FST speaks to Graham McKay, Executive Director of the ATM Industry Association, to find out what the banks are doing to protect customers when using a ‘hole-in-the-wall’.

By Julian Rogers

The arrival of the first ATM machine in the UK nearly 40 years ago heralded a new era in banking. Customers no longer had to queue up in their bank to withdraw cash within office hours – they could instead get access to their hard-earned 24 hours a day, seven days week. Although the first machine installed by Barclays Bank had pretty limited functions, advances in technology now allows customers to deposit cash, top up credit on mobile phones, make bank transfers and withdraw money from ATMs all over the world.

However, organised criminals and petty thieves have wasted no time in targeting cash machines. Gangs are forever adopting more cunning methods in their quest to relieve customers of their cards and PIN numbers. In the UK organised crooks stole UK£65 million through cash machine fraud in 2005. For the customers the hassle of claiming the money back from the bank is almost as much an ordeal as discovering the theft itself.

Across Western Europe Chip and PIN has been rolled out in a bid to deter criminals from paying for goods with stolen cards. While the technology has helped fight point-of-sale fraud, card skimming/PIN identification is still proving a major headache for “Card not Present” fraud, and cash withdrawal in countries which are not Chip & PIN compliant. The police point out that many of the gangs apprehended for cash machine fraud and card cloning are also involved in other crime, including human trafficking and prostitution. “The ATM, as a source of cash, has always been a criminal target, and both the banks and the ATM Industry are continuously reviewing, and introducing security measures,” acknowledges Graham McKay, Executive Director of the ATM Industry Association (ATMIA). “It is critical for customers to understand that the Chip and PIN card should be protected with the same degree of importance as a front door key – never give the details away. The ATMIA has introduced a range of ‘best practice security manuals’ using global expertise, which are regularly reviewed and updated as the criminal threat changes.”

Cash on Demand

Today, the UK boasts around 59,000 cash machines – more than anywhere else in Europe, with Germany second and France in third spot. Over half of the UK machines are now situated at non-branch sites, including supermarkets, railways stations and pubs. According to the Association of Payment Clearing Services (APACS), ATMs supply 63 percent of all cash to individuals. That’s an awful lot of people queuing up to withdraw money – an ideal opportunity for a thief to be ‘shoulder surfing’ to spy on PIN numbers being tapped into the keypad. McKay suggests that a duel responsibility exists. “Banks have an obligation to inform customers of good security practice, and ensure that customer data remains secure throughout the transaction process,” he says. “Customers have an obligation to ensure that the storage and use of the card is such that no other person can obtain the card, and that during use any attempt to obtain the PIN is thwarted by covering the PIN pad during use.”

In the UK customers are normally able to withdraw up to £250 a day. Many ATM crimes have taken place just before midnight so that the criminals are able to take out £500 before the victim has time to cancel the card with the bank. In moves to reassure customers and cut down on the money lost to fraud the banks are fighting back. One in four machines are now fitted with anti-skimming equipment. The system works by scrambling each card’s magnetic strip as the skimming device tries to read the data. The banks are also rolling out more CCTV cameras, tamper-proof machines and installing better lighting around poorly lit cash machines. At some ATMs privacy areas have been painted on the ground to stop crooks from spying over the shoulder of the person using the machine.

The banks recommend that customers stay alert to suspicious activity, use an ATM inside a branch where possible and avoid being distracted by people in the queue. With the incidents of card skimming scams and robberies gaining increased coverage you would be forgiven for thinking that customers are shying away from ATMs. McKay says this is not the case. “ATM transaction volumes do not indicate any reduction in customer use, or lack of customer confidence.”

Convenience

Despite the fear of fraud a ‘hole-in-the-wall’ is a convenient and swift option for getting hold of cash when out shopping or enjoying a night out. “During the introduction of the Euro, the ATM was the main source of note distribution – more than 90 percent of all notes in the first month,” McKay remarks. “As a source of cash it will remain a target for criminals, however the impact of Chip and PIN technology has shown a significant decrease in ATM fraud. This does not mean that criminals have gone away, but that a displacement factor is occurring on two levels – local crime and international crime.” McKay continues: “Local crime will tend to move to the weakest link, which now appears to be at point-of-sale and card not present transactions, whereas international crime moves to the country of lowest security. Currently the US is lagging in terms of Chip and PIN and we have noted an increase in ATM Fraud. The biggest threat therefore facing the ATM industry is the displacement crime that moves rapidly to the weakest link, and the internet knowledge transfer of successful crime techniques.”

To help the banks the ATMIA has established the Global ATM Security Alliance (GASA), which provides a worldwide database of crime prevention information. The database, known as COGNITO, arms member banks with information of global crime techniques, fraud alerts, any new modus operandi, and best practice recommendations. Additionally, there are a series of international conferences on each of the major continents, bringing expertise and experience together for knowledge transfer and technology updates.

All Eyes This Way

The ultimate goal for the banks is to have biometric identification (fingerprint or iris recognition) instead of PIN numbers at every ATM, although the cost of the technology is the major stumbling block. “Various forms of biometrics are already available for use at ATM’s and in some regions biometrics have already been introduced,” says McKay. “The rate of introduction of biometrics is a combination of the following factors – cost versus levels of loss, including customer loss. There is also the psychological impact of introducing different biometrics – finger appears to be the most widely accepted, but iris scan is the most accurate in the western world.”

