Keeping consumer trust in the ATM

Twenty-four-hour convenience and trust underpin the key role of the ATM in retail banking strategy. The essential task of protecting the integrity of the channel against the threat of fraud depends on best practice implementation of innovative technology.

For the criminal, there are three options: copy the card, steal the card or go direct for the cash. Of course, to be effective in terms of accessing cash via the ATM the first two options must also involve theft of the PIN.

Publicity has been given to the introduction of the chip card and the impact this will have in offsetting counterfeit fraud and card skimming. The fact is, however, that this has not yet been universally adopted and there remain other, in some instances less sophisticated, frauds that are equally prevalent.

Fraud migration is a fact of life, both in terms of modus operandi and geography. As chip technology is introduced, so counterfeit fraud may migrate to those countries that are slow in moving and within countries that have made the switch it is likely that rather than simply going away, criminals will seek other means to access the cash prize.

At NCR we have long recognised there is no single solution that will eliminate fraud. This fact is at the core of the company’s holistic approach to security. New innovative technologies are giving ATM deployers the edge in combating fraud. As well as supporting the migration to chip, in line with EMV standards, the focus has been on using complementary countermeasures to thwart criminal activity at the ATM.

Protecting card data

The term ‘card skimming’ applies to attempts by criminals to read and capture data that is stored on the magnetic stripe of a payment card. This crime is most prevalent in retail environments. Attempts to do so at an ATM involve criminals attaching card skimming devices to the fascia of an ATM.

Until the chip card is implemented globally and support for magnetic stripe disappears there remains a need to protect against attempts to copy information off the magnetic stripe, and a number of new security features have been introduced to prevent frauds of this type.

NCR’s unique, patented Enhanced Card Drive (Jitter) has been designed to make criminals ineffective at capturing magnetic stripe details at the ATM. By the introduction of a stop-start (jitter) motion the solution prevents an illegally installed device from being able to read the card information stored on the magnetic stripe.

Other countermeasures include the fitting of a protruding device (Enhanced Card Reader Surround), with illumination from behind that makes it difficult for criminals to attach their devices. This is also effective in conjunction with consumer awareness messaging, showing consumers what the card reader should look like.

Protecting the card

Another criminal activity is card trapping – where the criminal steals the actual card at the ATM – whether it be a magnetic stripe card or a smart card. The criminal does this by attaching a device to the card reader slot that allows the card to be inserted in the normal way but stops the card from being returned to the cardholder. Sometimes this activity is compounded by the criminal, in the guise of offering assistance, advising the cardholder to re-enter the PIN (which is observed). When the cardholder gives up and walks away the criminal will release the device with the card.

NCR has several security enhancements that can counter attempts to add trapping devices to the ATM, such as Enhanced Shutter Security (ESS). Using this solution, the card reader can detect if there is something inserted that keeps the card reader shutter open when it should be closed. A metal surround on the card reader and a stronger shutter mechanism make it much more difficult for criminals to tamper with it.

Protecting the PIN

Whether a card has been skimmed or stolen, without the PIN, a criminal cannot access cash at the ATM or, as some countries now move to a chip and PIN environment, purchase goods at a point of sale.

In many instances, attempts to steal the PIN are not high tech, and the industry has endorsed best practice guidelines from bodies such as the Association for Payment Clearing Services in the UK, who advise individuals to stand close to the machine and to shield the keypad to prevent anyone seeing the number being entered.

To protect against more sophisticated attempts to compromise PIN information, NCR has provided enhanced security via its Encrypting PIN Pad (EPP) solution. This supports Triple Data Encryption Standard and provides increased security to protect the PIN as it is sent to the bank host for authentication. It further supports the remote loading of a unique master encryption key for each ATM at installation or reset.

Protecting the channel – in real time

Real-time compromise prevention, detection and response – before the point of the actual fraud – is acknowledged as a goal of the industry. As well as enabling the effective management of an ATM network and maximising availability, ATM management tools, such as Gasper Vantage, can be used to manage risk and minimise the impact of fraud through real-time detection and response. NCR helps its customers understand how, using intelligent rules, Gasper Vantage is able to issue alerts to trigger appropriate action. In the case of card trapping, for example, repeated ‘card reader error’ reports are a good indicator of compromise and, where devices such as a false screen or PIN pad have been attached to an ATM machine to copy transaction information, the best indicator of compromise is a lack of transactions vis-à-vis the norm.

Using consistent rule-based logic, the ATM management system will activate a response when it detects the compromise indicators. Response options available to the deployer may include using automation to take the ATM out of service for a defined period, alerting the ATM help desk, notifying the services team or informing the authorities.

Protecting the cash

Brute force attacks on ATMs are an industry issue. Not only does physical attack become the path of least resistance if all other countermeasures are in place but it is also one of the most accessible forms of crime. As well as the traditional approach of heavy-duty safes and monitoring equipment, industry acceptance of new technology is now enabling a less expensive but potentially more effective approach to physical security.

Note-staining technology protects money by deterring criminals, thus reducing physical security costs and resulting in a rapid return on investment. It can be used to protect cash during delivery to the ATM, both in the vehicle and across the pavement, as well as during replenishment and in operation at the ATM. At each stage, any physical attack will result in the cash inside the unit being spoiled by indelible ink. Upon activation of the system CO2 gas is released from a capsule and within seconds the ink is pressurised via spray bars fitted in the lid of the cash cassettes. All bank notes are stained and the cash is therefore rendered worthless to criminals.

Adopting this solution sends a clear message to thieves: Don’t bother – there will be nothing worth stealing. Indeed, as well as rendering the cash worthless, the use of note staining means an increased chance of criminals being apprehended. The ink is wet and stains fingers and clothes as well as bank notes.

NCR’s Fluiditi subsidiary has successfully deployed its note-staining solution in a number of European countries and has a proven track record in reducing ATM attacks. Using this technology also enables ATMs to be placed in more locations more profitably by negating the logistical issues associated with secure rooms and the associated construction costs.

Safeguarding the future

ATM fraud remains a multi-faceted crime that requires a holistic, strategic response. Whatever the target, be it information on the card, the card itself, the customer’s PIN or indeed the physical cash, NCR is actively involved in maintaining channel integrity. This means working closely with the industry to understand the issues and threats, developing innovative but proven technologies and collaborating with customers and industry associations to inform, not alarm, the consumer. It is the success of this on-going activity that will secure the future of the self-service channel through protecting consumer trust in the ATM.

Jeff Lutz is vice-president, Global Sales & Marketing, Financial Solutions Division at NCR