ATM Security

Presented by WilliamsTown Communications

Courtney Cantwell, Instructional Design Manager

#FC153

2

IntroductionWelcome to ATM Security. In this Training on Demand

course, you’ll explore various threats to the security of your credit union’s automated teller machines. You’ll also learn how to protect your credit union and its members against these risks through implementation of a multifaceted ATM security program.

Automated teller machines, or ATMs, are incredibly popular throughout the world because they offer people easy access to their money at all times and in nearly every setting imaginable—all without having to visit their bank or credit union during business hours. Unfortunately, this convenience and ease of access also make ATMs a prime target for criminals.

ATM-related theft and fraud can be devastating to members whose accounts are compromised. It can also harm your credit union in more ways than one. Not only do ATM breaches directly affect your bottom line, but they often lead to decreased member trust and damage to your organization’s reputation.

So, what can your credit union do to protect itself and its members from ATM-related crime? By the end of this course, you’ll know the answer to this question—and much more.

ObjectivesUpon completion of this course, you should be able

to:

• ReviewcurrenttrendsinATMsecurityandhowthese trends are expected to shift in the coming decade.

• IdentifythethreemaincategoriesofATMattacks,and recognize example threats from each category.

• Reviewspecificsecuritymeasuresaimedatprotecting ATMs from the three main types of types of attacks.

• Recognizehowthesemeasurescanbecombined with other best practices to create a comprehensive security program that protects all aspects of a credit union’s ATM system.

Trends in ATM SecuritySince their introduction in the late 1960s, ATMs have

becomeastapleofthefinancialservicesindustry.Today, there are an estimated 2.2 million ATMs in use worldwide, and this number is expected to reach 3 million or more by 2016. Not surprisingly, as long as ATMs have existed, criminals have been trying to compromise their security. After all, many of the same

3

traits that make ATMs convenient for credit union members—such as 24-hour access, placement in nearby locations, and lack of round-the-clock staffing—also make them appealing to criminals.

In years past, most thieves who targeted ATMs focused on stealing the cash stored inside, typically by cutting or prying into the machine’s interior, or perhaps even stealing the entire ATM! Over the last decade, however, criminals have increasingly shifted their focus toward theft of user data, including account numbers,cardnumbers,andpersonalidentificationnumbers or PINs. The thieves then use this information to produce counterfeit cards that are used in fraudulent transactions, including ATM withdrawals, in-person purchases in which a PIN is required, and remote purchases that don’t require a PIN.

EMV TechnologyExperts anticipate that data-focused ATM attacks

will continue to increase in the United States. In fact, they are predicting a sharp rise in U.S. ATM crime as the rest of the world shifts toward use of a new generation of “smart” bankcards. These cards are known as EMV cards, because they employ technology originally developed through the joint efforts of the Europay, MasterCard, and Visa corporations.

Unlike typical U.S. bankcards, which store user information in a magnetic stripe, EMV cards are embedded with small computer chips. These chips can only communicate with ATMs and other card-accepting terminals when they come in direct contact with a specialized plate inside the terminal. The need for direct contact means that EMV cards are safe from a common form of fraud known as skimming (which is discussed in detail later in this course). Use of chip technology also makes it extremely difficult for criminals to produce counterfeit EMV cards—unlike magnetic stripe cards, which can be easily and cheaply produced and written with stolen data.