“Please enter your four-digit PIN”

The arrival of the first ATM machine in the US nearly 40 years ago heralded a new era in banking. Customers no longer had to queue up in their bank to withdraw cash within office hours – they could instead get access to their hard-earned 24 hours a day, seven days week. Although the first US machine installed by Chemical Bank in New York had pretty limited functions, advances in technology now allow customers to deposit cash, top up credit on mobile phones, make bank transfers and withdraw money from ATMs all over the world.

However, organized criminals and petty thieves have wasted no time in targeting cash machines. Gangs are forever adopting more cunning methods in their quest to relieve customers of their cards and PIN numbers. In the US organized crooks steal $200 million through cash machine fraud per year. For customers the hassle of claiming the money back from the bank is almost as much an ordeal as discovering the theft itself.

Though the US is proving resistant to the technology, Chip and Pin has been rolled out across Western Europe in a bid to deter criminals from paying for goods with stolen cards. While the technology has helped fight point-of-sale fraud, card skimming/PIN identification is still proving a major headache for “Card not Present” fraud and cash withdrawal in countries which are not Chip & PIN compliant. The police point out that many of the gangs apprehended for cash machine fraud and card cloning are also involved in other crime, including human trafficking and prostitution.

“The ATM, as a source of cash, has always been a criminal target, and both the banks and the ATM Industry are continuously reviewing, and introducing security measures,” acknowledges Graham McKay, Executive Director of the Global ATM Security Alliance (GASA) . “It is critical for customers to understand that the bank card should be protected with the same degree of importance as a front door key – never give the details away. GASA has introduced a range of ‘best practice security manuals’ using global expertise, which are regularly reviewed and updated as the criminal threat changes.”

Cash on demand

Today, the US boasts around 400,000 cash machines – more than the UK, France and Germany combined.. Many of these machines are now situated at non-branch sites, including supermarkets, railways stations and shopping malls. It is estimated that as much as 85 percent of the cash in circulation has been drawn from ATM’s.. That’s an awful lot of people queuing up to withdraw money – an ideal opportunity for a thief to be ‘shoulder surfing’ to spy on PIN numbers being tapped into the keypad. McKay suggests that a dual responsibility exists. “Banks have an obligation to inform customers of good security practice, and ensure that customer data remains secure throughout the transaction process,” he says. “Customers have an obligation to ensure that the storage and use of the card is such that no other person can obtain the card, and that during use any attempt to obtain the PIN is thwarted by covering the PIN pad during use.”

In the US customers are normally able to withdraw between $200 and $500 per day. Many ATM crimes have taken place just before midnight so that the criminals are able to make two maximum withdrawals before the victim has time to cancel the card with the bank. In moves to reassure customers and cut down on the money lost to fraud the banks are fighting back. One in four machines are now fitted with anti-skimming equipment. The system works by scrambling each card’s magnetic strip as the skimming device tries to read the data. The banks are also rolling out more CCTV cameras, tamper-proof machines and installing better lighting around poorly lit cash machines. At some ATMs privacy areas have been painted on the ground to stop crooks from spying over the shoulder of the person using the machine.

The banks recommend that customers stay alert to suspicious activity, use an ATM inside a branch where possible and avoid being distracted by people in the queue. With the incidents of card skimming scams and robberies gaining increased coverage you would be forgiven for thinking that customers are shying away from ATMs. McKay says this is not the case. “ATM transaction volumes do not indicate any reduction in customer use, or lack of customer confidence.”

Convenience

Despite the fear of fraud ‘ATMs are a convenient and swift option for getting hold of cash when out shopping or enjoying a night out. “During the introduction of the Euro in Europe, the ATM was the main source of note distribution – more than 90 percent of all notes in the first month,” McKay remarks. “As a source of cash it will remain a target for criminals, however the impact of Chip and PIN technology has shown a significant decrease in ATM fraud. This does not mean that criminals have gone away, but that a displacement factor is occurring on two levels – local crime and international crime.” McKay continues: “Local crime will tend to move to the weakest link, which now appears to be at point-of-sale and card not present transactions, whereas international crime moves to the country of lowest security. Currently the US is lagging in terms of Chip and PIN and we have noted an increase in ATM Fraud. The biggest threat therefore facing the ATM industry is the displacement crime that moves rapidly to the weakest link, and the internet knowledge transfer of successful crime techniques.”

GASA has been established by the ATM Industry Association (ATMIA) and now provides a worldwide database of crime prevention information. The database, known as COGNITO, arms member banks with information of global crime techniques, fraud alerts, any new modus operandi, and best practice recommendations. Additionally, there are a series of international conferences on each of the major continents, bringing expertise and experience together for knowledge transfer and technology updates.

All eyes this way

The ultimate goal for the banks is to have biometric identification (fingerprint or iris recognition) instead of PIN numbers at every ATM, although the cost of the technology is the major stumbling block. “Various forms of biometrics are already available for use at ATM’s and in some regions biometrics have already been introduced,” says McKay. “The rate of introduction of biometrics is a combination of the following factors – cost versus levels of loss, including customer loss. There is also the psychological impact of introducing different biometrics – finger appears to be the most widely accepted, but iris scan is the most accurate in the western world.”

Biometrics on ATMs would appear to be the best line of defense when it comes to fraud. But with every new technology you can guarantee that criminals will be looking to exploit loopholes in the system. The fact is our love affair with ATMs does not look like waning anytime soon. The number of ATMs has more than doubled in the last decade and there are now more than 10 billion transactions per year. ATMs are close to supplanting branches as Americans’ favorite places to bank.. With that sort of usage the banks will have to stay one step ahead of the criminals – not an easy battle but one that customers will want to see the banks win in resounding fashion.

Source: American Banking Association