Article

Serving the user, securing the ATM: A delicate balance

Is it really possible to harden an ATM against skimming attacks while ensuring a first-rate user experience? TMD Security answers 'yes.'

March 12, 2015 by Suzanne Cluckey — Owner, Suzanne Cluckey Communications

A picture is worth a thousand words, supposedly. But it really only takes four to sum up a particularly effective PowerPoint image from this week's webinar, "ATM card fraud prevention — achieving maximum security and convenience": ATM security is complicated.

The image — of an ATM secured behind iron bars — speaks to the difficult balance between hardening the machine and its contents against criminal attack and ensuring a user experience that maintains the speed, functionality and availability that consumers have come to expect.

So perhaps we should make it five words: ATM security is very complicated.

The webinar, sponsored by TMD Security and ATM Marketplace, took up the particular problem of how to protect an ATM against skimming crime. Three experienced security experts from the company addressed different dimensions of the problem:

Robin Hamstra, sales director for EMEA, offered insight into trends in card fraud and skimming — including digital, analog and stereo techniques. He also presented data on the European experience with EMV, including its effects on cross-border fraud.

Hamstra described (with examples) the proliferation of websites from which criminals can now order sophisticated skimming equipment — quickly and cheaply enough to make it worth the while.

"Just as fraudsters act fast, and are hard to trace, these websites typically appear and then soon move on, changing their URL to avoid being tracked down," he said.

Additionally, Hamstra presented statistics about the effects on ATM crime of Europe's marketwide implentation of EMV:

despite 100 percent deployment of EMV, the number of skimming incidents is still higher than in 2005;
international losses have risen 11 percent;
the top three cross-border locations are U.S., Thailand, Indonesia; and
criminals in the European market are turning to low-tech methods; card trapping now constitutes 35 percent of fraud.

Tom Moore, TMD Security managing director for North America, discussed best practice fraud prevention and described the relative value of anti-skimming options such as passive protection, jitter, sensors, and active jamming, which he said was the most effective means to protect the ATM and maintain a high quality user experience.

"Random electromagnetic signals interfere with the skimming device’s ability to make a clear copy or recording of the card data," Moore said "The more effective the jamming signal, and the more transmitters used, the more difficult it is for the criminal to filter out this jamming signal, and decode the card data in clear."

Moore also introduced a solution that provides active jamming for DIP readers — protection that has up to now been unavailable because the jammers interfere not only with the skimmer but also with the legitimate ATM card reader. So, machines relied upon a sensor to detect physical tampering with the machine and, in turn, activate the jammer. The problem: This took the machine out of service.

With TMD's Active DIP kit, Moore said, "the jamming signal is always on, so every transaction is protected from the threat of skimming. ... [I]t works like jamming in a motorized card reader and does not rely on the detection of a suspected skimming device to trigger it. The performance of the DIP card reader is not affected, and because the card data is always actively protected the ATM or SST safely stays in service all the time."

Finally, Claire Shufflebotham, Claire Shufflebotham, TMD global security director, discussed the latest threats — including the significant increase in the number of incidents of "eavesdropping" and the resurgence of card trapping in Europe following the migration to EMV. Figures from the European ATM Security Team showed that trapping had increased 98 percent in 2013.

"Though the cash losses associated with a trapping incident are not insignificant, it is the potential impact on cardholder convenience and trust that probably cost a lot more," Shufflebotham said. "We hear from our banking partners that the major issue with card trapping in their perspective is just how invasive this fraud is. It comes between them and their customers. The customer’s card is physically withheld — and the customer is left feeling deeply inconvenienced and unhappy."

Shufflebotham said that TMD recently worked with a major bank in the U.K. to design, develop, test and deploy new anti-trapping technologies, including a new bezel that makes it more difficult difficult for the criminal to insert a trapping device (it also has jammers inside to protect against skimming). The company also developed an active solution that physically holds the trapped card in place and keeps it safe so that the criminal can’t get hold of it.

"Industry collaboration, and technology innovation have been successful so far and the results have been encouraging," she said. "While card trapping remains a problem, we are seeing a reduction in the number of incidents where defenses are being deployed and this means less time wasted for the branch in investigations with law enforcement and much better security and service for their customers."

Replay the webinar on demand.

cover photo courtesy woodleywonderworks | flickr

About Suzanne Cluckey

Suzanne’s editorial career has spanned three decades and encompassed all B2B and B2C communications formats. Her award-winning work has appeared in trade and consumer media in the United States and internationally.