When asked by a reporter why he robbed banks, Willie Sutton famously replied: “Because that’s where the money is”.
There is certainly a lot of money sitting in ATMs around the globe and they are continually under siege. Ram Raids, explosive attacks, jackpotting, skimming, and shimming are all on the rise – with all types of ATM crime up more than 600% between 2019 and 2022.
It is pretty difficult to slow down a determined thief driving a stolen front-end loader that weighs 70,000 pounds, or someone with a few sticks of dynamite and a match. (Reflect back on our Mr. Sutton who always carried a gun during his robberies, because, as he said: “You can't rob a bank on charm and personality".)
Defeating criminals intent on getting to all the cash inside any particular ATM requires continual updates to the physical security components of the machine, e.g. HD cameras, sophisticated sensors, stronger safes, better locks, etc.
On the other hand, dealing with criminals who want to keep an ATM operational so that they can steal from you takes another layer of sophistication. Skimmers and Shimmers will take what they can get from a machine (usually up to a cardholder’s daily withdrawal limit), but what they want are the PANs and PINs that can be used to generate revenues away from the ATM.
It is certainly not difficult to find news stories about gangs targeting ATMs across the globe. USA Today recently reported on the increase in skimming attacks, citing FICO data that shows a significant increase in these incidents, both in the US and abroad. ATMs, fuel pumps and other self-service devices are all vulnerable, with the FBI estimating that skimming is now costing consumers and financial institutions more than $1 billion a year.
Chip cards have helped the situation somewhat. Unfortunately, it did not take long after the widespread adoption of EMV cards for mag stripe Skimmers to evolve into chip card Shimmers, which are capable of capturing enough data to create new cloned mag stripe cards or to use in other scenarios, such as Card Not Present transactions. Either way, these attacks continue to represent a significant threat to the ATM channel.
Biometrics - Time for More Widespread Adoption?
Given the success that thieves have had generating revenue from these various hacks and attacks, we can be certain that the fraudsters will not go away. Rather, they will continue to refine their tactics and exploit vulnerabilities wherever they can be found. Our only option is to introduce and adopt more advanced security solutions.
The use of biometrics for authentication has been growing in various sectors and consumers have increasingly realized that this technology is a valuable tool in the fight against payment fraud. Citing IDC research, the Payment Cards and Mobile website recently noted that “Consumer acceptance of biometrics is gaining traction”.
However, several issues and challenges remain that may impact the widespread adoption of biometrics for ATM security, including:
- Competing Technologies: Various implementations across the globe include fingerprint scanning, facial recognition, iris/retina scanning, as well as finger vein and palm vein pattern recognition. In order for biometrics to become widely accepted, there will need to be some way to standardize the technology options.
- Consumer Convenience: While there have been a number of ATM implementations of biometric authentication in geographies around the world, there have been mixed results in terms of speed, reliability, and ease of use.
- Privacy Concerns: Storing, accessing, and processing biometric data across multiple ATM devices and networks is complex and may raise privacy and (ironically) security issues.
- Cost: Acquiring and integrating biometric scanners, readers, and other components into existing ATM devices, networks, gateways, and authorization systems will require significant investment and technical expertise across the entire ecosystem.
Despite these roadblocks, the market for biometric solutions for ATMs is projected to grow significantly over the next several years.
Testing is a Critical Component of ATM Security
Fraudsters have become extremely sophisticated and their tactics continue to be innovative and aggressive. Our response can be no less forceful and determined. That means we must close every gap, fix every loophole, and remediate every vulnerability as quickly as possible – testing these solutions thoroughly to ensure that we do not inadvertently open up any new weaknesses for crooks to exploit.
By taking advantage of ATM testing solutions that support virtualization and automation your developers, testers, and QA resources can significantly speed up and expand their testing capabilities. Automating even the most common ATM test cases will enable your resources to spend more time on higher-value tasks, like developing new ways to fight fraud.
Improving your ATM testing capabilities will not only help in your fight against fraud, it will also provide several additional benefits, including:
- Improved quality
- Faster project and release cycles
- Expanded test coverage
- Increased productivity
- Reduced costs
Interested in learning more about how better testing can help enhance your ATM security? Get in touch with us today.
A Guide to ATM Testing
