Security

ATM Fraud & security – some perspective

That last post which emanated from the Boing Boing piece on ATM fraud cries out for some perspective. Of course everyone gets excited about ATM Fraud, and its terrible when you are personally involved. But then so are airplane crashes. Bad metaphor I know, but stuff happens, and there is stuff you can do as a consumer to prevent it. One of the challenges of the technology banking world, is that everyone assumes technology is perfect, and that any error/ crime/ event is the fault of the technology and the Banks that implemented it. If only that were true.

So with that rant out of the way, on with the ATM fraud story; some fact, case studies, and hopefully some perspective.

  • Banks take ATM fraud very seriously. If its troublesome for the individual consumer, consider how difficult it is for the Bank to communicate with customers, issue new cards, new bank accounts, re-instate stolen funds, and get that customer back on track again. Believe me the costs are such, that the profitability experts will likely say that customer is now mathematically a loss leader possible for ever. So … Banks take ATM fraud very seriously.
  • The number of occasions that fraud occurs is low relative to the number of transactions that take place. Of course its never low enough, but each Bank does several hundred million ATM transactions annually. For all banks in Canada for example, here are the stats from the CBA. They haven’t got 2005 status up yet, but they will be similar, with slight drop. Note that is 750 million cash withdrawals. There are only 32 million people in Canada and of those, some 20 – 25 million old enough, or have bank accounts.
    • Number of transactions at bank-owned ABMs
  • There are guidelines for using your debit card, and Canada has some very good advice on that for consumers, again at the CBA.  I would add a couple of my own:-
    • Think before you skim your card anywhere.  e.g. do not use your debit card to open the ATM vestibule – use your library card, or air miles card.  There could be a skimming device in the door opener.
    • Take a look at the merchant before you skim you card for a $5 item … carry some cash for small transactions

ATM fraud examples:

Some examples.  Note these examples are dated, but remain relevant as to style and MO.

  1. Police arrest Russina – 2002 skimming case
  2. Two women sentenced – 2002
  3. Skimmers hit Bank ATM’s – 2002
  4. Lebanese Loop – wikipedia
  5. “In fact, McGrath also told W-FIVE that the Canadian Bankers Association does not consider debit card fraud to be a major crime despite the fact that about 27,000 Canadians have been victims of this crime to the tune of $44 million in 2003.” – CTV
  6. New York Feb 2006 – At home, he had 105 more cards and nearly $70,000 in cash and goods.”
  7. Dominican republic:  Automated Teller Machines (ATM’s) are present throughout Santo Domingo and other major cities. However, as with credit cards, the use of ATM’s should be minimized as a means of avoiding theft or misuse. One local ATM fraud scheme involves sticking photographic film or pieces of paper in the card feeder of the ATM so that an inserted card becomes jammed. Once the card owner has concluded the card is irretrievable, the thieves extract both the jamming material and the card, which they then use.
  8. Fraud trends – Credit Association of Greater Toronto

Some conclusions:

  • ATM fraud is highly sophisticated involving some very smart technology people
  • ATM fraud is highly targetted – A big bank ATM is likely to be safer than that white label machine in the pub, or corner store.
  • ATM fraud requires two things to happen
    • Skim your card in order to make a copy of it
    • Steal your PIN.
    • MORAL:  Do not EVER let anyone or anything see you key your PIN – protect it at all costs

The future:

Chip cards are coming soon.  They are being developed and in place in many countries.  In Canada, pilots will be running in 2007, and full rollout for 2008 and beyond for debit cards.  All Credit Cards will be chip enabled by 2010.

Chip cards cannot be copied.  So in the “two things have to happen” above, chip eliminates the first problem.  Of course the bad guys will then try to steal cards, but as long as you protect your PIN, your card remains safe.