Trashing Those Old ATMs Is Not a Simple Task
The ATM Industry Association wants ATM deployers to exercise more caution when discarding decommissioned ATMs.
"With over 2.2 million ATMs already installed worldwide, a figure forecast to increase to 3 million by 2015, this presents the ATM industry with a challenge on a huge scale. What happens to the thousands of machines which become obsolete each year?" the international association asked in "Best Practices for Decommissioning ATMs," a white paper the association recently prepared on the topic.
The association noted recent media reports about organized criminals trying to obtain discarded ATMs from junkyards in the U.S. Criminals seek this information to both improve their efforts to skim card data from unsuspecting consumers through operations that modify ATMs and efforts to simply hack the machines.
"In many ways this problem has been building for some time, but always under the surface or off the radar," said one government security analyst who declined to give his name because his agency did not allow him to speak for the record. "Both as ATMs began to be able to do more and as they became more hooked into the overall financial system, their profile as possible targets has risen."
The association recommends that deployers like credit unions either completely disable an EPP or simply destroy it outright and that the credit unions not do this on their own but instead outsource the task to a certified firm. This is important, the association said, in order to protect the chain of custody that each EPP has. In other words, guarantee that each EPP has been accounted for from the time it was manufactured, through when it was installed in the ATM, through to when it will be finally destroyed. A certified ATM scrap firm will also make sure that environmental regulations are met, the association wrote.
"This secure data disposal process is essential to the proper decommissioning and disposal of ATMs at the end of their lifecycle," the association wrote. "ATM owners wishing to dispose of ATMs should first ensure that the scrapping company has followed the appropriate certification process and inquire as to how it supports green initiatives. A certified scrapping company will be sure to remove and destroy bank branding. It will also segregate plastics, ferrous metal and cables for the purpose of recycling."