By Ray Birch
MADISON, Wis.—As retailers pay more attention to high-tech fraud and tighten POS security, crooks are going old school, increasing their use of card skimmers on ATMs.
As CUToday.info has reported in recent weeks, there have been numerous instances of credit unions discovering the skimmers have been placed on their ATMs, including at Deseret First CU, Navy Federal, and Virginia Credit Union.
FICO reported a 174% increase in card data compromises at financial institution property ATMs and a 317% increase in ATMs at non-FI locations from January 1 to April 9, 2015.
CUNA Mutual Group, which sent a Risk Alert to credit unions on the issue, said it’s simply criminals taking the path of least resistance.
“It’s the common pattern of fraud,” said Robert Jarosinski, CUNA Mutual Group senior consultant, risk management. “Like any other industry, cyber-thieves try to benefit from a weakness in the market. So as POS terminals begin to get more secure, as cybersecurity becomes the buzzword, and EMV is on the way, fraudsters are looking at other opportunities to gain access to member data and the weakest links now are ATMs and gas pumps.”
Merchants and card issuers are moving quickly to meet the October 2015 EMV liability shift for POS terminals and plastic. But the liability shift deadlines for ATMs don’t arrive until 2016 and 2017. MasterCard’s deadline for ATMs to be EMV ready is October 2016 and a year later for automated fuel dispensers. Visa’s deadline for ATMs and gas pumps is October 2017.
“Again, this leaves ATMs and gas pumps exposed,” said Jarosinski.
Weakest Link Responsible
The EMV liability shift deadline for ATMs works the same as for cards and POS terminals, with the weakest link in the transaction chain accepting the fraud costs post-deadline.
“Right now if a credit union has a consumer from the local bank swipe their card on the CU’s ATM, and fraud occurs from that transaction, the bank is responsible for the fraud,” explained Jarosinski. “Post ATM liability shift deadline, if that bank customer swipes their EMV card on the credit union’s ATM that is not EMV ready, the credit union accepts the fraud costs.”
If card skimming is to continue once ATMs migrate to EMV, crooks will have to devise new skimming tools—and even then Jarosinski is not sure how worthwhile the data will be for criminals.
“Right now these skimmers are designed for swiping a card,” said Jarosinski. “With EMV the consumer dips the card. Plus, with EMV, each time a unique authentication code is used. So even if thieves had a device to get that code, it would only be good for a one-time use.”
But Jarosinski understands that given time, cyber-crooks often find ways to get what they need to steal data, noting there have been examples where data security experts have devised ways to beat chip cards. But Jarosinski said those methods so far have been very difficult and time-consuming ways to hack EMV, and probably not a means of data theft cyber-crooks would employ.
Jarosinski said CUNA Mutual Group was not surprised by the FICO report, observing that the company had “felt” the threat coming. “We started to see a rise in claims in this area, and learned about it through our risk management consultations with credit unions.”
Jarosinski said that recently a credit union CUNA Mutual works with found one skimmer on its ATM, and then a week later, another. He advised credit unions to step up their security reviews of ATMs, and make the walk-byes more than a weekly or monthly effort.
“When credit unions walk around their facilities daily to check for suspicious activity, it’s a simple step to add in checking the ATM,” said Jarosinski.
Inform Members
He added that it’s time to educate members about the threat from skimming, what it is and how to prevent it.
“Members need to know that the bad guys really want that PIN number. Explain to members to be very careful when entering their PIN—cover their entry with their other hand.”
Other ATM security steps recommended by CUNA Mutual:
• Ensure ATMs are free of concealment areas (e.g. overgrown shrubbery), lighting is adequate and in compliance with state laws, and alarms/surveillance cameras are working properly.
• Consider moving to EMV-enabled ATMs.
• Make sure ATMs are set up to validate and match against CVV/CVC or equivalent to help mitigate counterfeit fraud risks.
• Stay vigilant and place additional scrutiny on ATM and gas station transactions.