How to successfully deploy an ATM/self-service solution

How do you engineer your ATM and self-service equipment for the unexpected? And just what does it take to prepare, not only for bad weather or natural disaster, but for stolen pickup trucks hooking up to your ATMs and ripping it out of a wall to steal the cash?

A panel of self-service veterans convened to discuss just such questions during a session called "Lessons from hundreds of self-service deployments" at the most recent Self Service Innovation Summit in Miami, Florida, hosted by Networld Media Group.

Planning, preparation, deployment

The best way to start with your project is with a robust planning phase, according to Mike Melton, consultant, formerly of Refreshing USA, a convenience services firm.

"When we look at deployment, we put it in three phases: planning, preparation and what we'd call 'pizazz,'" Melton said. "The planning is important. You can't plan enough." Commonly, when vending and micro market operators don't invest enough care in the planning phase, they will arrive onsite to find problems, such as there not being enough room for their equipment.

Step two is preparation. "The more prepared you can be on any sort of deployment, the better things are going to go," he said.

Last comes what Melton calls "pizazz": "A lot of times in the micro market arena, we're switching the technology from vending to micro market, or maybe from nothing to micro markets, and it's really important that the customer, the end user, really enjoys the process and realizes the benefits that it's going to give them that they haven't had before."

Having a standard operating procedure, or SOP, with checklists is a great tool; for example, Grubbrr, a provider of self-service solutions, has a 300-step pre-deployment process for kiosk installations, according to Bhavin Asher, founder and CTO: "So, it's deployment, customer buy-in, what we call a user acceptance test with the customer, and then the real battle starts: where to place the kiosks, or, do you have the cabling?"

Having a rigorous pre-check process allows discovery of obstacles, like when Asher was planning a project with a customer and ran into a brick wall; the customer actually asked if it was possible to nail the kiosk to the brick wall — needless to say, having a rigorous planning process prevented some unusual errors with the installation. "There are some really funny stories," Asher concluded.

These steps are not unique to self-service and micro markets, either; rigorous planning is vital if you want to enter the ATM game, according to Lonnie Talbert, CEO at the ATM Industry Association, also known as ATMIA.

"The location of an ATM is critical," Talbert said. "You may think, oh, you can just stick it in a convenience store. But if you put it in the wrong place today, what people are doing is, they're tearing down the walls and pulling the ATM right out of the front of the convenience store. So, you don't want to put an ATM right in the front of the convenience store because most likely it could be taken at any point."

Physical security is a major part of the planning process for ATM operators, but going too far in the opposite direction by putting the ATM in the back of a store means it is less visible for customers, and it won't be used nearly as much. Some operators opt for installing the ATM in the wall of the store itself in an effort to find a happy medium between physical security and visibility/convenience. Unfortunately, in the U.S. particularly, some operators have literally seen thieves drag ATMs out of the walls of buildings with trucks.

"The unfortunate thing is that criminals aren't smart, but they're determined," Talbert said. "They can't get the cash that way — they really can't, it doesn't open up that easily. If it did, then everybody would be doing it. But location, placement and physical security concerns are critical when putting an ATM anywhere you would choose."

Build for successful deployments

The next part of building a secure, successful deployment is building the right team, both internally and externally.

The natural starting point begins with your sales team, followed by deployment and operations, Asher said. "We assign a project manager, so let's start there," he said. "A project manager, a deployments manager, we have a networking expert for the site survey, and then we have customer success. So it's technically four subteams, and the project manager is kind of the coach."

The teams all have to work in harmony while ensuring that integrations work across the installation, including network and power cabling, POS payments, hardware like scanners and printers, and the like. Often, Asher said he will outsource the installation team duties to a third party such as Burroughs. "The project manager coordinates all these pieces," he concluded. "It's like a Lego puzzle," referring to the popular children's brick-building toy brand.

