News

Playing by the rules -- and punishing those who aren't

Editor Ann All says it may be time to help officials establish and enforce appropriate regulations.

December 11, 2003

Nothing makes for a flashier "investigative report" than a hidden-camera tape showing someone doing something they are not supposed to do.

It's long been a tactic of shows like "Hard Copy" -- and has become increasingly popular among more mainstream network news programs like "60 Minutes" and "Dateline NBC."

Several such tapes were featured in a Nov. 30 "Dateline NBC" report focusing on ATM fraud -- specifically the issue of folks purchasing ATMs from ISOs then using them to harvest bank card information and PINs that can be used to compromise ATM users' accounts.

A convicted felon named Randy Glass was able to buy an ATM in one segment and to get a salesman's promise that he could in another -- even without providing a Social Security number.

Ann All

There is no question the "Dateline NBC" segment was not a balanced piece of reporting.

Secret Service agent Gregg James told reporter Victoria Corderi about the losses and accounts compromised during a high-profile case in which members of an Eastern European crime ring purchased ATMs and placed skimming devices inside of them -- yet no information was provided on how a group of ISOs, transaction processors and EFT networks helped apprehend several of the culprits. (See related story Skim scam man)

There was no information on how groups like the Electronic Funds Transfer Association and the ATM Industry Association are working with their members and with ATM vendors to ensure that measures are taken to help defeat ATM fraud. (See related stories New ATM security regs PIN it on the pad and Fraud fight gets more proactive at ATMs)

There was also no attempt to place the report in context, by mentioning how isolated the problem is or by mentioning that any device with a PIN pad -- including bank branch ATMs, point-of-sale terminals and pay-at-the-pump fuel stations, can be and are skimming targets.

If anything, criminals favor them because of their higher transaction volumes and relatively low risk ratios. A thief who affixes an external skimming device to a branch ATM or convinces a retail clerk to participate in a skimming scam is in theory more difficult to track than one who has to fill out some kind of paperwork to buy an ATM.

System failed

That said, did I find the "Dateline" report disturbing? Yes.

While I don't believe criminal background checks are required (yet) under Visa's enhanced ISO risk standards and other network guidelines, ATM providers are supposed to obtain personal and financial background information from buyers of machines.

Yet one of two ISOs shown in a hidden camera segment assured Glass that no such information was needed and that he was "automatically approved." Another sales rep volunteered to omit Glass' Social Security number from his paperwork.

In today's highly competitive environment, where every sale counts, I'm sure it's tough to turn away someone with an open checkbook. But it's important to look at the big picture here. Yes, machine sales are worth a few thousand bucks a pop -- but public confidence in ATMs is priceless.

If public confidence suffers enough -- and shows like "Dateline" don't help -- the entire business will suffer. I've heard ATMs compared to vending machines, but looking at them that way is a mistake. Vending machines cannot be used to obtain confidential financial information or to access the electronic banking infrastructure. It should be more difficult to buy an ATM than a Coke machine.

Closing some loopholes

Once criminals figure out ways to exploit loopholes, they will continue to do so until the holes are closed. Earlier this year, in a case similar to the scam referenced in the "Dateline" report, several Russians were convicted of fraud after they purchased ATMs and installed them in Vancouver, Ontario Canada, rigging them with skimming devices. (See related stories Two women sentenced in Canadian ATM fraud, Canadian police arrest Russian in skimming case) 

Three men -- all with criminal records -- were indicted earlier this week in Manhattan in yet another case similar to the earlier scams. In the wake of the most recent indictments, Sen. Charles Schumer (D-New York), a member of the Senate Banking Committee, has announced plans to introduce legislation requiring ATM operators to undergo background checks and be licensed by federal authorities. (See related stories 3 men indicted in NY ATM skimming case and NY senator wants ATM operators to be licensed)

I think it may be time for some additional oversight of the ATM business. Currently, it's largely left up to the financial institutions that sponsor ISOs into EFT networks to police them. These FIs are a generally diligent group -- but I believe ISOs would be more careful if they were more accountable for their actions and the actions of the agents they employ.

Not a popular public stance, I know -- but several ISOs have privately agreed with me.

Why not take those who are not following the rules out of the game? It removes any short-term advantage they may currently enjoy over their more scrupulous competitors. 

"What will happen if I'm competing on the street, and I'm asking my locations to do something that no one else is?" the president of a California ISO with more than a thousand machines under contract asked me earlier this year.

Those who are running their businesses the right way -- while not exactly excited by the prospect of more paperwork -- should have no real fear of regulation. Maybe it's time to admit it, and to work with the authorities on establishing appropriate regulations and helping enforce them.

Many have seen it coming, I believe. I've noticed that several larger ISOs have added house attorneys to their staffs in the past year.

After Credit Card Center (CCC) finally drove itself out of business through mismanagement, many in the business breathed a sigh of relief and talked about the industry "dodging a bullet."

Well, I think these recent instances of fraud and public reaction to them have far greater ramifications, the potential of being a real rocket launcher.

I don't mean to downplay the CCC debacle. Many of the merchants victimized by that company called me for help after discovering our site on the Web. It pained me to tell them that they had been ripped off and had little if any hope of recovering any of their money.

While they were certainly misled, the merchants knowingly entered into contracts with CCC. Consumers victimized by skimming scams are doing nothing more than using their cards to withdraw cash -- something we want to encourage them to do in greater numbers. Let's not give them a reason to abandon the ATM.