news

PAI aids law enforcement in fight against ATM fraud

Feb. 15, 2019

Payment Alliance International, the nation's largest privately held ATM provider, is collaborating with the United States Secret Service and local law enforcement agencies to thwart man-in-the-middle attacks at ATMs.

In man-in-the-middle attacks, criminals place a device between an ATM and its wireless communication box, altering settings that control the amount of cash dispensed by the machine.

It is unknown how many such attacks have occurred nationwide or how much vault cash has been stolen, but tens of thousands of dollars have almost certainly been lost, PAI said in a press release.

However, PAI is using proprietary real-time reporting software to alert officials to potential man-in-the-middle attacks as they occur, allowing authorities to apprehend criminals on the spot.

In one such incident, PAI identified a central Florida attack in progress, leading to the capture of suspects fleeing with an undisclosed amount of cash and the device used in the crime. The three individuals arrested are suspected of a series of similar attacks at ATMs across Florida.

"Nobody in the ATM industry has the capabilities we have developed to stop ATM fraud like man-in-the-middle attacks and I couldn't be prouder of our team," PAI CEO Neil Clark said in the release. "Our customers can sleep well at night knowing we have sophisticated tools to help identify, track and stop fraud."

Customers with PAI wireless communications can remotely update settings with the company's proprietary eRMS program to prevent this type of fraud.

Operators of ATMs using other wireless devices for transaction communication can take these steps to mitigate man-in-the-middle attack risk:

Program ATMs with TLS 1.2 and enable certificates to ensure the proper encryption standards are being used to communicate directly with processors.
Ensure that software is up-to-date and all security features are enabled.
Inspect ATMs for tampering and confirm that wireless units are secure with no foreign devices present.