News

Seen and heard at 'ATMs in the Americas'

Activism was the order of the day at 'ATMs in the Americas,' the ATM Industry Association's conference in Tampa, Fla., earlier this week.

March 2, 2004

The ATM Industry Association has so many initiatives under way, one needs a scorecard to keep track. No scorecard -- but a stack of handouts at its "ATMs in the Americas" show earlier this week showed just how busy the group and its members have been lately.

Some 450 attendees in Tampa, Fla., were invited to participate in a growing number of ATMIA committees, including the Global ATM Security Alliance (GASA), a legislative committee, a committee for sponsoring financial institutions and an ISO committee.

Formed in June, GASA includes five project teams: communications, best practice and standards, physical ATM crime, ATM crime information system and global security testing standards.

The communications team has already produced an exhaustive Cardholder Security Best Practice manual, with two smaller versions designed for easier consumer consumption. The manuals have been translated into Russian on ATMIA's Eastern European portal and into Spanish on the GASA and North American sites. A set of ATM crime "talking points" to assist industry members responding to media queries has also been posted on the North American site.

The group plans to release an international glossary of ATM terms next month - largely to streamline best practice manuals with consistent usage of terminology.

The best practices and standards team will produce drafts on ATM transactional security, PIN security and encryption key security, all to be published next month.

The physical crime team has produced a best practice manual on ATM physical security, including guidelines for both standalone and through-the-wall machines. It is on the North American site.

The crime information system team has drafted requirements for a global ATM crime database and a database format template, both of which should be approved this month. A trial global fraud alert system will be launched next month.

The global security testing standards team, including Visa, MasterCard, Interac, Banksys, NCR, Triton, the UK's Link network, ATMIA and EFT Data, hopes to reach consensus on standards for testing PEDs (PIN entry devices) and to create a common set of international requirements.

Lana Harmelink, ATMIA's international operations director, said that ATMIA hopes that regional and national EFT networks and other industry bodies will consider adopting at least some of the guidelines. "The manuals can't be all things to all people everywhere, but they can be a repository of sound advice for the majority," she said.

ATMIA is creating an ATM Best Practice Online Resource Center for ATMIA and GASA members, which will offer access to all of the GASA manuals via passwords. All of the manuals will be reviewed annually. The online center will also include the international glossary, the talking points, fraud alerts, network regulations and links to state banking commissions and proposed legislation.

"We're including all of the information we can think of to help empower the ATM industry," Harmelink said.

The legislative committee was formed last month, to give ATMIA members an opportunity to contribute to the dialogue surrounding legislation that has been proposed in several states to regulate the ATM industry, and to keep ATMIA members informed about regulatory efforts.

During the show's keynote, a panel discussion, members received updates on proposed legislation in several states, including California and New Jersey. In both states, lawmakers have drafted bills that would require the licensing of independent ATM operators.

Kurt Helwig, director of the Electronic Funds Transfer Association (EFTA), seemed to sum up the feelings of most in attendance when he called the proposals "unnecessary and counterproductive, albeit well intentioned." Helwig recently spoke to Rep. Michael Oxley (R-Ohio) about the possibility of national legislation. Oxley had "little interest in seeing any legislation on a federal level," Helwig said.

The committee for sponsoring financial institutions was formed in August. It has produced a list of FAQ relating to sponsorship, which will be posted in the ATM Best Practice Online Resource Center as well as the GASA Web site.

During its first meeting, sub-committees were formed to address four hot-button issues: risks associated with non-compliance with the Patriot Act; with not having insurance available to mitigate possible fraud-related losses; with inadequate PIN security; and with the use of third-party sales agents. All of the sub-committees met at "ATMs in the Americas."

He's baaack. Sam Jonas, founder of Cash Resources, was working the floor talking to folks about his new venture, which involves prepaid products.

An ISO committee was formed in January. Chaired by Bruce Kreeger, president of New Jersey-based ATM Center, the group will make policy recommendations to ATMIA's Executive Board and provide advisory assistance for all four subcommittees of the sponsoring financial institutions group.

Kreeger said he wants the committee to become an active lobbying force. "We need to let these legislators know that our business practices are already governed by Regulation E and network rules."

The committee is considering asking ISO members of ATMIA to make annual contributions to a lobbying/legal support fund, he said.

