Safety in numbers?

Every year, bank and building society customers withdraw a staggering £128 billion in cash from these 'holes in the wall'. Indeed, it would be fair to say that, as is the case with many inventions, it's difficult to remember how we managed without them.

In the UK today, more than eight out of every ten adults own and use an ATM card, while nearly 70% of all the cash withdrawals they make from their personal accounts are carried out using a teller machine.

Over the past few years there has been a definite proliferation in the number of ATMs in the UK. The total currently stands at over 37,000, a figure which is expected to carry on rising. In addition, it's important to note the trend for ATM installations, whereby 48% of last year's new machines were located off-site (and often in remote locations).

Looking into the criminal mind
Banks are quick to recognise the value of the service ATMs provide to their customer base, and new machines are constantly appearing on the High Street, in the petrol station and the small, out-of-town village.

However, such is the way of the world that no sooner does a technology like the ATM arrive – particularly one that's stuffed with cash – than the criminal mind sets to work in attempting to break down its security. This problem is compounded when the location of ATMs in ever-more remote areas means that protecting these machines (and the customers using them) becomes a matter of serious concern.

Typically, crime surrounding ATMs tends to compartmentalise into one of two areas – physical crime, and that which might be termed 'electronic' crime. Both are an important issue for the banks, building societies and independent ATM operators.

From the perspective of physical security, the first 'cash-and-grab' or 'ram raids' occurred soon after ATMs first hit the streets. Criminals simply drove into the machines to destroy them, and then made off with the cash inside. Reinforced safes and heavy duty anti-ram raid bollards appeared as defence mechanisms.

A more frightening aspect of the physical side of ATM-based crime is assault. Individuals who are alone and distracted can represent an easy target for muggers. Again, the problem is compounded if there's no-one around to help.

The second type of ATM crime, that of 'electronic' crime, is perhaps more insidious. At one level, electronic crime is no more than a simple fraud undertaken by the cardholder in attempting to defraud the bank. A cardholder will use an ATM card, which is legitimately theirs, to make two identical cash withdrawals back-to-back. They subsequently contact their bank to complain that the ATM has made a technical error. The burden of proof has often led to the bank giving way and refunding the 'missing' cash (albeit that the majority of banks are now no longer – if ever – so easily duped).

At another level, electronic crime is considerably more sophisticated, even though the end result is the same. Phrases such as 'shoulder surfing', 'transaction reversal' and 'skimming' have now entered common usage to denote and explain some of the frauds taking place. The use of fake keypads, card readers and card-trapping devices is now rising with alarming regularity.

For their part, criminals will go to extreme lengths to deceive the cardholder and the teller machines. It's not unusual for ATM fraudsters to work in a small pack, and to use a number of different tactics in order to steal cash. For example, they may attach a card-trapping device and, while the ATM user is keying-in their personal PIN number, someone will stand behind them in order to 'shoulder surf'.

When the ATM user realises there's a problem they invariably assume that a technical error has occurred. At this point they'll walk away, leaving their card in the machine (where it should be safe) and then contact their bank to report the technical error. The fraudster then removes both the card and device, and has the PIN number to access the cardholder's account.

Customers choose a bank to protect their day-to-day finances and their life savings based on a number of factors. With ATM use forming a key part of the service equation, it’s important for cardholders to feel that their account is safe

Alarmingly, ATM fraud largely goes undetected until the customer receives their bank statement. Exactly how many of us have discovered an unexpected ATM withdrawal and realised that we've become a victim of fraud?

This can often be very distressing because, by its very nature, fraud is faceless and so the victim is left with the daunting task of persuading the bank that they didn't make the withdrawal in the first place.

Following the US example
How the US banking community handles ATM security makes for an interesting case study. Currently, those banks Stateside integrate digital video recorders with their ATMs such that the transaction details made by the ATM user are recorded along with an image of the cardholder while they're at the machine. As such, there can be no margin for doubt.

Digital video recording using a Lanex system, for example, is already being deployed in a number of installations across the US. It enables the bank to digitally record transactions being made at the ATM, and associate these with the physical transaction data (this is time and date stamped in a proprietary 'read only' format which is both searchable and filterable). Therefore, this allows the given bank's security team to identify the individuals making fraudulent transactions, and provide the authorities with video evidence to prosecute those responsible.

The Lanex system is remotely accessible. The security manager can review the video and change the settings from any location. In use, the system may record up to 15 frames per second, and boasts 200 Gb of storage space per camera. Designed for stand-alone applications, it has long-term video storage capabilities so there's no need to change tapes.

With systems such as the Lanex DVR, video surveillance can be networked into the bank's enterprise-wide security system regardless of the ATM location. The system is also designed to counter hackers and virus attacks... which is all-important as criminals are finding more and more innovative and ingenious ways of tampering with the teller machines.

Growing concern in the UK
In the UK a security system like the Lanex may raise legal concerns relating to data protection and civil liberties. However, with the ongoing rise of fraud cases it's only a matter of time before the UK's High Street banks afford the issue of technological 'assaults' the attention and urgency it deserves.

Given this kind of backdrop, one would have thought that the UK banking community would be taking the issue of ATM fraud seriously. But is it? Research carried out by Verint Systems makes for interesting reading. While most banks and building societies do – as you'd expect – have someone in general charge of security, only 20% of those organisations questioned said that they'd placed someone specifically in charge of ATM security. In addition to this, none of the banks or building societies had video surveillance equipment installed at their ATMs, and only one had given any thought to digital video capture at their ATMs in the future.

This is not to say that the High Street banks are not doing anything about the problem. NatWest, for instance, is continuously examining measures that can be taken to combat ATM fraud and safeguard its customers. This particular 'major' states that it has a dedicated resource to monitor any attempted ATM-related criminal activity and implement counter-measures.

Customer awareness campaigns have included leafleting, 'Crimestoppers' stickers being adhered to more than 200 ATMs in vulnerable areas and the piloting of pavement 'hatching' around external ATMs to help cut down on shoulder surfing. It also claims to be increasing its use of CCTV and improved lighting at ATMs to combat crime.

However, the ingenuity of professional fraudsters is such that pretty soon the banking community will have to face the reality that possibly the most effective way of reducing ATM fraud is to fight fire with fire.