By Uwe Krause
ATMMarketplace.com
Criminals are constantly "upgrading" - enhancing their strategies and weapons for attacks on ATMs, among other channels. Companies wanting to thwart criminal attacks need to upgrade, too, with ingenious mechanical and electronic means of defense.
Security is booming. The segment is chalking up double-digit growth rates, mainly in the banking sector. However, this isn't surprising when we consider that no other industry is exposed to such refined and brutal attacks by criminals, and that no other depends so greatly for its success on the trust of its customers and the security of their assets.
In addition, those in charge at financial institutions (FIs) face considerable personal consequences if they neglect bank security.
Today's branches tend to have only insignificant amounts of cash easily accessible in conventional teller cash drawers. For this reason, more and more attacks are directed at electronic and mechanical equipment at banks and savings banks.
The culprits are brutal, mobile and use increasingly refined tactics. At risk are primarily automated teller machines, information technology systems, transport routes and data networks. Also critical is the dramatic rise in theft of cards and PIN data, which can be used for withdrawing money abroad.
The situation will not ease in the near future: More and more machines are being installed, and increasingly at off-premise and highly frequented locations. Moreover, storage volumes keep growing. State-of-the-art systems can hold 12,000 banknotes, and even that amount is on the rise.
Luckily, preventive measures are having an impact. But it is a race in which the criminal community has a head start, at least for now. The trend toward manipulating ATMs, mainly by skimming PIN and card data, remains unbroken, despite refined protective measures. For a long time, Germany was a target for most fraudsters. Credit cards normally used abroad for self-service transactions traditionally promised far greater gain for criminals. Losses from such attacks in Germany are only around one-tenth of the 95 million euros ($137.2 million U.S. dollars) lost every year in the United Kingdom to card fraud.
But Europe's push to EMV appears to be motivating criminals to train their sights more strongly on the Federal Republic of Germany. Industry estimates now suggest that ATMs play a role in about 15% of all cases of identity theft. Up to now, banks have shouldered the losses. Now the losses are too great for the banks to continue to bear the financial load.
A customer's PIN can be stolen using a commercially available mini-camera hidden in a fire alarm, light box or brochure rack. The card data can be read using a skimming device, with the captured data and PIN mailed or sent by mobile phone to another country, where the information is used to plunder a cardholder's account.
Such crime sprees can easily cause losses in the high six-digit range. Several offerings can protect cardholders at the ATM, however.
Some institutions prefer mechanical defenses. Common anti-skimming card throats prevent skimming devices from being attached to ATMs. These new throats are designed so that they cannot be broken or cut out of the machine.
Those types of throats are popular in Germany. In other countries, financial institutions tend to rely more heavily on intelligent sensors located inside the card slot that do not alter the appearance of the ATM. These sensors monitor signs of manipulation and sound the alarm if anything has been altered.
New criminal tricks have also helped bring about a revival in the cash-out camera, which complements surveillance with portrait and room cameras.
The tiny cash-out camera, positioned at the height of the output slot, has two functions. First, it records attempts by customers to defraud the bank by removing only part of a bundle of notes (causing the rest to be deposited in the reject tray). Second, it is an effective antidote to cash trapping, also known as reversal fraud.
With cash trapping, the output slot is obstructed so that customers making cash withdrawals cannot take their money. The trapped cash is then removed later by the criminal. Now with integrated image-recognition software, FIs are alerted as soon as an obstruction mechanism has been mounted on the ATM. The ATM is then shut down by the FI or operator.
But what about other types of scams, such as those that involve a group of fraudsters who work to distract an ATM user?
The remedy to that type of fraud is a security area around the ATM, one that is constantly monitored by a camera. If someone enters the zone, a warning appears on the ATM's screen. The customer can then assess the situation and decide whether to break off the transaction or complete it.
What about fraud that moves beyond the physical? Standard operating systems are gaining a growing foothold in network operations, meaning that ATM networks have become gateways that are easy to open, thus allowing criminals access to sensitive customer data. The result is a huge increase in the risk of unauthorized access.
Wincor Nixdorf, for instance, has developed virtual private networks that securely protect branches and host systems against data interception and internal misuse. Because it works on the principle that anything that is not explicitly permitted is forbidden, an attack, no matter how ingenious, cannot unfold.
A further step toward enhancing the security of transactions is the Secure Cash Out Procedure, which prevents cash from being withdrawn if there is an internal attack or if a trojan is infiltrated from the outside.
Cash is dispensed only if data has been exchanged between the bank's host system and the cash-out application and the transaction has been approved.
FIs' and off-premise operators' ATMs in Germany and other countries are introducing ink staining (also called maculation) at the ATM.
For a long time, this approach met with a lukewarm response; but an upswing in ATM violence has brought about a change of heart and provided the impetus for refinements in maculation technology.
The staining process can be triggered not only in response to blast waves or a change in location, but also if and when criminals weld open the rear panel of the ATM. Admittedly, the greatest protective effect offered by maculation is deterrence.
Stolen cash amounts are declining, and the number of attacks on branches and ATMs is stagnating in some areas. But theft activities are simply shifting to another stage.
Cash-in-transit operators are targets more often than they were in the past. To combat that type of crime, locating systems based on mobile communications complements security mechanisms in cassettes, attaché cases and cash boxes.
Using GSM mobile phone technology, which has been introduced in more than 130 countries, a security center can precisely track criminals.
If the microphone is activated remotely, security forces can even hear what the thieves are saying. RFID chips: Total control
Contactless radio frequency identification (RFID) tags are expected to offer a new dimension of security.
According to the latest RFID Report by consulting firm Eurospace, RFID technology will be used in marketing and distribution, as well as in tracking transports and vehicles.
The capabilities that RFID chips offer for logistics are being examined for the banking industry, since FIs and insurers want to pinpoint the location of the cash being transported.
Errors in replenishment processes and the transportation of cash cassettes can practically be eliminated.
Wincor Nixdorf estimates that up to 2% of replenishment operations for cash cassettes are carried out incorrectly: The cash volume in the cassettes is recorded incorrectly, the cassettes are mixed up or the cash simply disappears en route.
Financial institutions should take proactive measures to protect their overall networks.
To that end, they need to understand risk factors and revealing fraud patterns. For example, a certain number of aborted transactions may indicate that preparations for manipulation are under way.
Thieves, driven by their high level of criminal energy, are always a step ahead, however quickly the forces of law try to keep up with them.
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
Prev Next
