ATM Risk Management and Controls - EuroJournals

164 European Journal of Economics, Finance and Administrative Sciences - Issue 21 (2010)
Distraction theft or ‘manual’ skimming
Shoulder Surfing
Leaving transaction ‘Live’
Cash trapping
COMPUTER AND NETWORK ATTACKS
Network attacks against ATMs
Viruses and malicious software
Phishing
PIN cash-out attacks
Utilizing a Fake PIN pad overlay
PIN Interception
PHYSICAL ATM ATTACKS
Ram Raid Attacks
Theft of ATMs
Smash and Grab of ATMs
Safe cutting/Safe Breaking
Explosive Attacks
The other most common cash dispenser fraud has become known as the "Lebanese loop"
because criminals of Lebanese origin apparently first used it. This has many variations but usually
involves the cash machine being tampered with so that your card is not returned to you and is then
removed by the criminals: alternatively if you get your card back a device has recorded the details of
your magnetic stripe. The crooks have also captured your PIN number though some variation of
shoulder surfing. It is this problem that has led to banks putting posters and other warnings on ATMs
advising customers to visually inspect the machine to see if it has been altered or tampered with.
Types of Errors
So far the ATMs have been the most widely spread application of electronic banking. There are various
types of errors which can occur due to mechanical failure at the ATM terminal leading to the following
problems:-
• ATM dispenses less cash to the customer but the account is debited correctly.
• The customer’s account is debited twice but the cash is only dispensed once by the ATM.
• The customer’s account is debited but the cash is not dispensed by the ATM.
Normally errors can occur at any time, even when the ATM accepts cash and cheques deposits.
There have also been cases of phantom withdrawals and the card-holder denying being responsible for
those cash withdrawals, although the computer records showed that a genuine transaction had taken
place.
Reputational Risks
This is considerably heightened for banks using the Internet. For example the Internet allows for the
rapid dissemination of information which means that any incident, either good or bad, is common
knowledge within a short space of time. The speed of the Internet considerably cuts the optimal
response times for both banks and regulators to any incident.
Any problems encountered by one firm in this new environment may affect the business of
another, as it may affect confidence in the Internet as a whole. There is therefore a risk that one rogue
e-bank could cause significant problems for all banks providing services via the Internet. This is a new
type of systemic risk and is causing concern to e-banking providers. Overall, the Internet puts an
emphasis on reputational risks. Banks need to be sure those customers’ rights and information needs
are adequately safeguarded and provided for.