ATM Risk Management and Controls - EuroJournals

163 European Journal of Economics, Finance and Administrative Sciences - Issue 21 (2010)
E-money 16,642 18,198 28,115 28,771 29,236 30,198
1 MasterCard, Visa, American Express and Diners Club
2 Domestic PIN-based debit card scheme
n.a Not available
Note: Data is collected on a quarterly basis
Number of Cards/Users of Payment Instruments
as at end of period 2004 2005 2006 2007 2008 2009
'000
Credit card 6,583.0 7,815.5 8,833.0 9,901.3 10,812.4 10,817.6
Charge card 286.3 244.5 272.1 245.6 285.6 285.2
Debit card 1 10,237.2 15,676.7 18,861.4 21,887.3 24,436.6 30,847.6
E-money 34,174.1 44,034.8 46,874.7 53,150.4 61,534.1 68,461.8
Includes international Brand debit card and ATM card
Source: BNM Annual Report (2004 – 2009)* refers to commercial banks only, also excludes Islamic Banks
Frauds at ATMs
Diebold Inco. (2002), indicated that fraud at the ATM although more difficult than at a POS, has
recently become more widespread. Recent occurrences of ATM fraud range from techniques such as
shoulder surfing and card skimming to highly advanced techniques involving software tampering
and/or hardware modifications to divert, or trap the dispensed currency.
Recent Global ATM consumer research indicates that one of the most important issues for
consumers when using an ATM was personal safety and security*. As financial institutions use the
migration of cash transactions to self service terminals as a primary method of increasing branch
efficiencies, the ATM experience must be as safe and accommodating as possible for consumers.
The magazine (1991), published that the UK consumer Association reported a case pf phantom
withdrawals. In 1989, 570 pounds was wrongly deducted from John Allans’ Bank of Scotland account.
A total of 8 cash withdrawals were carried out, three of them when he was away with his card in
Andorra. Complaining to the bank was fruitless and later Mr Allan was going to sue the bank of
Scotland. The day before the case was due to come to court, the bank reached an out –of court
settlement with him. The magazine concludes that this case marks a breakthrough because the bank
acknowledged that money can get debited to a account without the use of the card plus the PIN.
This risk exists in each product and service offered. The level of transaction risk is affected by
the structure of the institution’s processing environment, including the types of services offered and the
complexity of the processes and supporting technology.
ISACA (2007), highlighted that the key to controlling transaction risk lies in adapting effective
polices, procedures, and controls to meet the new risk exposures introduced by e-banking. Basic
internal controls including segregation of duties, dual controls, and reconcilements remain important.
Information security controls, in particular, become more significant requiring additional processes,
tools, expertise, and testing. Institutions should determine the appropriate level of security controls
based on their assessment of the sensitivity of the information to the customer and to the institution and
on the institution’s established risk tolerance level.
There are three basic types of ATM attacks:
• Attempts to steal a customer‘s bank card information;
• Computer and Network attacks against ATM‘s to gather bank card information;
• Physical attacks against the ATM.
THEFT OF CUSTOMER‘S BANK CARD INFORMATION
Card Skimming
Fake ATM machines
Card Trapping/Card Swapping