Security

ATMIA and PCI warn of ATM cash-out threat

Photo provided by iStock

October 9, 2020

The PCI Security Standards Council and the ATM Industry Association are warning financial institutions and payment processors of an emerging attack known as "cash-out" that breaches and manipulates an ATM's fraud detection controls and ultimately the machine of all cash, according to a press release..

The ATM cash-out attack works by gaining remote access to a card management system by inserting malware or via phishing. These attacks then exploit any vulnerabilities of the system, giving fraudsters access to pin numbers of compromised cardholder accounts and the ability to create new accounts. Credit and debit cards of these new and compromised accounts are given out to a criminal team who then make withdrawals at ATMs in a coordinated manner until the machines are emptied of cash.

These attacks have happened globally and occur quickly, making early detection before damage occurs critical. Early detection can be made the following ways:

• Velocity monitoring of underlying accounts and volume.
• Installation of a 24/7 file integrity monitoring system and a reporting system that sends an immediate alert when suspicious activity is identified.
• Development and practice of an incident response management system.
• Monitoring for unexpected traffic sources and unauthorized execution of network tools.
• Continuous phishing training for employees.
• Multi-factor authentication and strong password management.
• Adoption of a layered defense with strong access controls and identification of third-party risks.
• Employee monitoring systems to guard against an "inside job."
• Applying security patches for all software updates to avoid the risk of malware being inserted in a system.

Financial institutions and payment processors should also choose software vendors with built-in security for software products which provide ongoing security and support throughout the software's lifecycle.

Included In This Story

---

ATM Industry Association (ATMIA)

The ATM Industry Association, founded in 1997, is a global non-profit trade association with over 10,500 members in 65 countries. The membership base covers the full range of this worldwide industry comprising over 2.2 million installed ATMs.

Request Info

Learn More