Biometrics on ATMs would appear to be the best line of defence when it comes to fraud. But with every new technology you can guarantee that criminals will be looking to exploit loopholes in the system. The fact is our love affair with ATMs does not look like waning anytime soon. Indeed, by 2015 APACS expects the machines to provide more than 80 percent of the UK’s cash requirements. Some 40 million people are forecast to be regular ATM users, making around 3.1 billion withdrawals, worth £245 billion. With that sort of usage the banks will have to stay one step ahead of the criminals – not an easy battle but one that customers will want to see the banks win in resounding fashion. 

**************

Fast Facts for UK ATMs

The total of all withdrawals from ATMs reached £172 billion in 2005 – an average of £5,455 per second.

• The average cash withdrawal value from a bank or building society cash machine is £65
• There were 164 million plastic cards in issue by the end of 2005 that could be used at a cash machine
• 96 percent of all cash withdrawn are from ATMs owned by the banks and building societies
• Almost 39 million regularly use cash machines, making 86 withdrawals ever second.

Source: Association of Payment Clearing Services (APACS)

Questions for Financial Services Technology (Europe Edition)

1. Firstly, incidents of fraud and crime at ATM’s hit the headlines an awful lot in the UK. Are the banks and the ATM industry doing enough to prevent crime at ATM’s?
   
   The ATM, as a source of cash, has always been a criminal target, and both the banks and the ATM Industry are continuously reviewing, and introducing security measures.  The ATM Industry association has introduced a range of “Best Practice Security Manuals” using global expertise, which are regularly reviewed and updated as the criminal threat changes
    
2. Do you think the threat of fraud is deterring customers from using ATM’s?
   
   ATM transaction volumes do not indicate any reduction in customer use, or lack of customer confidence.
   
   
3. What steps and precautions can the public take to help mitigate fraud?
   
   It is critical for customers to understand that the Chip & PIN card should be protected with the same degree of importance as a front door key – “never give the details away”. A campaign has been introduced to “PROTECT YOUR PIN” by covering the key pad while inputting the PIN information. This is critical at ATM’s and particularly at Point of Sale devices were customer information can be viewed from adjacent queues.
   
   
4. Presumably, you would like to see stiffer penalties for those convicted of stealing money at ATM’s?
   
   Definitely, the lack of an adequate deterrent is a contributing factor to repeat crime.
   
   
5. Do you think that the banks get criticized too much when it comes to ATM crime and that customers should be doing more to protect their PIN number and card from fraudsters?
   
   There is a dual role of responsibility:
   
   a) Banks have an obligation to inform customers of good security practice, and ensure that customer data remains secure throughout the transaction process
   
   b) Customers have an obligation to ensure that the storage and use of the card  is such that no other person can obtain the card, and that during use any attempt to obtain the PIN is thwarted by covering the PIN pad during use  (see below logo)
    
   
   
   
6. What are some of the biggest security challenges currently faced by the ATM industry, and how are these being tackled?
   
   The ATM is the main source for distributing cash, and the international criminal targets three currencies £, €, and $. During the recent €uro introduction, the ATM was the main source of note distribution (more than 90% of all notes in the first month). As a source of cash it will remain a target for criminals, however the impact of Chip and PIN technology has shown a significant decrease in ATM fraud. This does not mean that criminals have gone away, but that a displacement factor is occurring on two levels – local crime and international crime.
   
   Local crime will tend to move to the weakest link, which now appears to be at point of sale, whereas international crime moves to the country of lowest security. Currently the USA are lagging in terms of Chip & PIN and we have noted an increase in ATM Fraud.
   The biggest threat therefore facing the ATM industry is the displacement crime that moves rapidly to the weakest link, and the internet knowledge transfer of successful crime techniques. The ATM Industry Association has established a “Global ATM Security Alliance”, which provides a global database of crime and crime prevention information.
   
   
7. As ATM usage grows, and the potential for crime also increases, what future developments to tackle security are on the horizon?
   
   As stated above, a Global ATM Security Alliance (GASA) has been established by the ATM Industry Association. Embedded within this is a global database of ATM crime run by a major international fraud organization, and under strict security and password control. This database known as COGNITO, provides member banks with information of global crime techniques, fraud alerts of any new modus operandi, and best practice recommendations. Additionally there are a series of international conferences on each of the major continents bringing expertise and experience together for knowledge transfer and technology updates.
   
   
8. How long do you think it will be before we have biometric identification at ATM’s? Will the high costs associated with this technology prevent it from appearing in the near future?
   
   Various forms of biometrics are already available for use at ATM’s and in some regions biometrics have already been introduced. The rate of introduction of biometrics is a combination of the following factors:
   

• Cost versus levels of loss (including customer loss)
  
• Psychological impact of introducing different biometrics (finger appears to be the most widely accepted, but iris scan appears the most accurate in the Western world)
  
• To reduce costs, biometric technology should be available and acceptable to the global base (hot desert and dust, sub zero and snow, etc.) This will enable price reduction based on mass volume.
  
• Alternative forms of two factor authentication (i.e. part of PIN is in response to a personal numeric question). This type of authentication is already in use with some Internet Accounts.