“Please enter your four-digit pin”

The arrival of the first ATM machine in the UK nearly 40 years ago heralded a new era in banking. Customers no longer had to queue up in their bank to withdraw cash within office hours – they could instead get access to their hard-earned 24 hours a day, seven days week. Although the first machine installed by Barclays Bank had pretty limited functions, advances in technology now allows customers to deposit cash, top up credit on mobile phones, make bank transfers and withdraw money from ATMs all over the world.

However, organised criminals and petty thieves have wasted no time in targeting cash machines. Gangs are forever adopting more cunning methods in their quest to relieve customers of their cards and PIN numbers. In the UK organised crooks stole UK£65 million through cash machine fraud in 2005. For the customers the hassle of claiming the money back from the bank is almost as much an ordeal as discovering the theft itself.

Across Western Europe Chip and PIN has been rolled out in a bid to deter criminals from paying for goods with stolen cards. While the technology has helped fight point-of-sale fraud, ATM scams are still proving a major headache for the banks. The police point out that many of the gangs apprehended for cash machine fraud and card cloning are also involved in other crime, including human trafficking and prostitution. “The ATM, as a source of cash, has always been a criminal target, and both the banks and the ATM Industry are continuously reviewing, and introducing security measures,” acknowledges Graham McKay, Executive Director of the ATM Industry Association (ATMIA). “It is critical for customers to understand that the Chip and PIN card should be protected with the same degree of importance as a front door key – never give the details away. The ATMIA has introduced a range of ‘best practice security manuals’ using global expertise, which are regularly reviewed and updated as the criminal threat changes.”

Cash on demand

Today, the UK boasts around 59,000 cash machines – more than anywhere else in Europe, with Germany second and France in third spot. Over half of the UK machines are now situated at non-branch sites, including supermarkets, railways stations and pubs. According to the Association of Payment Clearing Services (APACS), ATMs supply 63 percent of all cash to individuals. That’s an awful lot of people queuing up to withdraw money – an ideal opportunity for a thief to be ‘shoulder surfing’ to spy on PIN numbers being tapped into the keypad. McKay suggests that a duel responsibility exists. “Banks have an obligation to inform customers of good security practice, and ensure that customer data remains secure throughout the transaction process,” he says. “Customers have an obligation to ensure that the storage and use of the card is such that no other person can obtain the card, and that during use any attempt to obtain the PIN is thwarted by covering the PIN pad during use.”

In the UK customers are normally able to withdraw up to £250 a day. Many ATM crimes take place just before midnight so that the criminals are able to take out £500 before the victim has time to cancel the card with the bank. In moves to reassure customers and cut down on the money lost to fraud the banks are fighting back. One in four machines are now fitted with anti-skimming equipment. The system works by scrambling each card’s magnetic strip as the skimming device tries to read the data. The banks are also rolling out more CCTV cameras, tamper-proof machines and installing better lighting around poorly lit cash machines. At some ATMs privacy areas have been painted on the ground to stop crooks from spying over the shoulder of the person using the machine.

The banks recommend that customers stay alert to suspicious activity, use an ATM inside a branch where possible and avoid being distracted by people in the queue. With the incidents of card skimming scams and robberies gaining increased coverage you would be forgiven for thinking that customers are shying away from ATMs. McKay says this is not the case. “ATM transaction volumes do not indicate any reduction in customer use, or lack of customer confidence.”

Convenience

Despite the fear of fraud a ‘hole-in-the-wall’ is a convenient and swift option for getting hold of cash when out shopping or enjoying a night out. “During the introduction of the Euro, the ATM was the main source of note distribution – more than 90 percent of all notes in the first month,” McKay remarks. “As a source of cash it will remain a target for criminals, however the impact of Chip and PIN technology has shown a significant decrease in ATM fraud. This does not mean that criminals have gone away, but that a displacement factor is occurring on two levels – local crime and international crime.” McKay continues: “Local crime will tend to move to the weakest link, which now appears to be at point-of-sale, whereas international crime moves to the country of lowest security. Currently the US is lagging in terms of Chip and PIN and we have noted an increase in ATM Fraud. The biggest threat therefore facing the ATM industry is the displacement crime that moves rapidly to the weakest link, and the internet knowledge transfer of successful crime techniques.”

To help the banks the ATMIA has established the Global ATM Security Alliance (GASA), which provides a worldwide database of crime prevention information. The database, known as COGNITO, arms member banks with information of global crime techniques, fraud alerts, any new modus operandi, and best practice recommendations. Additionally, there are a series of international conferences on each of the major continents, bringing expertise and experience together for knowledge transfer and technology updates.

All eyes this way

The ultimate goal for the banks is to have biometric identification (fingerprint or iris recognition) instead of PIN numbers at every ATM, although the cost of the technology is the major stumbling block. “Various forms of biometrics are already available for use at ATM’s and in some regions biometrics have already been introduced,” says McKay. “The rate of introduction of biometrics is a combination of the following factors – cost versus levels of loss, including customer loss. There is also the psychological impact of introducing different biometrics – finger appears to be the most widely accepted, but iris scan is the most accurate in the western world.”

Biometrics on ATMs would appear to be the best line of defence when it comes to fraud. But with every new technology you can guarantee that criminals will be looking to exploit loopholes in the system. The fact is our love affair with ATMs does not look like waning anytime soon. Indeed, by 2015 APACS expects the machines to provide more than 80 percent of the UK’s cash requirements. Some 40 million people are forecast to be regular ATM users, making around 3.1 billion withdrawals, worth £245 billion. With that sort of usage the banks will have to stay one step ahead of the criminals – not an easy battle but one that customers will want to see the banks win in resounding fashion.

Fast Facts for UK ATMs

The total of all withdrawals from ATMs reached £172 billion in 2005 – an average of £5,455 per second.

• The average cash withdrawal value from a bank or building society cash machine is £65
• There were 164 million plastic cards in issue by the end of 2005 that could be used at a cash machine
• 96 percent of all cash withdrawn are from ATMs owned by the banks and building societies
• Almost 39 million regularly use cash machines, making 86 withdrawals ever second.

Source: Association of Payment Clearing Services (APACS)