Protecting ATMs from attacks

ATM attacks are constantly evolving, from hook and chain and bombs to software jackpotting attacks. Criminals are always on the move, so ATM stakeholders need to have the same dedication to security, especially when it comes to physical attacks.

During a session at ATMIA from Feb. 14 to 16 in Las Vegas, panelists Bryant Thomas, AVP, ATM strategy and vendor solutions, Wells Fargo Bank and Paul Nicholls, director of business development at Oberthur Cash Protection, discussed this in detail.

Nicholls began by discussing some of the ATM attack trends. Although explosive attacks remain small in the U.S., this is largely because safes are often not as secure on U.S. ATMs, removing the need to use explosives, whereas in Europe, there were 490 explosive attacks in Germany.

"Protecting ATMs can be as complex as solving a Rubik's Cube since there are so many moving parts," Nicholls said.

He identified several other trends such as:

• Criminal groups talk to each other and do training on how to break into ATMs.
• In Europe there are more regulations on ATM protections.
• We are seeing attacks with two jaws of life and usage of double explosives.
• Groups such as Eastern European gangs are coming over to the U.S. and bringing their knowledge on ATM attacks with them, Nicholls said. And some of the protection is outdated.

"A lot of protection put in place over the last 25 years was based on the idea that police would be there quickly. Police don't respond as quickly now," Nicholls said.

He argued that this is a vicious cycle of escalation when it comes to ATM attacks as banks put in stronger defenses such as barriers and criminals use more aggressive methods to get in.

Nicholls said what you really need is a layered approach. At the center, banks should use tools such as Intelligent Bank Neutralization System to cover currency with ink to ruin the usefulness of the cash, but you also need physical security to act as a deterrent to opportunistic criminals.

Thomas first began investigating ATM attacks in a city with a lot of hook and chain attacks at Wells Fargo branches. From this research, he was able to gain a lot of intel on how better to protect ATMs and he offered some advice for other banks.

First, he said to identity the possible threats.

"Figure out what ATM models you have and whether they have any vulnerabilities. Do you have any protection against hook and chain? Figure out what are the main ATMs being targeted," Thomas said.

As another example, he said to look at your ATM's rating against gas attacks.

Next, do your research on what physical protection and deterrence products are available. For example, as you usually can't upgrade an ATM safe, you will need to choose it carefully, such as a CEN3 GaaX safe.

After that, you need to determine your preventive strategy, which Thomas said includes several factors such as:

• What sort of ATMs do you use? (Examples include on-wall, off-site, free standing).
• Scope of work. Will it require construction, surveys, additional training?
• Cost. Can you get packages of different products? What is your ATM's life cycle? Is it cheaper to buy a new ATM?

Lastly, Thomas emphasized that banks should stay informed on both local and national ATM attack methods.

"Utilize the relationship you have with your ATM manufacturer. Request quarterly updates on global current attack trends."

He also recommended meeting with other peer banks to discuss techniques and strategies for ATM security, as well as ATM turnkey and installers.

Overall, Thomas said it's important to "do your research."