Spooked by reports of independent ATM operators stealing users' identities, lawmakers in California are planning to introduce legislation in January that would require owners of nonbank automated teller machines to get licenses from state banking regulators.
Under the legislation, proposed by three Democratic members of the Assembly, owners and operators of nonbank ATMs would have to submit to full background checks by the California Department of Financial Institutions before they could receive licenses. The state agency would then be able to monitor their machines and their operations.
The lawmakers said the bill is necessary to lessen the chance of identity thieves' purchasing ATM machines and installing "skimming" devices to steal users' identities.
"Anyone wanting to steal identities could spend $3,000 and buy ATMs on the Internet, which is nothing compared to the millions that they could take from customers," said Karen Kim, a spokeswoman for Assemblyman Dario Frommer of Glendale.
Bankers in California are applauding the proposed bill. They say that the additional oversight could help curb identity theft - and the losses banks incur in reimbursing customers.
According to the Electronic Funds Transfer Association, about 35% of the 189,000 ATM machines located outside of banks - such as at hotels, convenience stores, and gas stations - are owned and operated by independent organizations. Reports of independent operators using their machines to commit fraud have become more common, the trade group said.
On Dec. 3, Iljmija Frljuckic was arrested near Detroit by the Secret Service and local police and accused of skimming more than 21,000 bank account numbers from users of the 50-odd ATMs he and others owned and operated in New York, Florida, and California.
Mr. Frljuckic and several other noncitizens from Eastern Europe allegedly used the stolen account information to make duplicate debit cards. The gang then allegedly went to other ATMs to withdraw $3.5 million from the accounts, which were at more than 1,400 banks.
The Secret Service suspects that at least one of the alleged thieves fled to Eastern Europe with even more cash. Mr. Frljuckic was expected to be returned to New York to face conspiracy, bank fraud, and access-device fraud charges.
The California bill would be the first of its kind in the country. In a December press release commending the plan, the California Bankers Association said: "California's banks have been complying with usage and safety regulations for years and have been happy to do so. … We believe that by enacting a set of meaningful and enforceable guidelines for nonbank ATM owners, we can further ensure a safe ATM experience for all Californians."
Mark A. Moore, a lawyer at Aldrich & Bonnefin PLC in Irvine, Calif., said that banks could benefit greatly if regulators oversaw nonbank ATM operators. The less chance identity thieves have to steal account information, the less likely banks are have to reimburse customers, he said.
In 2002 banks lost at least $1 billion reimbursing customers who had been defrauded by identity thieves, according to a report released in March by the TowerGroup Inc. research firm in Needham, Mass.
The California legislation would also impose new requirements on banks that sponsor nonbank ATM operators so that they can access the country's electronic banking network. Sponsoring banks would have to perform the type of due diligence that was recommended by the Electronic Funds Transfer Association's ATM Integrity Task Force.
For example, banks would have to thoroughly investigate the background of all the principals of the independent ATM entity, including checking whether they are included on the Office of Foreign Assets Control list. Sponsoring banks would also have to conduct a financial review of the business entity, including its tax returns. Banks that contract with independent entities to operate their bank ATMs would also have to adhere to the new requirements.
Currently, banks are not required to perform due diligence on ATM operators they sponsor or use as vendors, but most do at least some type of check to reduce the chance that they will have to assume fraud liability, Mr. Moore said.
Still, it makes sense for the state to require more thorough reviews by these banks, Mr. Moore added, since they are "the ones best situated to block problem merchants and prevent them from getting access to the ATM systems."
