Article

Webinar: Combating fraudulent redemption at the ATM

The Diebold-sponsored event discussed ATM vulnerability points and security program best practices.  

October 6, 2011 by Kim Williams — Reporter, NetWorld Alliance

Financial institutions around the world face increasing pressure from rapidly growing risks, threats and compliance mandates related to the security of their ATM fleets.

Skimming is one of the most widespread and organized crimes detected at the ATM. Bank cards use a magnetic stripe to store information to identify the customer and a personal identification number (PIN) to authenticate and allow transactions at an ATM. Unfortunately, the magnetic stripe information is simple to copy and counterfeit. As a result, thieves have focused on various methods of collecting this information.

In a webinar, sponsored by Diebold Inc. and ATMmarketplace, titled “Combating Fraudulent Redemption at the ATM,” industry experts discussed critical ATM threats and the fraudulent redemption that occurs due to ATM security breaches.

The Oct. 4 webinar presenters included Julie Conroy McNelley, a senior analyst within Aite Group’s Retail Banking practice, covering fraud, data security, anti-money laundering and compliance issues, and Chuck Somers, vice president of ATM Security and Systems for Diebold Incorporated.

McNelley opened with an overview of Aite Group’s research regarding financial institutions’ concerns over fraud and compliance mitigation risks through the ATM channel and the ways in which they approach and combat these issues.

“Compliance and managing risk were the top concerns by a pretty significant margin, outpacing a lot of revenue related initiatives” McNelley said.

On the fraud side, McNelley said that FIs ranked malware and skimming as the root causes of losses, citing organized crime as the common denominator between the two. McNelley noted that the same survey administered in 2009 only yielded 35 percent of FI respondents listing skimming as their highest concern, whereas the 2011 survey revealed that 70 percent were “concerned” or “extremely concerned.”

Naming the 24-hour news cycle as the cause for heightened consumer awareness of fraud threats, McNelley said that FIs are leveraging that awareness and viewing fraud protection as a competitive differentiator.

Interestingly, the 2009 survey asked FIs if and when they thought the U.S. would migrate to EMV chip-based cards and 36 percent responded that the U.S. would never make the transition, whereas the 2011 survey saw that number more than cut in half. Further, the 2011 survey was conducted before the recent Visa and MasterCard announcements regarding liability shifts and incentives for merchants.

Cardholder data chain of trust

Somers highlighted the seven areas of vulnerability in an ATM transaction from the time the cardholder takes her card out of her purse to the time she replaces it.

The points he identified were:

• Vestibule door access
• External skimmers on card-entry slots
• Internal skimmer on card reader
• Card reader to processor communications
• PC malware
• TCP/IP – Host communications
• Back end infrastructure – Data store

In talking about the major losses sustained by FIs today, which is the illegal redemption of cards that have been copied or cloned, the liability sits with the issuers of those cards.

“That is significant and important because not all owners or deployers of ATMs are issuers of cards, so some of the regulation standards and/or liability shifts that are happening in the industry are having a dramatic impact on everybody,” Somers said.
Somers also pointed to the significance of the Visa and MasterCard announcements, specifically MasterCard’s, which states that it will extend its existing EMV liability shift program for inter-regional Maestro ATM transactions to ATMs in the U.S effective April 19, 2013.

“This shift in liability over to the acquirer is really protecting these people who have issued EMV cards and made the infrastructure investment, and it’s really now putting the pressure on those geographies that aren’t compliant or bear that liability,” Somers said.

Somers wrapped up the presentation with a card fraud risk mitigation strategy incorporating these best practices for a comprehensive security program:

• Consumer awareness
• Inspect ATMs regularly
• Leverage fraud alert systems
• Chip-based cards
• Contactless cards
• Deploy video surveillance and monitoring
• Out of band authentication
• Biometric readers

Listen to the entire webinar, including an extensive Q&A session, here.

Included In This Story

---

Diebold Nixdorf

As a global technology leader and innovative services provider, Diebold Nixdorf delivers the solutions that enable financial institutions to improve efficiencies, protect assets and better serve consumers.

Request Info

Learn More