Introduction The state of ATM security
Chapter 1 ATM security trends
A multilayered approach
Chapter 2 Combating card and currency fraud
Chapter 3 Combating logical threats
Chapter 4 Combating physical threats
ATM vulnerabilities to physical attacks
The ongoing improvements in ATM security may sound like the start of a "Good News, Bad News" joke. The good news is, ATM security is improving. The bad news is, the bad guys always seem to be one step ahead.
As different markets implement security measures at different times, criminals move from country to country looking for easy targets. As adoption of the EMV or chip-and-PIN standard in Europe reached 98 percent in 2011, thieves follow the path of least resistance. In addition, approximately 65 percent of Canadian ATMs and 75 percent of Russian ATMs are EMV compliant, according to the European ATM Security Team (EAST).
Even though criminals may gain card data through skimming or other fraud techniques, EMV makes it nearly impossible to use the data to retrieve cash from EMV-compliant ATMs. So fraudsters have moved the redemption portion of the crime to countries that have not yet implemented chip-and-PIN authorized transactions. For instance, Europol reports that 80 percent of the fraud committed outside the European Union using EU payment cards is committed in the United States. That translates to about $1 billion in losses due to card skimming in the United States.
"The EMV rollout in Europe continues to be effective, although international losses are expected to continue while criminals are able to illegally withdraw cash from ATMs abroad that are not EMV compliant," said Lachlan Gunn, EAST director and coordinator.
The most recent fraud update report produced by EAST confirmed that skimming at ATMs is still an issue for all of the reporting countries, although overall the number of incidents is dropping, in line with the trend reported by EAST.
Dominic Hirsch, editor with London-based Retail Banking Research Ltd., called the shift of fraud "ironically a sign of the progress that is being made against skimming." Finally, EMV is making its way to the United States with MasterCard's announcement of the pending liability shift for interregional Maestro ATM transactions in the United States and the Visa Inc. road map.
Underlying this shift in crime is the reality that most fraud involving ATMs is the work of organized criminal gangs. These gangs use the proceeds from their thefts to further fund research and development of technology designed to overcome the industry's defenses.
Keep in mind that what the media often call "ATM fraud" is actually debit card fraud. More losses are due to the compromise of personal identification numbers (PINs) and fraudulent debit card use rather than the integrity of the ATM system. In fact, the Global ATM Security Alliance reports that just .0016 percent of all ATM transactions are affected by crime or fraud worldwide.
Losses to debit fraud are increasing, however, and now exceed losses connected to check and credit fraud, according to a survey by the American Bankers Association (ABA). Losses associated with debit fraud totaled an estimated $955 million in 2010, an increase from the $788 million in debit-related losses reported in 2008. More than 96 percent of banks surveyed in 2011 reported losses to debit fraud in 2010.
PIN-based transactions, such as ATMs and PIN-debit transactions at the point of sale, have lower losses than signature-based POS transactions, the ABA said.
However, the average loss at an ATM due to skimming has grown to $50,000, according to reports from Boston-based research firm Aite Group.
Big skimming cases run by organized gangs continue to grab the headlines. In June 2011, four men were charged for their alleged involvement in a $1.5 million ATM skimming scheme that targeted Citibank and JPMorgan Chase ATMs in New York, Chicago and Miami.
In another high-profile case, 28 suspects were indicted for their alleged connection to an organized credit-card skimming ring that recruited waiters and waitresses at high-end restaurants in Manhattan to collect card details from American Express accountholders.
Industry experts say that criminals tend to find the easiest target. The ATM or system that is least protected is most likely to be victimized, said Terrie Ipson, manager, security services strategy and business development for Canton, Ohio based-Diebold Inc., an ATM provider.
"Criminals will choose the path of least resistance and move down the street to somebody else's ATM," Ipson said. "They're constantly looking for ways to circumvent the security technologies that have been put into place. They're generally an organized criminal unit that's very well funded, so they have resources to work on devising sophisticated methods to defeat security."
This guide, sponsored by Diebold, will discuss ATM security, including card and currency fraud, logical threats and physical threats. We would like to thank Diebold for their support, which enables us to offer this guide at no cost.