ATM security: lessons from Europe

Theft involving manipulation of ATMs and customer card data has long since ceased to be a minor problem for banks. Today’s ‘highway robbers’ engage in crime sprees involving col-lateral damage that is anything but slight, often leaving a trail of devastation behind them.

In one case, between May and September 2005, a six-man gang in Germany pocketed €245,000 from banks in the Calw/Stuttgart/Ludwigsburg region, relieving 170 customers of their money. In another case, in just two to three days in June 2006, unknown persons cleaned out €21,000 from 14 accounts at a single bank in Stuttgart. The withdrawals were always initiated from a location outside Germany where security measures are usually mini-mal.

The Europe-wide advancement of copy-proof and unforgeable Europay, MasterCard, Visa (EMV) chips on EuroCheques (EC) and credit cards appears to be motivating criminals to train their sights more strongly on the Federal Republic of Germany, which has to date been largely spared these thefts. The number of attacks has soared since 2004, according to Euro-Kartensysteme, because of the increased usage of chip cards in several countries.

Consequently, there is a growing focus on preventive measures through central monitoring of ATMs and fraud detection by identification of fraud patterns. Camera monitoring also provides criminal prosecutors with impressively clear pictures of the perpetrators.

On a superficial level, the bare figures for Germany are not cause for great concern. German cash systems are protected thanks to the MM feature (a modular machine-capable code sys-tem). As a result, police have only registered approximately 200 manipulations in 2004, and estimates for 2006 assume a figure of 240 attacks. What is on the increase, however, is the theft of card and PIN data from which duplicates are created and used for obtaining money from outside Germany.

The damage from such crimes runs into the middle single-digit millions in Germany every year – and it’s a figure that is growing. In 2004 alone, 2377 cases of ATM manipulation were recorded throughout Europe. In the UK – a virtual El Dorado for skimming card data – the damage amounts to some €140 million a year.

Anti-skimming modules: part of the basic equipment

ATM criminals continuously enhance their technical resources, which suggest that there is no point in hoping for a one-time permanent solution to ATM crime. That’s why technical protective measures at ATMs are gaining ground. Examples include card throats that pre-vent skimming devices from being attached to the card entry slots of ATMs, sensors that check the entire environment of the card entry slot for changes, mechanisms for thwarting the installation of Lebanese loops, and cameras in automated teller machines. New machines from Wincor Nixdorf include these anti-skimming modules and protective card throats as basic, standard equipment features.

Although all of these measures are an effective means of preventing card data from being copied or keeping banknotes from being retained in the dispensing slot through adhesive strips, they are only a partial remedy. The modules only unfold their full effect when they are integrated in a process that is quality-assured and can be documented. This is because the strategies used by criminals are becoming more and more ingenious and their technology more and more refined. Their inventiveness is remarkable. Cameras for skimming PINs are hidden in smoke detectors and brochure stands, in the light strips above the keypad, or in the advertising display space at the top of the ATM.

In order to steal card data, criminals rearrange the entire front panels of the ATM, installing motorized card readers. Wafer-thin magnetic stripe readers are equipped with wireless sen-sors so that the card data they steal can be transmitted right away without the need for a photo. Other thieves use data memories that enable them to acquire data over a period of several days.

Another variant involves PIN pads that store and transmit the keystrokes. The newest trick: the ATM’s paneling conceals a camera mobile phone that records the PIN and transfers it using Bluetooth technology. Or, after a customer enters a PIN, an audio warning is triggered by remote control that instructs the customer to proceed immediately to the bank counter. Once the customer walks away from the ATM, all the thief needs to do is enter the amount and take the money.

Security in self-service: image is everything

This unstoppable criminal energy is currently proving to be an incentive for many banks to address the problem of ATM crime more intensively. Although a joint pool set up by the banks fundamentally shoulders the damage, banks are increasingly being taken to task. Out-side of Germany, for example, ATM operators are liable for losses caused by EMV chip-based cards at cash machines that are not suitable for EMV.

Moreover, the costs of each instance of fraud add up to a considerable sum. In addition to system downtime with the result of reduced revenue for the bank from transaction charges, there are also the costs of changing PINs, reissuing cards, repairing machines and the time needed to prosecute cases.

However, the loss of image for the affected bank is regarded as being far more important, as bank directors repeatedly stress. No bank can afford a situation in which its customers are uncertain about withdrawing cash. None wants to see its name in the local and regional press, which delights in reporting on these kinds of swindles. It is critical to maintain con-sumers’ complete trust in the security and reliability of self-service. After all, 85 percent of all contacts with the bank branch involve cash withdrawals, transfers and account statement queries. Shifting these services back to the counter would result in immense costs.

The key to stopping fraud before it happens

Wincor Nixdorf has therefore developed a comprehensive security solution based on the monitoring software ProView. This solution ensures that banks can take proactive measures thanks to messages from the anti-skimming modules, and thus prevent damage before it happens. When an irregularity at an ATM is detected, a red light on the administrator’s screen at headquarters indicates imminent danger. Depending on the individual configura-tion, ProView then proposes a response to the message initiates the action, and documents the entire process.

In addition, the information that is collected with ProView can be filtered to determine what locations are at acute risk and what combinations of features necessitate an increased state of alert, including special protective measures. To enable this, different criteria, such as loca-tion and time factors and card types (credit cards or EC cards from another bank), can be combined as desired.

The features on Wincor Nixdorf’s ProView solution also make it suitable for revealing fraud patterns and unusual behavior, with the result that a machine can be put out of operation in a controlled fashion. For example, a certain number of aborted transactions may indicate that preparations for manipulation are underway. The administrator can check this directly by specifically activating a portrait or room camera, and can then make a decision on what should be done. Options include photographing the perpetrator and initiating a silent alarm, switching off the machine, sending a member of the branch’s staff to the site, or alerting the police or security service right away. The machine is remotely activated again when the all-clear is given. As a result, the availability of the machines increases.

The administrator can also control the camera to acquire needle-sharp pictures from differ-ent angles over the network. These make it much easier to prosecute perpetrators.

The ProView solution can also be used to clarify disputes between bank customers and the bank – for example, if a customer claims that the machine did not dispense any money. Por-trait photos and pictures of the money being removed from the output slot deliver clear-cut evidence for both parties. In one case, this feature was used to show that a passerby had seized a favorable opportunity to grab a wad of notes (cash) from the dispensing slot while a customer was briefly distracted. Ultimately, the pictures provided unerring proof that the customer removed only a few banknotes and the rest were stolen from the passerby.

For more information, please visit www.wincor-nixdorf.com/usa or contact Julia Waugh at Julia.Waugh@wincor-nixdorf.com or +1 978 649 0689.