Protecting ATMs

In December RBR ran an online conference for Self-Service Banking Europe. There is much in the news about attacks on ATMs and this was one of the areas of interest in the conference. Paul Nicholls from Oberthur Cash Protection, Spencer Marshall from HID Global and Duane Campbell from Tesco discussed what they are doing in this area.

They made the point that the criminal fraternity talk to each other, perhaps better even than the industry. When discussing crime, a pattern was described of a new modus operandi evolving which then spreads fast amongst criminals. A solution is found, and attack numbers fall. There is the opportunity and need for the industry to communicate better and for much closer collaboration.

ATMs installed in bank branches are usually put in place with careful consideration. As bank branches close, many replacement ATMs are in more vulnerable places or installed with lower levels of protection. In addition, they are often in remoter areas where there are fewer police available. There was discussion about whether rules were needed to stop this.

The number of transactions at ATMs may be falling, but their value is increasing. This creates the challenge of defining the right level of notes to hold.

The move to increased use of remote communication with the ATM to ‘order’ notes means that two factor authentication is being used rather than the PIN pad, adding to security.

Three layers of security

Three layers of security were described. The use of analytics both to understand the threats and to manage the distribution and stock levels of machines, a layered approach to defend the front (manipulation of the interface), the back (the safe) and those threats that can be stopped (ram raids, explosives etc).

In recent years the number of physical attacks has risen (see page 4, which includes news of the latest ATM attacks in the Netherlands). However, this year the threat to ATMs has been lower in the UK, and Germany (although not as much as in the UK), but in the US it has gone up 148%. With the use of explosives increasingly popular, the group then discussed the role of different dye solutions to protect banknotes. Although these are common in CIT vehicles, they are also effective when used in ATMs.

In some countries dye protection systems are a regulatory requirement, eg. France, and in others voluntary, eg. Mexico. There are two types, passive (a bag of ink explodes over the notes triggered by a specific event – used widely in Brazil) and active (a sensor triggers the release of ink if an attack is detected). There is no international certification for the different systems.

The group recommended that in the absence of local regulations, those responsible for protecting CIT vehicles and ATMs look at countries like Malaysia, South Africa and Germany that do have clearly defined standards.

The discussion gave good evidence that active solutions work. There was a strong suggestion that the security measures used to protect cash should be publicised. People need to know that if they are given a banknote with dye stain on it, they should not accept it. Information makes the protection more powerful.