ATMs have long been a target of fraudsters hoping to steal a large amount of card data from unsuspecting consumers, and the problem looks like it can only get worse before it gets better.
The card networks are pushing ATM operators to accept EMV-chip cards, which can reduce counterfeit fraud, but the deadlines for ATMs are well past the deadline for installing EMV at the point of sale, leaving ATMs to be a more appealing target. And rather than motivate ATM operators to upgrade their technology, this rise in fraud an over 300% spike in fraud at non-bank-owned ATMs in early 2015, according to FICO is leading operators to look past EMV to other remedies.
The spike in fraud at the ATM also coincides with the massive data breaches at retailer stores, which have served as a catalyst for EMV card adoption at companies like Target Corp.
"Like most things in banking, something has to become a crisis before it gets a lot of attention, and fraud at the ATM is gradually reaching the levels of a crisis," said Ted Crooks, fraud expert and principal at Crooks Analytics Inc.
But at the same time, skimming at the point of sale, which has a much closer EMV adoption deadline, declined 81.25%, FICO said.
"Fraudsters realize that the methods they are using to counterfeit mag stripe cards will be going out of use before too long, even though it will take a couple of years before it completely disappears," Crooks said. In the meantime, criminals will try to capitalize on "the skills and methods they have in place before they go away," he added.
EMV would address the threat of skimming card data to rewrite it onto counterfeit cards, but ATM operators also want to protect against data system hacks and other vulnerabilities, said David Tente, the association's executive director for the U.S. region.
"I heard from a member of the association that one of its bookkeepers said the payback on the EMV investment will take about 14 years," Tente said.
Some operators are exploring ways to outright remove plastic cards from the ATM interaction.
"Some are going to QR codes and pre-staging the withdrawals through mobile to bypass the use of a card altogether," he added. "Some non-bank solutions, like PayPal doing money transfers without a card, are also being discussed."
Two years ago, ATM owners and operators received the timeline from the card networks outlining the steps to
At the point of sale, the deadline is October of this year, leaving a gap of one to two years before ATM operators reach their own deadline. Gas pumps also have a 2017 deadline. After these deadlines, the party unable to handle EMV payments will be liable for any fraud that could have been prevented by the technology.
The rising fraud and
"The liability shift is not as powerful of a carrot or stick in the ATM environment because either way, the banks bear the fraud," said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
"They don't have retailers to push the liability down to," Conroy said. "In some cases, the ATM fraud is taking place at the bank's own ATM with its own branded card."
Some banks are making it a regular practice to send branch staff out to physically check the ATMs on a weekly basis, Conroy said, but criminals will simply install their devices on a weekend.
"I have talked to banks that say one weekend of skimmed ATM cards can cost them $50,000 easily," Conroy added.
Banks have had some success in actively working with local prosecutors to go after the crime rings involved in attacking their ATMs, but not all banks are big enough to take on those aggressive and expensive measures to curtail fraud.
Still, banks hate losing money, said Avivah Litan, a vice president and fraud analyst at Gartner Inc.
"They are always worried about ATM fraud and probably more worried about it now, knowing that retailers will have EMV protection and the criminals will flock to the least secure channel," Litan said.
The only thing EMV will do is slow down ATM fraud, she said. It is not likely to completely stop it.
The ATM industry carries that same fear, ATMIA's Tente said.
"All of the conversion to EMV at the ATM by 2017 will help, but we believe Europe went back to pre-EMV fraud rates at the ATM a couple of years after converting," Tente said.
