Call it a nasty byproduct of the coming rollout of EMV (aka chip-and-PIN) debit cards but the frightening news is that many ATM experts now predict a 2014 explosion in old-fashioned magnetic stripe card fraud at ATMs as criminals enjoy a last robbing frenzy.
“The United States is now the weak point. We are the last major market to convert to EMV cards,” said Mike Urban, a financial crime expert with Brookfield, Wis.-based Fiserv. He ominously added that Canada had a “serious” skimming problem but now that it has largely converted to EMV cards, “those criminals are coming across the border.”
“The U.S. is one of the last bastions for criminals to skim. I think it will be a feeding frenzy,” said John Buzzard, a fraud expert at FICO.
“The future will have reduced ATM fraud,” predicted Cyndie Martini, CEO of Member Access Pacific, which provides card processing services to credit unions. She pointed to the coming of EMV, as well as multiple biometric login technologies, as paths to a more secure tomorrow.
But that’s the future and, as for now, Martini, too, is in the pessimistic camp: “Criminals will probably see this short window (before EMV implementation) as an opportunity to step up mag stripe fraud - but it will be short lived.”
There may be some good news for credit unions amid the gloom – hold on for that – but the key issue today is that criminals, with 20-plus years of experience perpetrating fraud with mag stripe cards, are good at this.
Buzzard, for instance, estimated that a skilled criminal could attach a skimmer to an ATM “in a minute or less.” High-quality skimmers fit snugly and are difficult for any but trained professionals to detect with a quick look.
It only stands to reason that that criminals will put their skills to use before the rollout of EMV debit cards, which most experts see gathering steam in 2015 when liability shifts await non-EMV compliant terminal operators per Visa and MasterCard edicts.
Note however that ATMs have their own later deadlines. Visa’s deadline for ATMs is October 2017. With MasterCard the deadline is 2016.
However, there is some wiggle in those timelines, noted Dean Nolan, a vice president at payments solutions company Saylent. “Another point to consider is that fraud will not be reduced until ATM machines in the US stop accepting mag-stripe cards,” he said. “As it's likely that U.S. ATM acquirers will continue to accept both EMV and mag stripe cards until the majority of U.S.-issued ATM and debit cards are EMV-enabled, it's possible that an actual decline in ATM fraud rates will not occur until sometime later.”
That means criminals may in fact be entering a multi-year thieving binge, said Nolan.
Just when you thought a sense of doom had become pervasive, know that Gary Walston, an executive vice president at Dolphin Debit, which supplies and manages ATMs for many credit unions, is in fact optimistic that credit unions, for the most part, will dodge this bullet.
He said, “We are not expecting a surge in theft. We definitely are not in panic mode.”
Walston’s reasoning: Credit union ATMs, at branches or in sponsor organizations, generally are well protected. “Criminals will seek out the easy targets, the ATMs in the back of retailers,” said Walston.
Many credit union ATMs, said Walston, are under 24/7 video surveillance and at least some machines are equipped with state-of-the-art anti-skimming controls. They also are routinely physically inspected by trained personnel. That makes them tougher targets than many ATMs found in more casual settings.
At Dolphin Debit, Walston acknowledged that “we are taking additional precautions” to keep their ATMs safe. He was taciturn about detailed specifics but did note, “We are increasing the number of physical inspections.”
Sift the predictions and two conclusions emerge: There will almost certainly be a binge of ATM skimming fraud lasting for the next several years but, quite probably, financial institutions that keep their ATMs monitored will escape the worst attacks.