Kreeger also urged ISOs to write letters to their state legislators to help educate them about the industry and safeguards already in place. For instance, he said, few legislators likely know that ISOs are sponsored into EFT networks by financial institutions -- which agree to assume liability for any acquirer-related losses.

Rick Westenberger, president of Florida-based Amer-e-com Digital Corporation later suggested that it would be a good idea for the committee to make form letters available to its members, a strategy used by many advocacy groups. Both Kreeger and Westenberger emphasized the importance of sending hand-written letters rather than e-mails to politicians

The serious tone of the keynote marked a departure for ATMIA, which is known for kicking off its events with motivational speakers. Yet most in the audience seemed energized by ATMIA's activism.

Other interesting things seen and heard in Tampa:

Stability sells: A representative in the Elan Financial Services booth said the US Bank subsidiary, which offers transaction processing, vault cash, cash replenishment, insurance and first- and second-line service, is beginning to aggressively woo independent deployers. The reason: consolidation is resulting in more stable, better capitalized ISOs.

Bill-ding an ATM app: Pay-Ease, a company that has placed more than a dozen bill payment ATM/kiosks in the Chicago area, is seeking distributors. Wally Hanna, the company's vice president of participant services, said no card or PIN is needed if a customer wants to pay with cash or a check; the machine reads a barcode on the bill and/or a checking account number. ATM/debit card or credit cards are also accepted. Pay-Ease already works with Tidel, and Hanna could be seen handing out his cards in other manufacturers' booths.

Walking the walk: J. Michael Brown, president of Innovus, said more financial institutions are rethinking their off-premise strategies and divesting ATMs not in their service areas. This creates opportunities for ISOs to take over management of those locations. Brown should know; Innovus is now working with a prominent Northeast bank.

Financial institutions aren't the only ones divesting, Brown said. "ISOs can't afford to cut deals where they are going to lose money. Don't be afraid to walk away."

Keeping the self in self service: Non-traditional ATM transactions, such as phone top-ups, must be intuitive, Brown said. "Do you really believe that manager or store owner is going to stand there and walk people through transactions? It's hard enough getting them to keep cash and receipt paper in the machines." Services must also be appropriately aligned with locations. "You don't want to offer enhanced services where you're going to cannibalize your cash business in high-volume locations," he said.

Aunt in the attic: Darlene Kargel, a CPA with accounting firm DeLap White Caldwell and Croy LLPand a veteran auditor for EFT networks, said it's time for all sectors of the industry to get serious about compliance with network operating rules. "Let's face it, we've got a lot of dysfunctional family members," Kargel said during her presentation. "It's time to stop being benevolent."

Working without wires: Dan Sparks, LaGard's Midwest regional sales manager, said ATM servicers and armored carriers no longer will need to call in for access codes with the company's new wireless Navigator lock. Instead, they'll connect PDAs or laptops to the lock via a USB port. The necessary information, including access codes, will be downloaded to the lock from a central server. The lock will automatically close its connection to the server when the lock bolt is closed. Audit information will also be stored on the central server rather than the lock itself, so the process is more secure. The Navigator will debut in June.

At the Alliance Services booth, ATM service was the selling point.

Power play: Electronic Systems Protection's power filters offer more effective surge protection than standard APC protectors, said Stephen Cole, the company's vice president of sales and marketing, who demonstrated the difference on an ATM. ESP sells some 250,000 filters a year to companies like Xerox for copiers and printers. Much like owners of office equipment, ATM owners want to avoid expensive service calls, Cole said. Filters also protect ATMs from adverse effects due to noise, something surge protectors don't do.

Getting the exclusive: Peter Zoumboulakis, vice president of eFunds' ATM division in Canada, said more than half of the company's ATM sales result from leads generated by exclusive endorsement arrangements. After identifying a potential ATM market such as restaurants, eFunds collects endorsements from industry suppliers. "You have the trust of the customer. You also get invited to trade shows where you're the only ATM company there," Zoumboulakis said.

Thinking small: WRGwill roll out a tabletop ATM in the second quarter. The still unnamed model -- called "the mini" for now -- is so narrow that bills are dispensed vertically rather than horizontally. The rear-load machine holds 1,000 notes, comes with an optional pedestal or through-the-wall kit - and will sell for about half the cost of a comparable machine from a larger manufacturer, said Jason Kuhn, WRG's general manager.

