SCOTTSDALE, Ariz.-The ATM fraudsters who stole about $50,000 from TruWest Credit Union here last winter were "pretty clever."
They attached an "all-in-one" skimming device to one ATM after the branch closed, removed the device after midnight, and then rotated it between two similar-model ATMs, according to Tom Gessel, CTO at the $750-million CU.
"The fraudsters expected that we wouldn't be around during those high-traffic hours," Gessel explained. "The device collected magnetic strip data and PINs several times in the evenings and weekends - during peak usage times. One rainy night, a very aware member saw the device come loose and contacted the police."
The thieves made no attempt to use the stolen information for a few weeks, hoping that TruWest would lower its guard, Gessel believes. In the meantime, they evidently used the stolen data to make fraudulent cards.
Suddenly, the thieves "bombarded the ATM network with the plastics they'd manufactured," he said. "They did it over a long, holiday weekend in order to maximize our exposure. So, the salient message is: The weekend is the time to have your guard up."
Good video surveillance is one reason that TruWest was able to shut down the fraudsters before incurring greater loss, Gessel continued. "We superimpose transaction data on the video, so we're able to correlate down to the exact transaction when the skimming equipment was placed and removed."
The all-in-one, wireless skimmer used on TruWest ATMs was the latest-and-greatest, said Gessel. "The camera was hard to find, no larger than the head of a felt-tip marker, and looked almost like an infrared receiver. A memory card stored the card data and associated the PIN-entry video with it."
Since then, TruWest has learned to make better use of suspicious transaction reports to identify potential fraudulent activity at additional merchants and ATMs, Gessel said. "We're taking a proactive approach of cross-correlating transaction data whenever we replace a card."
The correlation capability is enabled by a database TruWest designed that combines data from its in-house ATM management solution with data from the CU card processor, CO-OP Financial Services, he said.
Modest Cost, Bigger Payback
TruWest will begin paying CO-OP to process all transactions instead of intercept processing, which is free, he added. Each transaction will cost about a nickel to process. The more costly approach will help identify usage trends. "We think that modest incremental cost will be offset by fraud reduction."
By March, TruWest will replace its fleet of 30 ATMs with NCR models that not only meet the standards set by the American with Disabilities Act, but feature some of the latest anti-skim technology, said Gessel.
Sensors will detect equipment attached to the ATM card slot, shut down the ATM and notify the CU and the terminal driving host. A "jitter" mechanism will shake the ATM card as it moves in the slot, preventing certain skimming devices from reading data, he said.
"Our new ATMs will help us close off a number of avenues to fraudsters," said Gessel. "As other financial institutions take similar measures, the easier target becomes institutions that don't have upgraded anti-skim technology." TruWest's ATM upgrades have been on hold, but the need for anti-skim, ADA and security features "pushed the project to the forefront."
Each new ATM costs about $50,000 - the same amount lost to the fraudsters last winter. Upgrading old machines would have cost about $35,000 per ATM, Gessel continued. "In the long run, it made more sense to get new hardware and depreciate it over a long period of time rather than trying to upgrade older ATMs."
