ATMIA reaffirms strength of ATM security

"The ATM, in general, and the personal identification number in particular, are extremely secure and safe for consumer use," said Lana Harmelink, international director of ATMIA, a global non-profit association with more than 1,050 members in 50 countries. "There are over 1.6 million ATMs in the world performing millions of transactions every day, and the scale of ATM crime is truly minute compared to these volumes."

There are about 49 billion cash withdrawals each year at ATMs, including more than 14 billion at U.S. ATMs, according to ATMIA. The amount of cash withdrawn annually from ATMs in the United States is several hundred billion dollars. The ATM industry's estimated fraud losses are less than one-tenth of 1 percent of cash dispensed at ATMs in the United States and those losses are carried by the issuing banks and networks, not by the consumer. 

ATMIA says a combination of banking laws and network rules ensure that consumers in many countries, including the United States, are protected from monetary losses from fraudulent use of ATM cards, PINs and personal financial information. In the United States, Federal Reserve Regulation E ensures that consumers are covered and do not bear the financial burden of fraud. 

"The ATM Industry is dedicated to providing a safe and secure way for consumers to conduct financial transactions at the time and place of their choosing," Harmelink said. "As criminals trying to exploit ATMs modified their methods over time, our industry developed new technologies and safeguards to prevent fraud."

An example of this kind of proactive ATM security is the implementation of encrypting PIN pads and Triple-DES encryption. Those security enhancements, which instantaneously encrypt PINs within the PIN pad using strong encryption standards, are now mandatory on all ATMs operating in the United States. The standards, Harmelink says, have effectively eliminated the electronic theft of PINs from the ATM.  As a consequence of EPP and Triple DES, criminals have shifted their fraud focus to POS terminals and pay-at-the-pump and merchant IT systems.

 

"Today, criminals attempting to acquire PINs at the ATM are more likely to do so by using physical skimming devices coupled with PIN Pad overlay devices or camera systems to capture card data and PINs," Harmelink said. 

"Most of what is commonly reported by the press as 'ATM fraud' is actually PIN fraud (or debit-card fraud)," Harmelink said. "This fraud occurs when criminals obtain counterfeit cards and PINs from skimming of either POS terminals or databases operated in the retail environment. In these cases, the ATM is simply used as a means to retrieve cash — it is not the point where the cardholder's card number and PIN were stolen or copied, and in no way represents a threat to consumers."

In the rare case when ATM fraud does occur, ATM transactions create an electronic audit trail that can provide valuable information in tracking and prosecuting ATM fraud. 

However, ATMIA says it acknowledges that any dollar lost to fraudulent activity is a problem for the industry as a whole, and ATMIA says it expects to continue cooperating with law-enforcement agencies across the globe to fight any and all criminal activities directed at the electronic-payment system.