Seeing the light: It looked like Christmas at the Graphics Systems booth, which was filled with brightly colored signs that appeared to be neon but were LED. According to Diana Williamson, the national hospitality account executive, LED is similar in price to neon yet lasts longer, won't break or blow up and remains cool to the touch. "You can forget sending anyone out to repair it," she said.

Free sells: The concept of surcharge-free ATMs continues to gain momentum. Leslie Evans of the Credit Union 24 network said that 270 of its 400 members participate in its CU Here surcharge-free program. And not just credit unions are interested. Bonnie Dalrymple, VP of sales for Genpass, said its MoneyPass Surcharge-Free network has more than 5,000 ATMs, just three months after its inception. Lured by increased transactions and higher interchange, ISOs are beginning to show more interest, she said -- particularly when Genpass markets the service to holders of its PayCard payroll card.

The new TDES: Looks like EPP -- as in Encrypting PIN pad -- may be the new Triple DES. During an ATM technology panel discussion, moderator Bill Jackson, Triton's chief technical officer, and Hansup Kwon, president of Tranax Technologies -- speaking from the audience -- said that modifying PIN pads on older ATM models to ensure they meet the criteria for TRSMs (Tamper Resistant Security Modules) will pose a particular challenge. Some of the older models will require more extensive design work that simply swapping out a PIN pad. "We could replace the whole front panel, but that wouldn't be cost effective," Jackson said.

Beginning in July of 2004, all new PIN pads must be tested at a Visa-approved third-party testing facility. Visa introduced its testing requirements in November. Stoddard Lambertson, manager of Visa USA's PIN security program, said Visa expects to post three devices that have met the requirements later this month.

Visa has had similar requirements for point-of-sale PIN pads for nearly two years. Visa has set a "drop dead" date of July of 2010 for all POS devices to undergo testing. Such a date has not been established for ATMs. They are more costly and thus have a longer life than POS terminals, which likely means a longer timeframe will be required.

At the Electronic Systems Protection booth, attendees saw surge protection in action.

Jackson contended that the new requirements have delayed efforts at Triple DES compliance. Because deployers want to minimize service calls to their machines for upgrades, they are waiting until they are certain PIN pads designed for Triple DES compliance will also meet the EPP requirements.

"As a manufacturer, we wish you'd gotten together sooner on your dates and harmonized them," he said to Lambertson and panel member Bill Poletti, MasterCard International's senior technical consultant for information security.

Scrip lowdown: Tim Boccia, Visa USA's director of ATM products, after emphasizing that scrip transactions are not allowed in any of the Visa networks, said that when scrip is processed as an ATM rather than a point-of-sale transaction, it hurts issuers, cardholders and acquirers that are following the rules.

With an ATM transaction, interchange flows from the issuer to the acquirer; with a POS transaction, the direction is reversed. ATM interchange is meant to compensate acquirers for the higher costs of service and cash replenishment associated with an ATM, Boccia said. "If scrip is processed as an ATM interaction, the issuer has lost interchange and paid out when they shouldn't have."

Visa encourages deployers to report out-of-compliance scrip machines because it is otherwise difficult for Visa to identify them, Boccia said. One dead giveaway: a Plus logo on a scrip terminal.

Mexican ATM fees: Jorge Fernandez, president and chief executive of Capture Systems International, said that Mexico will begin allowing ATM surcharges in July. A national rate, that he predicts will be $1.50 to $2, will be established. Fernandez believes this may help open the Mexican market up for non-bank ATM deployers.

House party: Mischa Weisz, chief executive of TNS Smart Network and the newly-created Smart Processing Solutions, said he believes that as they get bigger, more ISOs will want to bring their transaction processing in-house. TNS recently sold its Smart Processing Suite software to California-based Automated Systems America, Inc. (ASAI),which is establishing a new processing division called Data Stream.

Banking on volume: Weisz said Canadian ISO clients of TNS have experienced increases in their ATM transaction volumes since Canadian banks began surcharging two years ago. In Canada, unlike the U.S., cardholders typically pay a fee for all PIN-based debit transactions.

Included In This Story

---

ATM Industry Association (ATMIA)

The ATM Industry Association, founded in 1997, is a global non-profit trade association with over 10,500 members in 65 countries. The membership base covers the full range of this worldwide industry comprising over 2.2 million installed ATMs.

Request Info

Learn More