Article

ATM security, regs top industry to-dos

ATM experts and agencies gathered in Houston to talk ATM security.

September 17, 2008 by Tracy Kitten — Editor, AMC

Click here to see a slide show from the event.

The greatest challenge facing the financial industry, in the United States and beyond, is terrorism. That's sometimes difficult for financial-services providers to grasp, says Jim Candelmo, deputy criminal chief for the U.S. Attorney's Office and keynote speaker during last week's ATM Industry Association's Payments Fraud in the Americas conference.

"It's all about the connections," Candelmo said. "We have been watching the financial industry for a number of years, and we've found that â€˜following the money' is so important when it comes to fighting terrorism and crime."

This year's West event, which only a couple of years ago was officially re-branded the "security" conference, marked ATMIA's last.
Beginning in 2009, ATMIA will hold only one annual event in the U.S.
ATMIA East: Feb. 10-12 in Nashville
ATMIA's focus: Not just ATMs, but overall payments
Number of attendees: 120 registered
Number of years: ATMIA's 11th year.

Card compromises, such as the well-known TJX breach, fall in line with a number of challenges the industry is struggling to combat. In fact, as the world becomes a smaller place, financial providers have to work together more closely. Stephanie Cook, the vice president of fraud management for Metavante, says international crime rings are creating new challenges for financial institutions, processors, issuers, etc.

When counterfeit cards are used on four different continents, tracking compromises as they happen is critical, she said.

"Eastern European and Russian gangs are leading the way, and they don't have to have a PIN to compromise the card," Cook said. "We're actually seeing a lot of signature-debit fraud."

According to Co-Op Financial Services, which owns and operates the Co-Op ATM network, from July 2006 to August 2006, between 4,000 and 5,000 Co-Op debit transactions were disputed — reflecting a growing problem that the network spent the last year addressing.

J.B. Rambaud of Fiserv says debit is vulnerable, accounting for between 15 percent and 22 percent of all fraudulent attacks on cards, though credit-cards still seems to the be weakest link, accounting for 51 percent of all card attacks. Card-not-present transactions remain the industry's most vulnerable.

In the payments space, Candelmo says monitoring fraud will continue to be a No. 1 priority for the government. Finances are part of terrorism, and in the ATM space, regulators and legislators have grave concerns about money laundering and crime rings' ease when it comes to accessing cash.

story continues below...

Better ATM Services, Inc. Gift cards, premiums, and incentives dispensed right from the ATM cash tray without costly upgrades. A more secure, convenient, profitable distribution option.

"Increased government regulation of financial information will happen, and it's going to reveal all kinds of fraudulent activities. But you need to be ahead of this curve as an industry, because I suspect it will drive criminals from traditional financial channels and more to ATMs," Candelmo said.

For U.S. ATM deployers, it means more government scrutiny and industry regulation, says Kurt Helwig, chief executive of the Electronic Funds Transfer Association, which co-hosted the security event with ATMIA.

Helwig says he expects a lot of changes to come down the pike in the near future, relating to evolving Payment Card Industry standards and overall regulation.

â€˜Legislation might influence us to do the right thing'

Jim Hanisch, chief executive of Co-Op Financial Services, says fraud will never be prevented.

"Every time we think we've found a silver bullet, it tarnishes very quickly," he said. "Legislation might influence us to do the right thing."

Changing industry opinions are one reason ATMIA and EFTA have partnered, Helwig says.

"We're working to help law enforcement, and they're working to help us," he said.

In Sydney, Australia, partnership with local governing bodies and ATMIA has helped ATM operators cut the number of physical attacks on ATMs by 95 percent.

"We've retained that reduction for 12 months," said Richard Gould, director of Lockit Systems (Aust.) Pty. Ltd. "The city has saved between (AUS) $3 and $4 million in the policing area alone. Through cooperation with policing agencies and ATMIA, we've been able to drastically reduce the attacks."

Ram raids

See what other industry experts and law-enforcement have to sayabout reducing ram raids in the United States

Though not so sexy when compared with high-tech, international card comprises, physical attacks on ATMs are rapidly growing in popularity throughout the world. In the United States, ATMs are most often attacked by brute-force, usually called ram raids or smash and grabs. ATM bombings and gas attacks, while popular in Africa, have not caught on domestically.

Gould, who developed and patented an anti-ram-raiding/anti-smash-and-grab device called the Raminator, is a licensed security consultant in Sydney — and he says he sees similarities between ATM attacks in Sydney and attack trends in the United States. Gould has more than 1,000 Raminators out on the market today.

Between 2005 and 2007, Sydney suffered nearly 200 ATM attacks, with each attack costing an average of AUS $120,000 in damages alone — cash losses and expenses related to damage to the ATM are not included.

In the States, Texas, specifically Dallas, seems to be a hotbed of ATM attacks. To combat the problem, the Dallas Police Department assigned a special task force. Det. Steve Catina is heading up that force. (Click here to watch a video interview with Det. Catina and Mike Adams of DASH ATM)

In 2008, Dallas suffered more than $500,000 in store damages and $400,000 in cash losses because of ram raids, Catina says. The cost of damage to the ATM is not included in those figures. Exxon, 7-Eleven, Valero and Walgreens were hit most often, he said.

"Some of industry's rapid ATM growth has led to some of is growing security vulnerabilities, and ram raiders are taking advantage of that," Catina said.

For one, ATMs that are left full of cash overnight and are located near front windows or doors are prime targets. Catina says CVS, which was hit three times in Dallas, was able to make its stores less attractive by moving its ATMs to the center of its stores.

"Little things can make a big difference," he said.

And while Gould is working to promote his Raminator product in North America, some local players, including DASH ATM LP, which last year released an ATM shroud/sleeve that helps prevent ram raids, are garnering some interest in Texas.

Mike Adams, a DASH partner, says ATM deployers need to address ram raids now.

"We're hearing that some retailers are viewing ATMs as more of a liability than a benefit," Adams said. "That's a real problem. So we developed a product that some of our customers asked us for, just something to put retailers' minds at ease."

Watch videos interviews with Rod Reef, the former chairm and CEO of Citishare Corp., regarding card losses and EMV.

See a video interview with Jim Cichy, the vice president of fraud services for PULSE, about financial losses after card compromises.

Included In This Story

ATM Industry Association (ATMIA)

The ATM Industry Association, founded in 1997, is a global non-profit trade association with over 10,500 members in 65 countries. The membership base covers the full range of this worldwide industry comprising over 2.2 million installed ATMs.

Request Info

Learn More