ATMs may be an easy target for thieves

How cards are cloned
For years, special security codes have been embedded in the magnetic stripes on the back of every ATM card -- secrets that allow the bank to verify the authenticity of the plastic being inserted into ATM machines. But many banks don't bother checking the codes, experts say.  Instead, they rely on correctly-entered PINs to prove the ATM card is authentic.

But with the widespread success of phishing e-mails, which appear to come from banks and sometimes trick consumers into divulging account numbers and PINs, forgers are having an easy time getting the data they need to print up fake ATM cards.

The combination of stolen data and the lapsed security checks allows criminals to raid ATM machines, Litan says. Hackers generally know which banks aren't doing the checking, and call the easy targets "cashable," industry insiders say.

Until recently, most banks believed they didn't need to check the extra security information, because the PIN requirements limited fraud, Hayes said. "Most banks believed it was a very secure mechanism, and they were right," he said. "The level of fraud on ATMs has been historically miniscule."

But in the past twelve months, Hayes said, white card fraud has risen steadily thanks to phishing attacks. Individual bank losses are "in the millions, if not tens of millions," he said.

"This PIN mechanism that has worked so well for 30 years, this is the first time it has been seriously challenged," Hayes said. "It's a global phenomenon."

Because the ATM network operates around the world, withdrawals from a U.S. bank account, for example, are not limited by geography. "You'll see all of the sudden all these transactions coming from Romania. These crooks are incredibly smart," Hayes said.

ATM fraud rates rising
Nessa Feddis, senior federal counsel at the American Bankers Association, said U.S. banks she's spoken to concede there was a problem with white card fraud in the recent past, but say they've largely defeated it. She suggested information in the Gartner report about white card fraud was outdated.

"About a year ago ... they did see some problems with debit cards," Feddis said. "They all now say they do check the security code on magnetic stripes and debit cards losses are significantly down. This study may be based on old data ... They all seem to be verifying the code now and losses are down significantly."

But another financial industry trade group, the Anti-Phishing Working Group, said white card fraud is still a real issue for banks.

"Yes, it's happening," said Dave Jevans, a spokesman for the group, which is sponsored by Visa, Mastercard, and other financial firms, along with a host of software companies. "It stands to reason if you can phish somebody's ATM and PIN you can make an ATM card and make withdrawals if the mag stripe security information is not being checked."

It's hard to peg just how common white card fraud is.  In a separate report published in June, Gartner's Litan estimated that $2.75 billion has been stolen from 3 million bank accounts through various kinds of ATM and debit card fraud in the past 12 months. That report was based on a consumer survey.

Banks are tight-lipped about the problem. But there are signs that ATM fraud has increased around the world.  Last year, the Association of Payment Clearing Services in the United Kingdom announced that counterfeit ATM card fraud had cost the banks $230 million in 2004, up from about $195 million last year. Jemma Smith, a spokeswoman for the association, says UK banks have largely stemmed the tide of counterfeit ATM fraud by introducing new cards that include a computer chip for extra identification.

MORE FROM SECURITY

Security Section Front

Nearly 1 in 3 older teens gets ‘sexting’ messages Australia to block obscene, crime-linked sites After criticism, Facebook tweaks settings again Court reviews employer access to texts NYT: U.S., Russia open talks on cyberwar limits Red Tape: Holiday ‘cyberbegging’ grows on eBay Internet users lured to oppose health bills 5 things to know about Facebook’s new settings Facebook privacy revamp draws fire Facebook gives users more privacy controls Security Section Front   Add Security headlines to your news reader: