NY Skimming Incidents May be LinkedRecent String of Breaches Adds up to Big Losses for Banks
The news comes on the heels of a half-million dollar ATM skimming scheme in Seattle, which involved, in part, targeting ATMs at BECU, Watermark Credit Union, First Tech Credit Union and Chase. [See New ATM Skimming Arrests.]
And just weeks before authorities shut down the Seattle scheme, investigators in Florida said they were looking into card compromises that had been linked to skimming devices found on walk-up ATMs at Tampa Bay bank branches, one being a Bank of America branch. The Florida incidents resulted in financial losses totaling at least $26,000. [See ATM Skimming Spree Investigated.]
How costly is this increase in skimming incidents? Aite analyst Julie McNelley says when it comes to card compromises linked to a skimming incident or data breach, losses associated with debit fraud outweigh losses associated with credit fraud by 3 to 1, "And a lot of that is due to ATM skimming."
One bank told McNelley that it could easily experience $50,000 in losses from just one weekend's worth of skimming at a single ATM.
Skimming TrendsIn the Seattle case, it seems fraudsters were targeting certain bank and credit union branches because of the similar ATM equipment they use. The fraudsters also targeted vestibule-entry readers.
"The vestibules are definitely getting hit more often," McNelley says. Criminals are going anywhere they can get a read of the card. "They saw that the banks were proactively checking the ATM, so then they hit the vestibules, and we've seen more of them hitting ATMs in the bank branch itself now, too."
Fraudsters can get more bang for their buck with a vestibule swipe, McNelley says. Since vestibules typically provide access to multiple ATMs, a skimmer on vestibule's access door gets a read of every card that enters.
"At the end of the day, though, I think the fraudsters do their best to mix it up, so they can use their device without detection as long as possible," she says.
Skimming is not a new problem, but one that is garnering more public attention, as ATM-related fraud appears to be increasing. "Banks have always been targeted by skimming fraud," says Jerry Silva, a financial fraud and card skimming expert at PG Silva Consulting. "Both problem and solution have been well documented by now." [See 6 Tips to Curb ATM Skimming.]
The uptick in attacks points to two striking weaknesses, experts say: Outdated security technology and a continued reliance on magnetic-stripe card technology.
The SolutionsThe anti-skimming technology banks rely on is really mixed. Some are investing in technology that alerts branch staff when the fascia of an ATM has been manipulated. Others are investing in transactional analytics, biometrics readers and even out-of-band authentication for ATM transactions.
"This is a very high priority for financial institutions," McNelley says. "But they can't rely on one technology or solution. They need a layered approach, one that includes a combination of policies and procedures, like regular inspections of ATMs."
Industry experts were quick to point fingers toward outdated U.S. payments technology when news of a $13 million ID theft scheme broke late last week. [See Biggest ID Theft Bust in History.]
McNelley says the scheme, which allegedly involved five organized crime rings with ties to Europe, Asia, Africa and the Middle East, hinged on the U.S. card market's continued reliance on mag-stripe technology. "It would not have been possible if the U.S. was already EMV-enabled," she says.
It's clear the U.S. needs to move to smart or chip card technology, better known as the Europay, MasterCard, Visa standard in other parts of the world, most experts agree. And Visa's and MasterCard's [for ATMs] recent announcements to support an EMV move will undoubtedly push U.S. card issuers in the chip direction.
Randy Vanderhoof, executive director of the Smart Card Alliance, says card issuers can expect fraud losses related to skimming to continue. Most won't be encouraged to initiate moves until the expense of fraud becomes too high to absorb.
"Until the U.S. issuers reach the point where their fraud losses or the expenses in mitigating further losses reach the level of where magnetic stripe fraud is no longer a cost of doing business, or banking regulations intervene, we will be seeing more cases," he says. "There are no other technology choices available, other than EMV chip, that will do the job as well and maintain global interoperability for payments."