Article

ATM deployer vs. ATM fraudster: how to make sure you come out the winner

May 30 anti-skimming webinar will present a 10-point strategy for defeating determined and increasingly sophisticated criminals.

May 20, 2013 by Suzanne Cluckey — Owner, Suzanne Cluckey Communications

Many of the best minds in the financial services industry today are not in the business of providing financial services. Rather, they are in the business of inventing ever more ingenious ways to siphon money from financial service providers — most often through ATM skimming.

Ingenious fraud techniques require ingenious defenses. And ATM and self-service terminal deployers need to know all about these defenses in order to devise the best-informed risk mitigation strategy.

Deployers can learn the facts that they need to know about skimming during a May 30 webinar hosted by ATM Marketplace and TMD Security titled, "10 essential facts to combat ATM skimming."

Presenters Claire Shufflebotham, global security director at TMD Security, Lachlan Gunn, coordinator and director of the European ATM Security Team Ltd., and Robin Hamstra, commercial director at TMD will share the latest information about skimming costs, trends and emerging threats, and will present a checklist of essentials for an effective skimming protection program.

ATM skimming — growing costs

In Europe, 99 percent of all ATMs are EMV compliant. Nevertheless, the European ATM Security Team reported an increase of 12 percent in skimming costs in 2012, amounting to €260.3 million ($335.7 million).

What's going on?

Eighty-five percent of the fraud experienced in Europe was cross-border, meaning that data was skimmed from the residual magnetic stripe on the back of an EMV card, and then used in a non-EMV market (most often, the U.S.), where magnetic data transactions are still the norm.

"The magnetic stripe is so easy to compromise that even a hybrid EMV card with a secure chip and a stripe means that the actual point of fraud will just migrate to those countries that are yet to move to a full EMV infrastructure," Shufflebotham said. "While the magnetic stripe remains on the card, skimming will continue to be the biggest single security risk to the global ATM industry."

Major card companies have said they don't anticipate removing the magnetic stripe from their cards anytime in the foreseeable future.

Today, a skimming incident costs a deployer $50,000 in hard cash losses on average — a phenomenal increase of 66 percent during the past two years, according to Aite Research. In Europe the estimated cost comes to $47,189 — an increase of 20 percent, according to reported data from EAST.

In addition to these hard costs, deployers must also foot the bill for operational costs for the reissuing of cards and repair of equipment — at an estimated $22,500 per incident. Additionally there are the incalculable costs of reputational damage and lost customer loyalty.

ATM skimming — emerging threats

The collection of card data at the ATM is an evolving criminal art that requires constant counteraction to defend against major losses from a skimming attack, which could take one of three forms:

Digital — Card data is collected and stored in electronic memory device, then downloaded to a PC where it can be read in the clear.
Analog — Sound from the card data signal on the magnetic stripe is recorded in MP3 or MP4 format, then downloaded to a PC. In cases where the ATM emits a jamming signal, the criminal uses computer technology to filter out the jamming signal. Analog skimming represents 65 percent of all skimming attacks.
Stereo skimming — an emerging threat designed to defeat one or even two jammers. The criminal uses a skimming device with two read heads; one to pick up the jamming and card data signals, the other to pick up just the jamming signal. The jamming signal is then filtered out and the data converted back into analog or digital format using a software decoding program.

"Effective anti-skimming technology is actually very complicated," Cees Heuker of Hoek, CEO. "It results from years of experience and insight into the constantly evolving nature of skimming techniques. The ATM and SST industries need proven protection from common frauds such as digital and analogue skimming and, most importantly, new threats such as stereo skimming."

The webinar, "10 essential facts to combat ATM skimming," will take place on May 30 at 11:00 a.m., EDT. It is offered free of charge and is open to all. Participants may register online.

photo: nancy ward

About Suzanne Cluckey

Suzanne’s editorial career has spanned three decades and encompassed all B2B and B2C communications formats. Her award-winning work has appeared in trade and consumer media in the United States and internationally.