News

FIs rely on third-party techs to inspect their ATMs

Third-party service providers are touting their turnkey solutions as the remedy for ATM owners' headaches. In fact, financial institutions arguably have the most to gain from utilizing the services of third parties for second- and third-line service, especially where the detection of skimming and fishing devices is concerned.

May 23, 2005

Pick up any banking trade publication and you'll soon be bombarded with images and stories of fraudsters' attempts to tamper with the ATM.

What's Important Directions on how to make skimming and fishing devices are readily available on the Internet. Fraudsters know how to copy mag-strip data, because it's been around since the '80s. A criminal can create a skimming device for less than $200.

Skimming and card-trapping devices can be easily disguised, especially to untrained eyes. At an off-premise location, for instance, a tampered-with ATM could eat cards for days and have them fished out by a fraudster on several different occasions before the bank or credit union ever realized a problem.

'Eyes and ears' of the industry

Rob Evans, director of industry marketing for Dayton, Ohio-based NCR Corp., said many financial institutions rely on trained third-party service technicians to identify those types of devices.

"When they (techs) go out there to service the ATM, they more readily recognize skimming devices and other things placed on the machine," Evans said. "In fact, we're seeing more and more requests for that very thing."

Evans said FIs' requests for techs to come out and inspect off-premise ATMs has tripled in the last 18 months. "A few years back, in the good ole days of the '80s and '90s, you typically didn't have to worry about skimming devices and other things being attached to your ATM."

But that's not the case today.

One reason for the increase in theft devices, Evans said, is that criminals have more information readily available to them than ever before. Almost anyone, he added, can make a skimming device that can be placed and disguised in a way not immediately detectable by the untrained eye.

"One of the wonders of the Internet age is that it's made it easier for criminals to get information about skimming devices," he said. "You can create a skimmer for under $200. It's amazing how easy and inexpensive it is to do."

Joni Sherlock, vice president of operations for Westmont-Ill.-based Efmark Service Company of Illinois Inc. (Efmark Premium Armored ATM Services), said techs provide a valuable service. Her team of first-, second- and third-line techs is trained to inspect five different types of ATMs. "We really are the eyes and ears out there," Sherlock said. "And all of the armored and maintenance techs are cross-trained in both areas."

Having trained eyes look at ATMs regularly is important, Evans agreed. Why? Because it's getting easier for criminals every day to figure out how to copy magnetic-strip information, he said.

"Since the mag-strip has been around so long - for 20 years - people have figured out how to copy it."

That ease to copy is a primary reason the Europay, MasterCard and Visa specifications were first introduced in 1996; and it's why European countries and others throughout the world are adopting cards embedded with smart chips (a.k.a. smart cards) in place of mag-strips. Information on smart cards is, reportedly, more secure than information saved within a mag-strip. And according to a report published by Verifone, entitled "EMV: Global Framework for Smart Card Payments," Visa estimates that counterfeiting can be decreased by at least 70 percent with smart cards.

(Read also, London Programme uncovers security flaw in chip payment cards.)

Sherlock added that because techs know what to look for, when they see suspicious materials like tape on an ATM or in a nearby trashcan, they pay frequent visits to that ATM - just to make sure it hasn't been compromised since their last check.

Pamela Hoy, a spokeswoman for Efmark, said companies like Efmark, which provide more than one line of service, benefit the ATM owners because their techs and personnel are cross-trained.

"I think having our route personnel, armored personnel, as well as maintenance techs, is a huge benefit," Hoy said. "The bank really gets kind of a double layer - in terms of security and protection. It's not just maintenance."

A banker's perspective

Pasadena, Calif.-based Wescom Credit Union has been using Efmark for first-line service and vault cash replenishment for the last seven years. The $3 billion credit union owns and operates 140 ATMs, 90 of which are off-site, said Kevin Sarber, vice president of the credit union's Remote and Automated Services division.

Sarber said having trained techs, whether through the manufacturing company or another third party, lessens the burden FIs have to carry. Wescom has been using Efmark for its first-line off-premise service since 1998.

"It's beneficial, since we have very infrequent visits to those ATMs from our own personnel," Sarber said. "From a fraud perspective and a security perspective, the technicians are our eyes and ears. We've had calls from deposit pullers about people lurking around the machines, or recommendations about how we could make the ATMs more visible from the street, by trimming the shrubs for instance."