Plan hardware, software, networking

You also have to choose your software and hardware carefully. For example, the Android operating system accounts for about 90% of self-service deployments, followed by Windows, according to Bill Nulf, VP of sales at Microtouch, a self-service OEM firm.

"Grubbrr, we work with them, they're very heavily into the Android space, but they'll do Windows as well," Nulf explained. "Android is a very big focus of ours right now." Further, as a supplier of components to self-service operators and customers, it's important to listen to customers and to observe industry trends beyond operating system software and hardware, down to things like trends in mounting types.

"We work with companies like Grubbrr and even down to the end user as well with [respect to] what kind of environment is it going to be in?" he said.

Planning kiosks and other hardware to account for things like harsh elements in outdoors installations, along with physical security or wear and tear, is vital. Then you have to make sure you have the right government approvals from municipal approval bodies and the like, along with factoring in Internet Service Providers and deciding between wireless and wired networking options.

Many ATMs, for example, use cellular networks, Talbert said; you can't just assume Wi-Fi is going to be available, or that it's going to be reliable when installing ATMs or kiosks.

"Is there a strong enough Wi-Fi signal? You take that for granted sometimes," he said. "The last thing you want to do is have an ATM in place and have someone go and try to use it and they can't get cash — they lose their mind and then they start calling everybody. The poor convenience store clerk can't do anything… Or even at a bank or at a drive-up where someone tries to get money at two o'clock in the morning, but the signal is not strong enough."

And it's not just about networks; you can't simply assume that power will be available at all sites. Sometimes, you'll have to run your own power to the installation site, and you should also plan for the unforeseen, such as unreliable power.

Having backups for network and power, or what is also called "systems redundancy," is key to a successful installation and deployment — and this kind of careful forethought extends to things like regulations.

"In the vending and micro market arena, connectivity is one of the major issues," said Melton the consultant. "Our industry is also regulated a lot, depending on the state that you're in. Some of the states are really tough… and sometimes you'll end up with one legislation that kind of conflicts with another one. So, we sometimes have to navigate that, how to go between the two different places that are regulating us to find something that works."

Still, the panel agreed that connectivity is perhaps the leading headache for operators and customers.

"I would say, from the Esper perspective, one of the toughest situations to solve on behalf of customers is intermittent cellular connectivity," said panel moderator Keith Szot, SVP and chief evangelist at Esper, a device management firm specializing in company-managed hardware. "There is work to be done, I think, by infrastructure providers to figure that out."

It was this very problem that led Grubbrr to design its kiosks to be able to function offline, according to Asher; the company is still developing offline capabilities and rolling them out to installations, but they have made meaningful strides in that direction.

"Our payment integrations like Freedom Pay, Verifone, Fiserv — they all work offline," he said. "The menu stays on, the payments go through, orders go to the kitchen and the customer will not know that the kiosk is down [unconnected to the Internet.] So we have built that in, but it's very limited right now."

Note from the outset that you absolutely have to check your kiosks to make sure they are reconciling after recovering their Internet connection (or rebooting after any outage), the panelists agreed.

"Something to recall is that when it [the kiosk] goes offline, the reconciliation after it comes back online is critical," Talbert said. "Because a lot of times, people think, oh, it comes back and everything updates automatically. No — you've got to go back in and reconcile all of that, or you're going to have misposted payments, misposted debits or credits in [an] ATM where you just take it for granted that it comes back online and it's going to update; it does not."

Additional obstacles discussed by the panel that one should consider in planning and rolling out self-service solutions include the following.

1: People

You have to develop your people skills, for even the most unusual or unexpected personality types and people issues.

"The biggest obstacle you always have first are people," Melton said. "I remember being on a micro market installation and having a guy come up and tell me there was no way he was going to put his real name into the system at all… He thought we were all part of some CIA plan or something like that."

