New Trends, Threats to Hit Credit Union ATMs

ATM security was a hot topic in 2018, and for good reason – unrelenting theft threats, rapidly-changing technology and shifting member demands were just a few of the major trends that influenced the sector over the last 12 months. Here are five of the year’s biggest stories in ATM security, plus a few predictions from the experts about what 2019 may have in store.

EMV-Ready – Or Not

In its 2018 EMV Migration Survey, the ATM Industry Association reported that 91% of U.S. ATMs were EMV-capable and 86% actively accepted chip transactions, which was a significant spike from an estimated 19% at the beginning of 2016 and 58% at the beginning of 2017.

But there was an open secret in the industry in 2018: Many credit unions still hadn’t finished – or perhaps not even started – issuing EMV cards.

Fee Fury

More consumers than ever said they would do just about anything to dodge ATM fees, which may have put more pressure on credit unions and other financial institutions to join or create fee-free ATM networks, according to data from Maynard, Mass.-based Mercator Advisory Group.

Its survey of 3,001 U.S. adults found that in 2017, 77% of U.S. consumers do whatever they can to avoid paying ATM fees. That was the highest level since 2011 and 2012 and was up seven percentage points from 70% in 2016.

Smarter ATMs

Consumers felt better about the EMV chip cards in their wallets in 2018, but they were also clamoring for ATMs that could do more with those cards than dispense cash and belch out balances, according to a Fiserv study of household finances. That survey found that more than a third of people (37%) were interested in cardless ATM withdrawals, and 35% wished they could transfer funds from one ATM to another for someone else to pick up.

Few consumers may have had cardless cash access in 2018, but that didn’t stop the industry from looking ahead. Bitcoin ATMs continued to spread, for one thing, and ATM advertising technology evolved. One thing the credit union industry still clung to in 2018: The mag stripe.

The Final Countdown

The ticking of the clock got louder when it came to the looming end to support for a Windows operating system that powered many ATMs in 2018 – adding to a series of ATM-related deadlines that credit unions have had to deal with in recent years. Pros warned credit unions to start getting ready because Microsoft’s planned death of technical assistance and automatic updates for Windows 7 meant that credit union ATMs that don’t move to Windows 10 before 2020 could become more vulnerable to hackers and malware.

Skimming/Shimming. Skimming, shimming and jackpotting kept the industry scrambling to detect bad actors and mitigate risks in 2018. FICO data showed a 10% jump in the number of debit cards compromised at U.S. ATMs and merchant readers, and the number of compromises at ATMs and on devices rose 8%. Both hit all-time highs. And in August, the FBI warned ATM operators about a potential threat involving breaching ATM operating software.

One of the many efforts to stay ahead of criminals was the “Skim Reaper,” developed by researchers at the University of Florida, which could make it much easier to spot skimming devices on ATMs, gas pumps or other payment terminals.

What Will 2019 Bring?

Here are four things ATM experts said could happen in the credit union world this year when it comes to ATM security.

Fraud attempts will grow. Criminals will be on the prowl in 2019 for ATMs that don’t accept EMV chip cards – fertile ground for the already-active world of skimming, according to CO-OP Financial Services ATM Senior Product Manager Terry Pierce. In addition, shimmers, which are next-level devices that typically attempt to read information transmitted from EMV chips, will test credit unions on their ATM fallback practices and authorization limits, Pierce said.

Physical deterrents such as ink-staining technology will keep some criminals at bay, but new information-sharing tactics are also on the horizon for 2019, added Mike Lee, CEO of the ATM Industry Association.

“ATMIA has just developed a risk register, which identifies criminal technologies and methods of attacks being used in other sectors and channels, and assesses the risks of those technologies and methods migrating to the ATM channel to enable the industry to become proactive in anticipating future attacks,” Lee explained.

ATM operating system hacking will tantalize more criminals. Many ATM operating systems are migrating to the cloud, and more criminals are looking there for ways to steal. It beats having to stand in front of an ATM at midnight trying to make withdrawals with stolen PINs and a stack of fake cards, Pierce said.

After all, that’s a lot of work for the thieves, she noted. “Now it’s more infiltration of networks and actually getting big dollars as opposed to here and there, and trying to have the mules going through the different cards to withdraw cash,” she explained.

Cardless cash will get real traction. Getting cash out of an ATM without inserting a physical card will become more common in 2019, pros predicted.

“The wider adoption of cardless ATM transactions will be a major security boost because the mobile phone will eventually become the main medium for transacting at ATMs in place of cards, and this paradigm shift will wipe out skimming attacks on cards at ATMs,” Lee said. “This will benefit consumers by bypassing the threat of their cards being skimmed.”

The use of QR codes and the pinless nature of cardless cash transactions can leave bad actors without an opportunity to compromise card numbers or pins, Pierce added.

Fewer credit unions will own their ATMs. Running an ATM network is hard work, and it’s only getting harder. In 2019, fewer credit unions will likely count ATM operation as a core competency; more credit unions will probably hire or partner with someone else to get the job done, especially with regard to security, Pierce said.

“It’s becoming so challenging because, one, you have to have the right expertise to even understand what all these things mean,” Pierce explained. “Then, two, to execute it. That’s probably why we’re going to start seeing that growth in [credit unions] outsourcing to someone else – still serve their members in some capacity, for an ATM channel, but not having to have the headache for it.”

She added, “It used to be that it was smaller credit unions that didn’t have the expertise and money to buy machines and so forth. What they were doing is doing co-branding with the ISOs [independent sales organizations]. Now we’re starting to see larger credit unions that are moving in that direction.”