most forms of electronic payments, create an electronic audit trail that can provide valuable information in tracking and prosecuting ATM fraud.
Millions of ATM transactions are successfully carried out every day around the world without problems or interference by criminals and fraudsters.

But aren’t so-called “off-premise” ATMs or ATMs not located at bank branches more likely to be compromised by fraud than bank branch ATMs?
Not really. Firstly, off-premise, or independently owned ATMs, are subject to the same network rules that govern machines that are owned by banks.

Secondly, in order to be connected through an ATM network, non-bank owners of ATMs must be sponsored by a financial institution. The financial institution is responsible for maintaining the same dependability for those machines as for its own.

Is the problem of ATM crime growing?
What continues to grow is ATM usage. Consumers have come to depend on the reliability and ubiquity of ATMs. ATMs have become part of modern life. It is understandable that as the number of transactions rise, the number of fraud occurrences will rise as well. However, it would not be accurate to say that ATMs have become more susceptible to fraud.

If ATM fraud has not changed, why is there such an increased focus on it now?
What has changed is the nature of ATM fraud. It no longer just consists of someone shoulder surfing or robbing a consumer walking away from the machine. It may now involve elements of organized crime, meaning; people who study the industry for years in order to perpetrate a systemic pattern of fraudulent activity.

However, this is an industry that for 25 years has successfully stayed ahead of the “bad guys.” It is a competitive industry. The race for market leadership continues to produce safer machines, more secure software and better operating rules to protect all consumers.

How closely does the ATM industry work with law enforcement and fraud prevention groups?
Very closely. Law enforcement and fraud prevention groups, including: the US Secret Service, the Flying Squad at New Scotland Yard and the South African Fraud Prevention Services, are part of the Global ATM Security Alliance that is working out strategies for dealing with international ATM crime. In addition, various partnerships have been formed in several countries between the police and industry associations and ATM deployers, such as the ATM Integrity Task Force in the USA and the ATM Security Working Group and the APACS national ATM crime programme in the UK.

Acknowledgements
EFTA
ATMIA
Tom Harper, President, NetWorld Alliance
Global ATM Security Alliance