|
ATM Fraud: Does It Warrant the Expense to Fight it?
BY LAURI GIESEN
In the aggregate, ATM losses are a fraction of other types of fraud, and vulnerability varies between ATM location and machine. Bankers balance the cost of protection against customer and reputational loss.
|
SYNOPSIS | Skimming, which involves criminals placing false fronts or card readers over ATMs to capture confidential card data and defraud customers, is a problem. New technology has been developed to help banks reduce this crime. But banks must decide whether to invest significant dollars to reduce a crime that is small compared to other types of payment fraud.
Bankers seeking to protect ATM-using customers face a real dilemma. They can spend hundreds or even thousands of dollars per machine on add-on hardware and software to prevent crimes that have a very small chance of occurring. Or, they can take their chances and do nothing, running the risk of customer and reputation loss in the event that their machines are among those hit by fraudsters.
ATM fraud today is relatively rare in the U.S. A study by Boston-based Celent LLC estimates annual ATM fraud direct losses at between $55 million and $60 million. This compares to the industry?s loss of $624 million in identity theft, $708 million in check fraud and $966 million in credit card fraud.
But, when ATM fraud does occur, ?even if it only happens one time, if the event is well publicized, it can have serious consequences,? says Rob Evans. Evans is director of industry marketing for the financial solutions group at NCR Corp., based in Dayton, Ohio.
For example, in May 2006, local newspapers in New Castle County, Del., reported that criminals were able to steal more than $75,000 from consumer accounts by ?skimming? data from machines owned by Wilmington, Del.-based Wilmington Trust Corp. and Pittsburgh-based PNC Financial Services Group. The events were well covered.
Technology has proven effective in helping banks prevent or mitigate such skimming attacks ? as well as other types of ATM fraud. But, experts say, the central issue is whether the expense of purchasing this technology makes sense from a return on investment perspective. In her recent study of ATM fraud, Celent senior analyst Ariana-Michele Moore concluded that ?ATM managers are unlikely to see a return on their investments in anti-fraud measures based purely on lost dollars.?
However, because many customers? primary interaction with a bank is through its ATMs, ?it is imperative for banks to ensure that the customer?s experience with the ATM is safe and secure, as well as pleasant,? Moore said in her report.
Victims of ATM fraud are reimbursed for any losses by the bank that issued the card, as long as they report the fraud and did nothing to cause it. Even so, having someone go into a bank account and steal funds can be frightening to consumers.
Comprehensive Risk Assessment
The type of skimming that occurred in Delaware is not a new concern to ATM owners, but fraudsters have become more proficient at committing this crime, experts say. With skimming, criminals put false fronts or fake card readers over ATMs. These fake card readers capture the information retained in the cards as they are inserted into the ATM. The criminals later remove the device and record the information captured.
To complete the fraud, the fraudsters need a camera working in conjunction with the false front. They can either mount one nearby with a zoom lens or affix a lens onto the ATM. The camera records each customer inputting a personal identification number (PIN). Once the criminals collect the information captured from the card and they know the PIN, they can create new ATM cards and then use these cards to drain bank accounts via ATMs throughout the world.
Security experts point to several devices and software packages available today that can substantially reduce a bank’s odds that its machines will be hit by skimmers (see “Fighting ATM Fraud: The Technological Response”). These security devices either prevent the overlays from working or they detect when a machine has been tampered with and set off an alarm to the machine’s owner.
Why not just install these devices and avert a crime? Experts say that the ROI calculation is not clear-cut. “Banks don’t need to put every security feature on the market onto every single machine,” says Anna Istnick, senior product marketing manager for Canton, Ohio-based Diebold Inc. “Rather, they have to know what the real risk is for each machine they own and invest accordingly. In order to do that, a bank really needs to make a comprehensive assessment of its entire network.”
Istnick suggests that in assessing risk, banks look at how much volume each machine has, where each machine is located, who has access, how isolated the machine is from the bank or retailer who can monitor it and what hours the machine is commonly used. “A machine that will be within eyesight of your branch personnel and not accessible for 24 hours won’t need all the same features as a machine that is isolated and accessible to the public at night,” says Kirk Ergang, senior vice president of the Star ATM network, owned by First Data Corp.
Istnick notes that high-volume ATMs in metropolitan regions are more vulnerable to fraud than those in less urban settings. Banks should keep in touch with other financial institutions and respond by deploying anti-fraud systems and closely monitoring transactions when there is a rash of ATM-related crime in a particular region, she says.
Consumer Education
Some of the best fraud detection banks can implement is simply to train bank personnel on what to look for in ATM tampering and to instruct them to perform routine inspections, experts say. Similarly, banks that deploy ATMs in retail locations should also train store employees on how to spot an ATM that has been tampered with.
“One of my customers told me that his bank was told to do a physical inspection of each machine once a day. It only takes about 30 seconds per machine to see if something is wrong,” says Bill Jackson, vice president of engineering for Triton Systems, Long Beach, Miss.
Customers also need to be trained, as well. “Customers need to be told, ‘If something looks different about the machine, don’t use it and call somebody to report your suspicions,’” says Diebold’s Istnick. Diebold, for example, operates a consumer Web site (www.atmconsumersafety.com) that provides information about physical safety at ATMs as well as about types of fraud and what consumers should look for to prevent fraud.
While Tuscaloosa-based Alabama Credit Union has not experienced any ATM fraud in recent years, the institution offers educational programs on what to look for that would indicate an ATM has been tampered with, says CEO Steve Swafferd. The credit union has put educational materials in its statement stuffers and included articles about the crime in its newsletter. Anti-crime materials are also included in all new card mailings, Swafferd says.
Still, experts warn bankers not to overdo the alarms. “You have to walk a fine line between informing customers about security aspects of ATMs that they need to know and scaring them so much that they won’t use ATMs,” says Triton’s Jackson.
|