Educating your users is another part of this. Different user groups have different comfort levels with the technologies you are installing, and some will struggle with newer tech. "I think sometimes when we're pioneering these strategies, we forget that some of the people that are being exposed to this — it's a new thing for them," Melton said. "And so, we've tried to develop a little more [into] supporting the end user [using] a little more in-depth training with the end user."

2: Changing consumer behavior.

While he agreed that people can be a top area of friction in deployments, Asher said he finds the top issue to be engineering behavior change in users.

"It's people, yes, but consumer behavior," he said. "We are asking the consumer to change behavior, which is the hardest." He cited examples like the advent of touchscreen smartphones and the QSR industry, which were initially mocked in popular culture before being universally adopted. "So yes, I can have the best tech in the world. The kiosk will always work, or the app will always work, but how do we have the consumer go order that?"

It was a theme also referenced by Manuela Zoninsein in discussing the growth strategy of Kadeya, a renewable beverage vending brand, during another session at the Summit.

3: Working at scale

For Grubbrr, working at a scale not of hundreds but now thousands is another challenge, Asher said; the sheer size of the kiosk fleet makes it tricky to a) proactively find and fix issues before a customer even knows about them on a device, b) push that fix to the entire fleet quickly and reliably. Make sure that you design your hardware and software systems early to support operations and maintenance at scale, whether you have 10 kiosks or 10,000.

Related, make sure you have robust partnerships and good supplier and distributor relationships to help you with potential supply chain issues; the COVID-19 pandemic and war in Europe are two recent examples of supply chain problems that continue to have ripple effects across the industry.

4: Security

From kiosks to ATMs, security is a major focus, and it only grows as your fleet scales; it's not enough to design a user-friendly, easy-to-use app that works across devices. Locking down USB ports is a key example, "because we are at airports, we are in some critical locations," Asher said of Grubbrr's security challenges. "How do we make sure that we don't get hacked? We don't want a data breach. I don't want to see a million-dollar bitcoin screen on our laptops at Grubbrr every day."

Grubbrr has a dedicated internal white-hat hacking team that is constantly trying to hack Grubbrr systems in an effort to find and repair potential vulnerabilities; known as "PEN testing" in IT circles (short for "penetration testing"), this kind of proactive effort can serve you well on both the hardware and software side in protecting yourself and your clients, along with the data of all parties.

Of course, physical security is right up there with software security, particularly with ATMs. Talbert noted that Payment Card Industry compliance and security compliance are vital, along with data encryption.

"In terms of PCI compliance and security compliance regarding PIN-based and encryption between not only the middleware and the PIN-pad but also between the host, anywhere between — because, typically, even though you may just put in your four-digit code and take money out, there are multiple steps that occur after that before it even posts to your account, because it's never a direct connection to the host."

Despite the massive amount of security in the software side, criminal elements still pose problems on the physical security side, Talbert said. "The unfortunate part is, they think that it [security] all resides in the physical hardware piece," he said. "So a lot of times, [criminals attempt] the destruction of the hardware, getting to the hardware device, thinking that's going to give them the cash, and that just doesn't happen. It's much more in depth."

With the advent of better physical security, Talbert noted that current trends are seeing a rise in less physically obvious tactics.

"What we're seeing more and more is point-of-sale skimming — and this is crazy — not only in the ATM device, but point-of-sale devices at the counter, where they will distract the attendant and they will put an overlay right on the device right in front of you, where they have now hooked up and will leave it there for 10, 15, 20 hours, come back, and remove that overlay, take it out, and they've gotten all of the information for any customer that's been at that convenience store using that pen pad for either taking cash back and/or paying for their goods.

"And so, those components — you can be as smart as you want to be, but if it overlays on top of something that you're not expecting, it's really hard to sort of out-think that piece, so the security pieces are non-stop and on all sides," Talbert said. "The hardware part you think is easiest, because you just think, oh, we'll just make these things out of steel, which they do, and we'll put them in places where you can't rip them out of the walls, but they [criminals] are getting more and more smart around the things that we're not thinking about."