[BreachExchange] National ATM Council announces 2017 Retail ATM Skimming Survey results – Responds to recent FICO clarification

[Destry Winant]

https://www.cuinsight.com/press-release/national-atm-council-announces-2017-retail-atm-skimming-survey-results-responds-recent-fico-clarification

The National ATM Council, Inc. (NAC) has announced the results of its 2017
U.S. Retail ATM Skimming Survey (Survey). Results demonstrate the number of
card skimming incidents at U.S. Independent retail ATM locations remains
very low – with 9 of 10 survey participants reporting never having
encountered a single skimming device on their ATM routes

The Survey was designed to ascertain the current level and nature of card
skimming activity (theft of card/PIN data) at retail ATMs in the U.S.
Respondents to this year’s annual survey included 151 ATM companies
representing a diverse and statistically significant sample of the total
U.S. retail ATM base. A large majority (70%) of the ATM providers
responding to the Survey have operated in the ATM business for over ten
years.

The large majority of respondents (89%) have ATM business protocols that
involve regular checks of their ATM terminals and provide consumers with a
phone number to call in case of any irregularities at the machines (87%).
Four respondents this year reported seeing six or more instances of
skimming activity on their routes, compared with two respondents in 2016 –
a definite year over year increase, but still entailing a minuscule number
of incidents out of the many tens of thousands of ATMs and millions of
transactions covered by the Survey.

“NAC has long anticipated some level of increase in skimming at Independent
ATMs during the transition to EMV chip card technology now underway for all
ATMs in the U.S.,” said Bruce Renard, Executive Director for NAC. “Data we
have seen from other countries indicates increased skimming activity during
this migration period. We are pleased that the vast majority of retail ATMs
in the U.S. has remained free from skimming activity thus far.”

When provided the opportunity for additional comment regarding skimming at
their ATMs, Survey respondents forcefully rejected any suggestion that
retail ATMs constituted a significant target for card skimming. “Each and
every ATM on my route is visually inspected, the customer fascia area
cleaned and test transaction performed. The armored personnel do the same
on their routes,” said one respondent. Another commented, “While other
types of payment terminals have had skimming devices found in our area,
none of the more than 1,200 ATMs that we have ownership or processing
interest in over the last 18 years has ever had a skimming device found on
them.”

The findings of NAC’s 2017 Retail ATM Skimming Survey comport with
clarifications
provided
<http://r20.rs6.net/tn.jsp?f=0015jkWS9mx0H3NoB7k8rtZWgN4ylEg6JdZLraxY-D_6YbjjE6NF2mYN4bEmriPdSH1kQR77dNW2lji4Z1i0Y5y1crhn8oRHFObldOM4Dty5Po1cMM91tr6JuQP3XiG4Kpp16ZYMMxOUbT8cUb5FOvmUd_U-lEexkTPXBn1WlGPrlIpVJ0N2gzxtrTfcziSP_Ns8M-9YmBlwGfSgde4cz7Jgxh1tmN4joTsydIssBrLOKykMVIrzKh47us4ErHv6bAYXO4EKBXkgK-c1DtU6ia6pA==&c=6Y8sFI-uFsrWF_68e4QziUZt7QgCHmCiozfs3X0WOMYd8eR5lEzUsQ==&ch=QBz5X-oii9kfv5-MXYbpP6fKsyqITVJpc-QDgu2nrzK8ltBBAVBAuA==>
by FICO in a recent article regarding the rarity of card data theft at
retail ATMs. “…NAC is right in its claim that the vast majority of ATMs did
not suffer a compromise last year,” stated T.J. Horan, Vice President of
Fraud Solutions for FICO. “A very small percentage of ATMs are compromised
each year.”

“Especially in light of these most recent survey results, NAC appreciates
FICO’s clarification of its recent report on card fraud at retail ATMs,
making clear that the number of actual card skimming incidents for non-bank
ATMs remains very low,” said NAC Board Chair George Sarantopoulos of Access
One Solutions in New York. “NAC was concerned with the way FICO originally
presented its data and with the headlines it generated, giving consumers
the erroneous impression that card skimming was rampant at retail ATMs. We
as ATM operators know firsthand, as confirmed by the latest survey data,
that retail ATMs are one of the safest places to get your cash, and card
skimming at these ATM terminals remains extremely rare.”

NAC Vice-Chair, Patrick Conner of ATMPartMart.com, based in Los Angeles,
commented, “NAC has been unable to reconcile FICO’s recent contentions that
it is not owned by banks. A quick review of NASDAQ’s listing of FICO’s
largest shareholders
<http://r20.rs6.net/tn.jsp?f=0015jkWS9mx0H3NoB7k8rtZWgN4ylEg6JdZLraxY-D_6YbjjE6NF2mYN-69c9AMYbmBedKvTkI73FN19-W-mvBu-lY0PmrzRhcb6pMj5tKWKK19zOef4-wJOZmq5KDO3m2zG3wGVClnFiZ38F7COs9cPT7JW_81t9rg45jgAJUuGk8jDM4CLn4XpRsxnVHXk1BV_Rf4VgzoHUU0upv5pcfgsseguTqSCM1N0s-IExT8fGQ=&c=6Y8sFI-uFsrWF_68e4QziUZt7QgCHmCiozfs3X0WOMYd8eR5lEzUsQ==&ch=QBz5X-oii9kfv5-MXYbpP6fKsyqITVJpc-QDgu2nrzK8ltBBAVBAuA==>
shows that several of the largest U.S. depository institutions, Bank of
N.Y. Mellon Corp., JP Morgan Chase, Bank of America and others are listed
as major shareholders that own large amounts of FICO stock.

“NAC is in full agreement with FICO as to the need for vigilance on the
part of ATM operators, merchants and consumers whenever conducting an ATM
transaction,” Conner continued, “which is why NAC worked with Conexxus to
develop the Skimming Detection and Deterrence – Quick Reference Guide
<http://r20.rs6.net/tn.jsp?f=0015jkWS9mx0H3NoB7k8rtZWgN4ylEg6JdZLraxY-D_6YbjjE6NF2mYN7FMaxIV1D0L_aM7P_M5xXI7Ejp-p3dSpk0TZHu_5cP9VJloy_KFEpRi2Vn15gYtUUr_F5QPHCr209Lw-URs8dqhvZ4XffVD8AF1MfypjG6rxG_-b5s9X1xDMkbsb1MARUtoSymHtAMX5oPQ7oR776AXmttg41Svuw==&c=6Y8sFI-uFsrWF_68e4QziUZt7QgCHmCiozfs3X0WOMYd8eR5lEzUsQ==&ch=QBz5X-oii9kfv5-MXYbpP6fKsyqITVJpc-QDgu2nrzK8ltBBAVBAuA==>
as a general ‘best practices’ field resource for our nation’s convenience
store merchants and ATM operators.”

For consumer safety, security experts agree the best protections against
skimming are to jiggle the card reader and always cover your hand when
entering your PIN.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170511/1c114981/attachment.html>