News

ATM industry mobilizes for fraud fight

All who convened in Washington D.C. for the inaugural meeting of the Electronic Funds Transfer Association's ATM Integrity Task Force agreed that ATM fraud has the potential to become one of the biggest and hairiest monsters the industry has ever faced. Less obvious were possible methods of slaying the beast.

July 30, 2002

All who convened in Washington D.C. for the inaugural meeting of the Electronic Funds Transfer Association'sATM Integrity Task Force agreed that ATM fraud has the potential to become one of the biggest and hairiest monsters the industry has ever faced.

Less obvious were possible methods of slaying the beast.

Secret Service Agent Gregg James reported on a recent fraud case in which skimming devices were placed inside ATMs in California and New York, allowing a ring of criminals to capture data stored on the magnetic stripes of bank customers' cards (see related story Skim skam man), and on other cases in which thieves captured PINs and magnetic stripe information using external "parasites" on ATMs.

While he didn't offer specific statistics, James said ATM fraud is on the rise in the U.S. - although still not approaching the levels of some other countries. James said the crime rings which are believed to be behind many instances of mass fraud will likely remain in their home countries until authorities crack down on the problem.

In Malaysia, which experienced a flurry of ATM skimming in recent months (see related story Malaysian authorities warn banks about ATM fraud), authorities are fast-tracking plans to convert ATM/debit cards from magnetic stripe to chip. Several banks have also imposed limits on daily ATM withdrawals, and some have severed their links with the inter-bank Malaysian Electronic Payment System. (See related stories More Malaysian banks sever network links and Malaysian bank fast tracks ATM smart card program)

If countries like Malaysia make it more difficult for thieves to steal account information, James said there is a risk that foreign criminals will move their operations to countries with fewer safeguards.

The independent angle

Gregg identifed the ISO sector as one area for concern, noting that one of two ISOs which sold ATMs to the ringleader in the New York fraud case kept such poor records that the Secret Service had trouble locating one of the ATMs after getting permission to seize it. The ISO also failed to obtain a driver's license or other form of identification from the buyer.

Relatively few countries have independent ATM deployers, and no country has an ISO market as developed as the one in the U.S., which Dove Consulting has estimated controls nearly a third of this country's 324,000 or so ATMs. Visa has already introduced what it calls enhanced ISO risk standards (see related story Visa: New ISO risk standards will help prevent fraud), and several networks are considering implementing similar regulations.

A loss prevention officer for one of the financial institutions which suffered losses in the New York case, who preferred to remain unidentified, wondered why the ISO didn't question an individual purchasing 30 ATMs. "Instead of wondering what his commission was going to be, he should have been wondering what the guy wanted those machines for," he said.

In some ways, said Mike Hudson, chairman of the ATM Integrity Task Force and executive vice president of Tidel Engineering, the industry is at odds with law enforcement. As ATMs proliferate, especially in non-branch locations, it becomes tougher to keep tabs on ATM activity.

"We have to figure out how we can continue to meet the market's demand for ATMs in convenient locations and at the same time combat fraud," he said.

Jim Merrell, director of product marketing for Diebold, agreed. "When we consider solutions to the fraud problem, certainly we have to consider security," Merrill said, "but we must also consider convenience and cost."

Hudson said it's important for the industry to deal with such issues head on rather than waiting for them to attract the attention of regulators.

"I think the last thing we want to have happen is for someone outside the industry to try to regulate this thing," he said.

Gregg hinted at that possibility when he noted that the Department of the Treasury has expressed concern that ATMs could be used as a means for money laundering.

Group effort

Several in attendance at the meeting, which was attended by some 40 representatives from major ATM manufacturers, networks, processors, financial institutions and ISOs, saw the strong showing as a signs of the industry's willingness to work together and deal with the problem proactively -- a trait not always found in previous efforts to enact change.

The importance of the issue seems to outweigh proprietary concerns, said Rob Evans, NCR's director of industry marketing. "This is about consumer confidence in payment mechanisms. If we lose that, we can all go home."

Susan Zawodniak, vice president and executive director of the NYCE network, suggested it would make sense to bundle as many anti-fraud efforts as possible into ATM upgrades that will be required to fulfill mandates for Triple DES encryption and Americans with Disabilities Act (ADA) compliance.

Despite the desire to move forward, some of the difficulties of problem solving -- or even of problem definition -- emerged during a break-out session. For instance, some attendees advocated broadening the scope to include point-of-sale devices while others wanted to focus only on ATMs.

Evans used his trip to the Capitol as an analogy for the way he envisions the industry working together to combat fraud. Automobile manufacturer Ford Motor Co. was responsible for getting him from the office to the airport, he said, where Delta Air Lines took over. When he arrived in D.C., he used the public transportation system to take him to his hotel.

"If each of us -- the guy who builds the ATM, the guy who operates the ATM and the guy who makes it work -- focus on what we can do to improve security, the result is going to be a pretty good end-to-end system," Evans said, noting that the task force can help identify any "gaps" in the system and correct them.

EFTA Director Kurt Helwig expects members of the task force to convene at an already-scheduled EFTA meeting in mid-September.