ATM Risk Management and Controls - EuroJournals

168 European Journal of Economics, Finance and Administrative Sciences - Issue 21 (2010)
• Retained cards – these ATM cards pose an even greater risk, if they fall into the wrong hands
and are misused.
• Inadequate supervision of embossing of the card.
• Stolen cards not being reported immediately
• Stocks of blank cards could lead to unauthorised cards being issued leading to fraud.
2. Business Process Controls
In general no one person should handle all the transactions. This can be achieved by proper segregation
of duties. Appropriate control should be included during reconciliation, verification of withdrawals and
date/time of transactions was completed.
Application Close supervision is necessary within the embossing department, where control on
card issuance should be rigorous after embossing. Furthermore the envelopes should be issued based
on a predetermined control number. During hours of non-production, the embossing department should
be kept locked. Personnel having access to cards must be denied access to PINs whenever cards are
prepared and processed. There should be two staff in charge of the process in order to have dual
accountability for stock.
Security and Control of PIN (Personal Identification Number)
A PIN is a “personal identification number” . This is a number consisting of four numerical characters
which is essentially a cardholder’s password. PINs can be assigned by the institution or can be
customer selected. PINs which are generated for the customer can be derived from the customer’s
account number and a logarithm used. These PINs are normally stored in an encrypted form at the
ATM. A temporary PIN is issued which can be used at the ATM immediately. Later the customer has
the choice of selecting his own PIN number at the ATM.
Risks/Threats
There are a number of risks involved in the management of PIN numbers:-
1 There is the integrity of the PIN itself. If control and security is not tight, the method of
selecting PIN or encryption keys may become known and duplicated PINs and mailers be
prepared.
2 The PIN mailers are intercepted during mailing.
3 PINs longer than four digits are security hazards, as holders may be tempted to write down their
number to remember them.
4 Issuing replacement PIN numbers to customers. If the person making the request has stolen the
card or is not authorised to use it, the true owner of the card stands to lose a substantial sum of
money.
Application Controls
For controls and security purpose the PIN which is in encrypted form is stored in a database file for
security purposes. The PIN mailers are prepared separately. The PIN is only activated upon the use of
the card by the customer at the ATM.
Adequate control should be carried out when PIN is produced for mailing. Mailing of the PIN
is carried out subsequent to card mailing. The PIN is forwarded to the customer in a separate mailer on
a different day.
For security reasons all systems documentation concerning PIN generation/encryption and
decryption keys must be under tight control at all times. Furthermore, extreme care must be taken when
requests for new PINs are made. It is important for security reasons that the request for a new PIN
should be in writing.