ATM fraud was becoming an increasingly urgent concern for financial institutions as the industry prepared for the transition to EMV technology. While many card issuers had already established their EMV migration strategies, upgrading ATM fleets presented another significant challenge. Criminals were taking advantage of vulnerabilities in U.S. ATMs, particularly through skimming attacks, creating substantial potential losses for ATM operators.
The approaching EMV liability shift added pressure for banks and credit unions to accelerate ATM EMV migration. With manufacturers warning that the U.S. had become an attractive target for skimming fraud, institutions faced both security and financial incentives to modernize their machines. The potential cost of a single ATM skimming incident made delaying upgrades an increasingly risky proposition.
Most card issuers have their EMV migration strategies firmly in place and now need to turn their attention to plans for migrating their ATM fleet. NCR and Diebold both are warning customers that due to the increased incidents of fraud by skimming, financial institutions may want to consider taking action quickly:
NCR believes the attacks are growing in the U.S. because it’s an easier target. Owen Wild, director of security marketing at NCR said operators in America have yet to deploy as many anti-skimming technologies and techniques as other countries have. And many operators have yet to implement EMV chip technology at ATMs with the liability shift still at least a year away. (MasterCard’s ATM liability shift date is October 1, 2016 and Visa’s is October 1, 2017. However, most ATM operators accept both, which makes 2017 irrelevant for most, because they have to be compliant for MasterCard anyway.)
To add a further sense of urgency to the matter, it is estimated that ATM operators lose $50,000 on average for each skimming fraud incident that attacks their machines.
ATM EMV migration represented more than a technology upgrade for financial institutions—it was an important component of a broader ATM fraud prevention strategy. As criminals increasingly targeted machines that lacked stronger anti-skimming protections, banks and ATM operators needed to evaluate whether waiting until the liability shift deadlines was worth the additional exposure.
The estimated losses associated with individual skimming incidents also strengthened the business case for acting sooner. Investing in EMV-capable ATMs and complementary anti-skimming technologies could help institutions reduce fraud exposure while strengthening the security of a self-service channel that customers rely on for convenient access to their accounts.
Ultimately, financial institutions needed to view ATM EMV migration as part of their overall card security strategy rather than simply another compliance deadline. Card issuance and ATM acceptance are interconnected pieces of the payment ecosystem, and upgrading one without addressing vulnerabilities in the other leaves opportunities for fraudsters.
As EMV adoption expanded throughout the U.S. payments market, criminals were likely to concentrate their efforts wherever weaknesses remained. Financial institutions that moved quickly to modernize their ATM fleets could reduce those opportunities while preparing their networks for the changing payments environment. A proactive approach to ATM security could also help institutions avoid potentially significant fraud losses and provide customers with greater confidence when conducting ATM transactions.
Overview by Sarah Grotta, Director, Debit Advisory Service at Mercator Advisory Group.
Read the full story here.