Guard Your ATMs 24/7 Banks Told

Good old-fashioned physical security is the key to preventing technology-enabled crimes like the “skimming hack” on Banco De Oro last month, ICT experts say.  It was emphasized that automated teller machines (ATMs) will continue to be targeted by tech-savvy bandits until banks find a way to keep these scammers away from their cash-dispensing equipment.

The Internet Society –Philippines Chapter (ISOC.PH) said that local banks’ on-line security systems are generally sound and are often sufficient to repel external hacks. ISOC.PH chairman Winthrop Yu said the Achilles’ heel in the system is that many ATM machines are not guarded round-the-clock and are therefore vulnerable to being physically hijacked by skimming hackers. He explained that the latest ATM card cloner can be inserted into the machine’s card slot in much the same way as any ATM card. Once the cloning apparatus is in place, any ATM card that passes through the slot can be copied and consequently, the depositor’s account can be cleaned-out, he added.

Yu further said that most banks’ solution to this problem seems to be to hasten the migration to ATM cards using the modern Europay, MasterCard, and Visa (EMV) Chip, which are supposedly clone-proof. The Bangko Sentral ng Pilipinas (BSP) had earlier ordered banks to replace old ATM cards with those containing this latest technology by 2017, but gave a one-year extension after it became clear that most large banks could not make the deadline. Still, Yu is not convinced that the more sophisticated cards can put a stop to skimming hacks altogether. 

“The skimming syndicates are at the cutting edge of technology while bank managements are only trying to catch up,” he explained. He said that the newest card cloning devices are most likely able to read and copy the information contained in ATM cards with the newer EMV technology. “This kind of equipment can probably be ordered from China for the right price,” he added. 

Yu said that all local banks should jointly adopt new protocols that will provide enhanced monitoring of ATMs, especially those in dimly lit corners, as well as regular check-ups on the internals of all machines. He warned that the skimming syndicates are not composed of youthful hackers as often portrayed in cinema but rather they are part of sophisticated criminal enterprises, often with cross-border reach.

Meantime, banks are reportedly scrambling to make the transition to EMV card technology because it is still regarded as the best defense against skimming hacks. Banking industry insiders said that smaller and medium sized banks seem to be outpacing large banks in the transition to EMV card technology simply because they have less ATM cards to replace.

Philippine Veterans Bank’s vice president for corporate communications Miguel Villa-Real said they already have in their possession all the EMV chips needed to complete the technology migration. He explained that most if not all payroll accounts, which comprises a big chunk of the bank’s depositor base, have already made the transition to EMV. “We are just waiting for our other depositors to turn-in their old Magnetic Stripe cards and claim their new EMV cards,” he said. Villa-Real however added that there seems to be hesitation on the part of some depositors to turn-in their old cards because they do not want to be troubled to take a trip to the bank upon which they will be asked to fill-out some forms.     ---Mister