Oct. 15, 2016 7:00 a.m. ET
The ATM is the newest front in the war against cyberthieves.
A year after millions of U.S. merchants began installing equipment at the check-out line to accept credit and debit cards with security chips, the automated teller machine is getting similar technology.
The move comes as thieves increasingly target ATMs. While chip-enabled credit cards are expected to slow growth in fraud at the checkout counter, the number of ATMs compromised by criminals jumped more than sixfold from 2014, according to a recent report from FICO, a credit-score provider and analytics firm. FICO says the number of 2015 compromises was the highest it ever recorded, though it declined to disclose specific numbers.
The burst of ATM-related fraud also was the largest one-year increase since FICO started keeping track of such data about a dozen years ago. Meanwhile, rates of credit-card fraud, a more popular scheme for criminals, have largely leveled off.
The push to make ATMs more secure takes on added significance this month: Under MasterCard Inc.’s network rules, ATM operators on Oct. 21 will become liable for any fraud costs that occur if a MasterCard chip-enabled card is used at a machine that isn’t equipped with chip technology. That cost is currently borne by the card-issuing bank. Visa makes a similar shift next October.
The shift to more secure ATMs is expected to tackle the growing problem known as skimming, by which criminals rig a machine with a surreptitious device that can steal a customer’s card data, often including the personal identification number. The crook can then use the data to make a counterfeit card and drain the associated bank account.
The computer chip embedded in many new U.S. credit and debit cards fights such fraud by creating a one-time code for each transaction, limiting the ability of a thief to steal and replicate data.
“The U.S. market is definitely being targeted with card skimming,” says Owen Wild, global marketing director for enterprise fraud and security at NCR Corp., one of the largest makers of ATMs. Nonbank ATMs account for 60% of recent incidents, up from 39% in 2014, the FICO analysis found.
Cyberthieves make at least 1.5 million illicit ATM cash withdrawals in the U.S. each year, according to consulting firm Tremont Capital Group. That figure represents a tiny fraction of the 5.8 billion ATM withdrawals consumers made in 2013, according to a Federal Reserve estimate.
Still, theft from ATM skimming can be more dangerous to consumers than credit-card fraud because the debit card is tied directly to a consumer’s checking account. Banks will typically reimburse customers for losses, but the process can be complicated
Cost is an issue for ATM operators; It typically costs between $300 and $700 to upgrade an existing ATM to accept chip cards, says Brad Daniel, president at America’s ATM, a Plantation, Fla., company that maintains a fleet of the machines.
Everything ATM, an ATM operator and supplier based in Brooklyn, N.Y., has requested 5,000 upgrade kits from a supplier, but has only received 1,000 so far, says Jim Shrayef, principal at the firm. “I cannot get the product I need to satisfy the demand,” he said.
So far, it appears that ATM operators are better prepared for the transition to chip cards than merchants that have grappled with challenges to get the equipment ready at the check-out line.
In part, that is because many of the nation’s 420,000 ATMs are owned and operated by large financial institutions or independent companies that manage thousands of machines.
MasterCard estimates that 40% of ATMs will be chip-ready by the end of October. That compares with industry estimates that fewer than 20% of merchants were ready to process chip cards when their liability shift took place last year. Millions of smaller merchants—and some big grocery chains—still haven’t upgraded their equipment.
J.P. Morgan Chase & Co. and Bank of America Corp., which operate about 34,000 ATMs between them, say that most of their machines are ready to accept chip cards.
PNC Financial Services Group Inc.’s 9,000 ATMs are already accepting chip cards. “We have been preparing for this for a few years,” says Ken Justice, head of the ATM network at the Pittsburgh bank.
However, many consumers still don’t have chip-enabled debit cards since card-issuing banks initially concentrated on credit cards.
MasterCard says that close to one-third of its branded U.S. debit cards are embedded with chips, well below the 88% of its U.S. consumer credit cards. Visa says that 42% of its branded debit cards have chips, compared with 64% for its credit-card portfolio.
“We’re continuing to see a rise,” in the percentage of debit cards with chips, says Chiro Aikat, senior vice president for chip-card delivery at MasterCard. “But there is no doubt that debit was a laggard.”
Tags: ATM, ATMs, automated teller machine, check-out lines, chip-enabled credit cards, counterfeit credit card, cyberthieves, drug stores, fraud at the checkout counter, grocery stores, J.P. Morgan Chase, MasterCard Inc, more secure ATMs, theft from ATM skimming, U.S. debit cards