Check Fraud at the ATM: Reduce the Risk
The advent of imaged deposits at ATMs can eliminate one type of check-fraud, commonly known as empty-envelope deposit fraud. But as Wesley Wilhelm, a senior analyst at Aite Group, points out, only about 50 percent of institution-owned ATMs have been upgraded to accept envelope-free deposits.
"The empty envelope component," Wilhelm says, "is not typically tracked and reported on." Check fraud accounts for between 12 percent and 18 percent of total fraud at the ATM, he says, and empty-envelope only accounts for a fraction of that fraud. That stated, Wilhelm says a financial institution's move to imaged deposits at ATMs won't be solely fueled by a need to curb empty-envelope fraud; the move will have to be driven by an institution's desire to enhance the consumer experience, better integrate all of its banking channels, and an acceptance that future self-service transaction growth is on the way.
"An investment in enhanced ATM capabilities is certainly going to provide a significant payback," he says. "From a product differentiation standpoint, from customized ATM screens, to one-to-one marketing campaigns, to person-to-person transfers, and maybe even ATM integration with mobile banking applications," ensuring that the move to imaged deposits makes sense for the future.
Any time new technology is introduced, however, new security concerns emerge. Imaged ATMs could open doors for new types of fraud, such as increased attempts to deposit counterfeit checks. But Wilhelm says the security concerns appear quite pale when compared with the overshadowing benefits imaged technology provides. "Some of that straightforward matching could get done in an automated way," he says.
In this interview, Wilhelm, who covers fraud management, payments and retail banking technology and operations, discusses why smaller and mid-sized institutions have not yet made the move to imaged ATM deposits, as well as how future regulatory mandates and compliance standards such as PCI could encourage more institutions to make the imaging leap.
Wilhelm has more than 25 years of experience in banking and consulting to the banking industry, in which he has held management positions in risk and fraud management, credit card issuing, debit card issuing and ATM driving, merchant acquiring, and branch and call center operations. He is a recognized fraud management thought leader for research on the Fraud Management Lifecycle Theory.
Before joining Aite, Wilhelm was an operations executive at Merchant e-Solutions, where he led the launch of a merchant fraud and chargeback management service offering. He also served as vice president of retail risk management at JPMorgan Chase, where he managed fraud losses within the Washington Mutual debit card portfolio, which was acquired by Chase. Wilhelm was a director of business consulting with FICO (formerly HNC Software Inc.), where he was involved in the development of eFalcon and the creation of Falcon ID. Before that, he held management roles at various banks, including Seafirst Bankcard Services (now part of Bank of America), Santa Barbara Savings and Loan, City Commerce Bank, and The Chartered Bank of London (now part of Union Bank).
Wilhelm has published numerous articles on fraud management in publications such as Journal of Economic Crime Management, Credit Card Management, Card Technology, and the White-Collar Crime Fighter. He also has taught university-level courses in economic crime management at Utica College.
TRACY KITTEN: Wes, could you please tell the audience a bit about your role at Aite, and the areas in which you counsel financial institutions?
WESLEY WILHELM: My focus at Aite Group is in the retail banking practice, and within that practice, I focus on retail bank delivery channels, the ATM branches, back office, call centers, and I also have a significant focus in enterprise fraud management, which would include fraud and checking accounts, debit cards, credit cards, home equity line of credit, internal fraud, pretty much fraud across the enterprise, as well as focus on compliance and anti-money laundering solutions.
KITTEN: Wes, we've been talking about the constant decline of paper checks, but despite a continuing decline in the number of paper checks that are currently in circulation, check fraud continues to be a problem. When we look at the ATM channel specifically, how prevalent is check fraud, and what types of check fraud do you see there?
WILHELM: Check fraud at the ATMs has been pretty stable over the last four to six years, and typically runs anywhere from 12 percent to 18 percent of the total fraud at the ATM. There are a number of schemes that fraudsters can perpetrate through the ATM, from something as simple as depositing a known counterfeit item or depositing items that are lost or stolen or altered, or checks that are washed. Typically, they use the more anonymous ATM channel to protect themselves. There are also deposit frauds that deal with depositing empty envelopes in hopes of getting the immediate cash. And then there is a whole host of other ATM frauds that are not deposit related.
KITTEN: The advent of image deposits at ATMs has been touted as offering a way financial institutions can help eliminate one of the forms of check fraud that you mentioned, and that is commonly known as "empty envelope" deposit fraud. But, a large percentage of financial institutions have not yet made the imaging investment. Can you tell us where the industry currently stands, where the deployment of image-enabled ATM's is concerned?
