Citibank ATM breach reveals PIN security problems

The ATM Industry Association (ATMIA) (www.atmia.com) would like to address the inaccurate reporting and statements made in your report and by your professed experts.

The ATM Industry in general, and the ATM Personal Identification Number (PIN) in particular, are extremely secure and safe for consumer use. Further, while the Industry works diligently to prevent fraud, a combination of banking laws and network rules ensure that consumers are fully protected from monetary losses that arise through any fraudulent use of their ATM card, PIN, or personal financial information. In the United States, whether consumers opt to use credit or debit cards to access cash at the ATM, Federal Reserve Regulation E ensures that consumers are covered and do not bare the financial burden of fraud.

Since its inception, the ATM Industry has worked diligently to provide a safe and secure way for consumers to conduct financial transactions at the time and place of their choosing. As criminals who would attempt to exploit ATMs have modified their methods over time, the ATM Industry has proactively developed new technologies and safeguards to prevent fraud.

When criminals developed electronic means to attempt to steal PIN numbers several years ago, the Industry reacted by implementing Encrypted PIN Pads (EPP) and Triple DES Encryption (Triple DES). These security enhancements, which instantaneously encrypt PINs within the PIN Pad itself using strong encryption standards, are now mandatory on all ATMs operating in the United States and have effectively eliminated the electronic theft of PINs from the ATM.

As a consequence of TDES and EPP, the criminal element has shifted its focus to: •POS terminals and pay at the pump •Merchant IT systems

I would be more than happy to provide you with a chart constructed by Fair Isaac demonstrating this fact. They provide actual statistics from actual experts that show the dramatic decline in PIN compromise at all ATMs and especially the privately owned or "NonBank" ATM.

Today, criminals attempting to acquire PINs at the ATM are more likely to do so by using physical skimming devices coupled with PIN Pad overlay devices or camera systems to capture card data and PINs. This relatively rare type of fraud is particularly difficult to accomplish with ATMs placed in retail locations – those ATMs are under constant scrutiny by store staff during business hours and are unavailable to would be criminals during non-business hours making it particularly difficult to install and retrieve the equipment required to steal card data and PINs.

However, as the chart will demonstrate, such skimming attacks are much more likely to occur at a POS terminal than an ATM.

Due to the EPP and TDES requirements by the various Networks, PIN based transactions have far less incidences of fraud than signature based transactions and are much harder to compromise than card numbers.

Most of what is commonly reported by the press as "ATM Fraud" is actually PIN Fraud (or Debit Card Fraud). This fraud occurs when criminals obtain counterfeit cards and PINs from skimming of either Point of Sale terminals or databases operated in the retail environment.

In these cases, the ATM is simply used as a means to retrieve cash – it is not the point where the cardholder's card number and PIN were stolen or copied and in no way represents a threat to consumers.

The ATM Industry has proactively developed and initiated security technologies and best practices to cope with ATM crime. The Industry has worked to fight crime through the use of risk assessments, implementation of best practices, formation of joint law enforcement-industry crime fighting groups, hardening of targets, and sharing of fraud monitoring and fraud alert system. In the rare case when ATM fraud does occur, ATM transactions create an electronic audit trail that can provide valuable information in tracking and prosecuting ATM fraud.

It is reasonably estimated that World-wide there are 49 billion cash withdrawals each year at ATMs of which over 14 billion such cash withdrawals are at ATMs located in the United States. The amount of cash withdrawn from ATMs, just in the United States, on an annual basis is several hundred billion dollars. The ATM Industry's estimated fraud losses are considerably less than one-tenth of one percent of cash dispensed at ATMs in the United States. Further, such loss is totally borne by the issuing banks and networks and not by the consumer. The ATMIA acknowledges that any dollar lost to fraudulent activity is undesirable and will continue to cooperate with law enforcement agencies across the globe to fight any and all criminal activities directed at the electronic payment system, of which the ATM is but one of many parts.

About ATMIA
www.atmia.com

The ATM Industry Association is a global non-profit trade association with over 1,050 members in 50 countries. Its mission is to promote ATM convenience, growth and usage worldwide, protect the ATM industry's assets, interests, good name and public trust; and provide education, best practices, political voice and networking opportunities for member organizations. In June 2003, ATMIA established the Global ATM Security Alliance (GASA) (www.globalasa.com) with the mission to employ global security resources in a united alliance in order to protect the ATM industry from criminal activity.