Article

Internal ATM cash theft: The toughest temptation

How can we better design ATMs and their security systems to reduce the opportunity — and the rewards — for internal theft?

April 10, 2015

by Ross Woodburn, International Business Development, Scotia Security Group

Statistics on the volume and nature of ATM crime are extensive and make for fascinating, if unpleasant, reading. A significant proportion is carried out by individuals involved in the storage, transport, handling and dispensing of cash. This type of crime is not so much overlooked as it is underreported — for reasons that are perhaps understandable.

How can we better design ATMs and their security systems to reduce the opportunity for internal theft and make it less rewarding?

Access all areas

Arguably, the majority of cases of internal theft are impulsive, or at least unplanned. This makes the first task in reducing theft one of reducing opportunity, which means understanding where the weak points are in the cash handling process — points where cash is more accessible to more individuals — and then finding ways to reduce that accessibility.

This "temptation reduction" strategy can only be effective to a certain degree; even modest rewards that are hard to obtain will, to the determined or sufficiently desperate thief, be too hard to resist.

To help address this we can implement measures designed to reduce both the perceived and actual rewards from internal theft. Here, technology, product design, process and logistical improvements can be combined to create an environment in which the perception of potential rewards is further reduced — on more occasions tipping the balance in favor of not acting.

Internal affairs

We might not like to think it but it seems that a significant number of employees commit theft against their employer; according to a 2005 survey conducted by the University of Florida, employee theft accounted for roughly half of store inventory shrinkage, about $17.6 billion per year, making it a much greater problem than theft from shoplifting. And according to the Global Security Alliance (part of the ATM Industry Association) about 90 percent of ATM-related fraud in the United Kingdom is committed by organized crime and internal staff. Insider fraud is more prevalent but the losses from organized crime are higher.

So, it happens. What can we do about it?

Fundamentally, as suggested above, we can take measures designed to reduce the attractiveness of the opportunity, simply by making it clear that the potential rewards are low.

In an ATM context, some simple measures should, on initial inspection, make a substantive difference. For example, keeping less cash in the ATM sounds like the right kind of thing to do, but this inevitably means more frequent replenishment, adding cost.

ATMs are vulnerable when open; for instance, during replenishment and servicing, but these opportunities can also be made less tempting by making anyone with legitimate access to the cassettes enter a secure code, creating an audit trail. These "legitimate thieves" can be put off from opening other cassettes by the introduction of time delays.

Logistical considerations, such as who actually carries out cash replenishment and performs first line maintenance, can also come into play. in the U.K. approximately 20,000 of the roughly 70,000 ATMs are in bank branches, but only a fraction of these — less than 20 — are replenished by third parties, increasing the potential threat.

Equally concerning is the fact that around 23,000 ATMs not in bank branches are replenished by site owners. Every bank performs first line maintenance for branch ATMs but outsources this for nonbranch devices.

Publicizing clearly that an ATM is protected and that potential gains are low must act as strong deterrents. Such protection includes ink-staining (possibly using "aromatic" dyes), electric shocks, GPS tracking of stolen ATMs, panic buttons, smart cassettes that auto-count cash and record access, and CCTV.

Making clear that access to only one cash cassette is possible at any one time is a clear and simple opportunity-reduction measure that can be realized through good product design.

Finally, operational procedures can reduce the opportunity for fraud or theft; dual control ensures that a second person verifies actions. This can be made a physical constraint, whereby two people with different keys or codes must be present to access secure areas.

Money is expensive

With the number of ATMs in Europe alone approaching half a million, and the number of transactions around 12 billion, according to the European Central Bank at the end of 2012, the scale and cost of the business of maintaining, replenishing and servicing such a vast estate becomes clear.

The ECB estimates that cash replenishment costs approximately two billion euros per year.

It’s a huge industry, one that by its scale and complexity creates opportunities for fraud and theft, a proportion of which is committed by individuals that handle or have access to cash. But it is possible, by the judicious application of technology and product design, to reduce this class of crime.

It's hard to imagine totally eliminating temptation, but perhaps it can be reduced to the point where it's no longer so irresistible.