By Ray Birch
TAMPA, Fla.—GTE Financial is investing in 61 new skimmer-proof ATMs at a cost of about $35,000 apiece.
The $1.9-billion CU says the investment is well worth it not only to avoid fraud losses due to the rising number of skimming attacks, but also to keep member confidence in the credit union high.
There is also another plus. Installing the machines today, which GTE Financial said are just beginning to appear across the nation at a few banks, can get the financial institution a lot of free press, as well, since skimming attacks are regularly in the news.
What prompted GTE Financial’s move was not skimming attacks on the credit union itself, although it encountered two in the last year, but instead the rash of skimming attacks that are occurring nationwide. As CUToday.info has regularly reported, ATM skimming attacks have increased dramatically in the last two years as EMV has crimped POS fraud, pushing crooks to ATMs. GTE Financial CU CIO/COO Chad Burney believes the skimming attacks will only increase as more merchants roll out chip-enabled terminals.
“When an ATM is compromised, the credit union typically takes a hit of about $50,000, for fraud losses and the costs of reissue, etc.,” said Burney. “But there is the larger issue of member confidence, which you cannot place an ROI on. When you lose that it is hard to get it back. With all the skimming attacks on the horizon, keeping member confidence high in the credit union’s ability to protect their personal data is the biggest reason we made the move.”
61 Machines
GTE Financial plans to have all 61 of its machines replaced by the second week of September.
The technology inside the new Diebold ATMs is called ActiveEdge, said Burney.
“It’s relatively new technology. Diebold is saying now that there is no known skimming device that can compromise this machine,” said Burney.
Burney explained that in the event a thief attempts to place a skimmer on the ATM, the machine will sense it, shut itself down, alert the CU, and start flashing a series of red LED lights that surround the card entry slot. With the new ATMs, consumers insert plastic cards horizontally instead of vertically. The card goes completely inside the machine. The magnetic strip goes in first, and skimming devices can't reach it.
“With the machine sucking in that card internally and then having a moving head to read the mag stripe, it’s impossible for a skimming device to read the magnetic data as it passes by,” said Burney.
Burney pointed out that the ATM detects a skimmer via a series of sensors inside the machine and at the “gate,” where the card is inserted. Those sensors are set, he said, to detect anything inserted into the machine that is not a card. So the machines would even detect if a fraudster used a deep insert skimmer, one placed inside the machine via a wire.
Tech 'Badly Needed'
Burney said the anti-skimming technology is badly needed as criminals’ skimming skills are advancing. He said their devices are getting smaller and much harder to detect, even by credit union staff who regularly inspect the machines.
Gas station card readers are often compromised today because crooks can easily get inside to the internal workings of the devices via a universal key that works on most gas pumps.
If a criminal were able to “open the door” to the new ATMs, could the machine be compromised?
Burney said no. Not only would the machine detect the intrusion and alert the credit union, it also has a number of sophisticated fraud prevention devices internally. Burney explained that very sophisticated fraudsters can compromise a standard ATM by getting to its internal workings and installing a USB device that then sends card data to the criminal.
“But with the new machines we can give it a white list of the IPs it can talk to,” said Burney. “The machines have much better malware prevention and firmware capabilities than a standard ATM.”
As GTE swaps out its old ATMs, the new machines are EMV enabled. The CU therefore did not have to make two changes to its fleet—one to meet the October ATM liability shift deadline.
Burney noted that converting an ATM so it can read chip cards won’t stop skimming attacks—with many old mag-stripe cards still in use and fallback fraud, where criminals fool the card reader into reading the mag-stripe data and not the chip.
“The mag stripe data is still on chip cards,” noted Burney.
Internal workings of skimmer-proof ATM
Burney agreed that credit unions that install the skimmer-proof ATMs may waste their money when a machine is inside vestibule. As CUToday.info reported, fraudsters are now placing more skimming devices on the card reader to the vestibule entry door.
Benefits from the new ATMs—at least for now—extend beyond fraud savings and protecting member confidence, said Burney. GTE received a lot of free local press when it installed its first anti-skimming ATM.
“The news stations got a hold of this and we did interviews with ABC, CBC, NBC and FOX stations,” said Burney. “And we were often the lead story on the stations’ evening news.”
According to what Burney has learned, GTE may be the only FI that is currently replacing its entire fleet of ATMs with the anti-skimming machines. He said he had heard of a few banks that may be making changes, but not to their entire fleets right now.
More Change
But more change is coming.
“I think banks and credit unions will adopt some type of advanced anti-skimming solution,” said Burney. “There's just too much fraudster focus on this hole in security right now for credit unions to ignore it. I think credit unions will start to adopt these new machines. It will be interesting to see what the other manufacturers do, now that Diebold seems to be leading the pack.”
To sit back and not address skimming is a mistake, insisted Burney.
“We have to do something. We are building the wall against ATM fraud, and with the new machines we now have 12-foot wall and the crooks only have an 11-foot ladder,” Burney said. “But we have to keep building the wall as thieves build their ladders taller.”