Security

ATMIA and PCI warn of ATM cash-out threat

Photo provided by iStock

October 9, 2020

Summarize with

The PCI Security Standards Council and the ATM Industry Association are warning financial institutions and payment processors of an emerging attack known as "cash-out" that breaches and manipulates an ATM's fraud detection controls and ultimately the machine of all cash, according to a press release..

The ATM cash-out attack works by gaining remote access to a card management system by inserting malware or via phishing. These attacks then exploit any vulnerabilities of the system, giving fraudsters access to pin numbers of compromised cardholder accounts and the ability to create new accounts. Credit and debit cards of these new and compromised accounts are given out to a criminal team who then make withdrawals at ATMs in a coordinated manner until the machines are emptied of cash.

These attacks have happened globally and occur quickly, making early detection before damage occurs critical. Early detection can be made the following ways:

Velocity monitoring of underlying accounts and volume.
Installation of a 24/7 file integrity monitoring system and a reporting system that sends an immediate alert when suspicious activity is identified.
Development and practice of an incident response management system.
Monitoring for unexpected traffic sources and unauthorized execution of network tools.
Continuous phishing training for employees.
Multi-factor authentication and strong password management.
Adoption of a layered defense with strong access controls and identification of third-party risks.
Employee monitoring systems to guard against an "inside job."
Applying security patches for all software updates to avoid the risk of malware being inserted in a system.

Financial institutions and payment processors should also choose software vendors with built-in security for software products which provide ongoing security and support throughout the software's lifecycle.

Skimming / Fraud SecurityATM Industry Association (ATMIA)

Included In This Story

ATM Industry Association (ATMIA)

ATMIA is the leading non-profit representing the global ATM industry, serving thousands of members across 500 companies, including financial institutions, deployers, manufacturers, and service providers. As a division of, ePayResources, our mission is to promote ATM growth and usage, protect industry interests.

Request Info

Learn More