WILHELM: I don't have a specific statistical analysis, but I would estimate it is probably somewhere around 50/50 right now, 50 image-enabled and 50 envelope-enabled. The basis for that is that a number of the large banks, Chase, Citi, Wells and BofA, have had an aggressive rollout plan to differentiate their ATMs by enabling them to take both check images and deposit in bulk, as well as to deposit cash in bulk.
KITTEN: And what doors have been opened for fraud because of imaged deposits?
WILHELM: The ability to image deposit is certainly going to put a kink in the ability to deposit an empty envelope, because there is no envelope to deposit. One always takes a look at new technology and tries to think of potential vulnerabilities. One of those potential vulnerabilities may be using the image-enabled deposit at the ATM to deposit counterfeit checks, or to more easily deposit checks that have been washed or altered in some way. It just depends on the level of sophistication in the deposit-monitoring capabilities, and, of course, the level of sophistication of the accountholder.
KITTEN: How many OS/2 ATMs remain in the market, and can those legacy terminals be upgraded to accept image deposits?
WILHELM: I'm not sure how many OS/2 operating systems are still deployed out there, but there certainly has been a strong migration away from them as more institutions upgrade to a Windows environment. I just don't know that the capabilities for differentiation, the imaged deposits, the cash deposits, the customization of personalization at the ATM for the cardholder, are economically feasible in an OS/2 environment.
KITTEN: Why are some institutions waiting to make the investment in image deposits?
WILHELM: I think the short answer to that is capital. In this environment, one of the toughest environments in banking in quite a while, investments in new ATMs and new capital expenditures are certainly going to be taken very seriously. Bankers are very focused on maintaining the ratios they need to maintain.
KITTEN: Do you expect future compliance mandates, with PCI, for instance, to push credit unions and banks to imaged deposits at the ATMs?
WILHELM: Well, while I think PCI and the PCI application to the ATM channel is significantly important, I'm not sure that it would be the main or the single driver. It's certainly a component of driving to enhance the capabilities at the ATM that a Windows environment and the newer functionalities provide. I don't know that it would be the sole emphasis for the move; but it is certainly a contributing factor.
KITTEN: Given the market's continued reliance on envelope-accepting ATMs, can you give us any sense of the losses institutions are still incurring relative to empty envelope deposits, for instance, where check and cash deposits are concerned?
WILHELM: Again, the numbers have been pretty stable for the last few years, at around 12 percent of the losses, based on the ATM channel, for check deposits. The empty envelope component of that is not typically tracked and reported on. While empty envelope deposits are certainly a concern for financial institutions, it's not a huge environment. There's ways of making sure that the deposits are processed in a timely way.
KITTEN: What other types of fraud could image-enabled ATMs help to curb? Counterfeit checks?
WILHELM: Certainly, if the image-based technology is capable of counterfeit detection, if the counterfeiter doesn't have a correct routing and transit number, or the transit and routing number and bank name don't match, some of that straightforward matching could get done in an automated way. Other types of fraud that occur at the ATM -- skimming is still quite prevalent; skimming and PIN compromise. There are also cash trapping devices that are placed in ATMs, there are manipulations of cash extraction that can be done; and then there are card-capture devices that allow the fraudster to capture someone's card and trick them into sharing the PIN with them.
KITTEN: What opportunities do you see envelope-accepting ATMs opening for internal or employee check fraud?
WILHELM: The biggest issue there is to ensure that when your employees are opening envelope deposits, there are dual custody or dual controls in place, because customers are still putting cash in those envelopes. And, if there's not appropriate controls on the deposit-processing side, that cash can evaporate before it gets to the account. The employees, if they're perpetrating a counterfeit fraud scheme, could be getting fairly anonymous access to potential counterfeit check items. In other words, if they've got a live check with a live signature, they may be able to scan it with a Blackberry device and capture it on their own, and then be able to create a fairly good counterfeit from that image; but it all hinges on appropriate controls at the ATM on the deposits.
KITTEN: I'd like to go back to talking about making investments in image-enabled deposits at ATMs. Aren't the long-term savings, and security benefits, outweighing the short-term expenses or the short-term investments?
WILHELM: To make an investment in enhanced ATM capabilities is certainly going to provide a significant payback, not only from a security standpoint, and a protection standpoint from data compromise issues and the like, but also from a product differentiation standpoint, from customized ATM screens to one to one marketing campaigns, to person to person transfers, and maybe even ATM integration with mobile banking applications. The message I would have is, as soon as the capital is available to make an investment, make the investment. It's not a matter of "if," it's a matter of "when."