An
automated teller machine (
ATM)
or the
automatic banking machine
(
ABM) is a computerized telecommunications device
that provides the
clients of a
financial institution with access to
financial transactions in a
public space without the need for a cashier, human clerk or
bank teller. On most modern ATMs, the
customer is identified by inserting a plastic
ATM card with a
magnetic
stripe or a plastic
smartcard with a
chip, that contains a unique card
number and some security information, such as an expiration date or
CVVC (CVV). Authentication is
provided by the customer entering a
personal identification
number (PIN).
Using an ATM, customers can access their bank
accounts in order to make
cash
withdrawals (or
credit card cash
advances) and check their account balances as well as purchasing
mobile cell phone prepaid credit.
ATMs are known by various other names
including automated transaction machine, automated
banking machine, cashpoint (in Britain), money
machine, bank machine, cash machine,
hole-in-the-wall, cashpoint, Bancomat
(in various countries in Europe and Russia), Multibanco (after a registered trade mark,
in Portugal
), and
Any Time Money (in India
).
History
.
There is some controversy over who invented the ATM. A review of
papers submitted to atmmachine.com can be found on their website.
http://www.atmmachine.com/atm-inventor.html
The first
mechanical cash dispenser was developed and built by Luther George Simjian and installed in
1939 in New York
City
, USA by the City Bank of New
York, but removed after 6 months due to the lack of customer
acceptance.
Thereafter, the history of ATMs paused for
over 25 years, until De La Rue developed
the first electronic ATM, which was installed first in Enfield Town
in North
London
, United
Kingdom
on 27 June 1967 by Barclays Bank. This instance of the
invention is credited to
John Shepherd-Barron, although various
other engineers were awarded patents for related technologies at
the time. Shepherd-Barron was awarded an
OBE in the 2005
New Year's Honours List.
The first
person to use the machine was the British
variety
artist and actor Reg Varney. The
first ATMs accepted only a single-use token or voucher, which was
retained by the machine. These worked on various principles
including
radiation and low-coercivity
magnetism that was wiped by the card
reader to make fraud more difficult. The machine dispensed
pre-packaged envelopes containing ten
pounds sterling. The idea of a PIN stored on
the card was developed by the British engineer
James Goodfellow in 1965 and he patented
the ATM as we know it around this time.
In 1968
the networked ATM was pioneered in Dallas
, Texas, by
Donald Wetzel who was a department
head at an automated baggage-handling company called
Docutel. In 1995 the Smithsonian's National Museum of
American History recognised Docutel and Wetzel as the inventors of
the networked ATM.
ATMs first came into wide UK use in 1973; the IBM 2984 was designed
at the request of
Lloyds Bank. The 2984
CIT (Cash Issuing Terminal) was the first true Cashpoint, similar
in function to today's machines; Cashpoint is still a
registered trademark of Lloyds TSB in
the U.K. All were online and issued a variable amount which was
immediately deducted from the account. A small number of 2984s were
supplied to a US bank. Notable historical models of ATMs include
the
IBM 3624 and
473x series,
Diebold
10xx and
TABS 9000 series, and
NCR 50xx series.
Location
ATMs are placed not only near or inside the premises of banks, but
also in locations such as shopping centers/malls, airports, grocery
stores, petrol/gas stations, restaurants, or any place large
numbers of people may gather. These represent two types of ATM
installations: on and off premise. On premise ATMs are typically
more advanced, multi-function machines that complement an actual
bank branch's capabilities and thus more expensive. Off premise
machines are deployed by financial institutions and also ISOs (or
Independent Sales Organizations) where there is usually just a
straight need for cash, so they typically are the cheaper
mono-function devices. In Canada, when an ATM is not operated by a
financial institution it is known as a
"White Label ATM".
In North America, banks often have
drive-thru lanes providing access to ATMs.
Many ATMs have a sign above them indicating the name of the bank or
organization owning the ATM, and possibly including the list of ATM
networks to which that machine is connected. This type of sign is
called a
topper.
Financial networks
Most ATMs are connected to
interbank
networks, enabling people to withdraw and deposit money from
machines not belonging to the bank where they have their account or
in the country where their accounts are held (enabling cash
withdrawals in local currency). Some examples of interbank networks
include
PULSE,
PLUS,
Cirrus,
Interac, Interswitch,
STAR, and
LINK.
ATMs rely on
authorization of a
financial transaction by the
card issuer or other authorizing institution via the communications
network. This is often performed through an
ISO
8583 messaging system.
Many banks charge
ATM usage fees. In
some cases, these fees are charged solely to users who are not
customers of the bank where the ATM is installed; in other cases,
they apply to all users. Where machines make a charge some people
will not use them, but go to a system without fees.
In order to allow a more diverse range of devices to attach to
their networks, some interbank networks have passed rules expanding
the definition of an ATM to be a terminal that either has the vault
within its footprint or utilizes the vault or cash drawer within
the merchant establishment, which allows for the use of a
scrip cash dispenser.
ATMs typically connect directly to their
ATM
Controller via either a dial-up
modem over
a
telephone line or directly via a leased
line. Leased lines are preferable to
POTS lines because they require
less time to establish a connection. Leased lines may be
comparatively expensive to operate versus a POTS line, meaning
less-trafficked machines will usually rely on a dial-up modem. That
dilemma may be solved as high-speed Internet
VPN
connections become more ubiquitous. Common lower-level layer
communication protocols used by ATMs to communicate back to the
bank include
SNA over
SDLC,
TC500 over
Async,
X.25,
and
TCP/IP over
Ethernet.
In addition to methods employed for transaction security and
secrecy, all communications traffic between the ATM and the
Transaction Processor may also be encrypted via methods such as
SSL.
Global use
There are no hard international or government-compiled numbers
totaling the complete number of ATMs in use worldwide. Estimates
developed by
ATMIA place the number of ATMs in
use at over 1.5 million .
For the purpose of analyzing ATM usage around the world, financial
institutions generally divide the world into seven regions, due to
the penetration rates, usage statistics, and features deployed.
Four regions (USA, Canada, Europe, and Japan) have high numbers of
ATMs per million people and generally slowing growth rates. Despite
the large number of ATMs, there is additional demand for machines
in the Asia/Pacific area as well as in Latin America. ATMs have yet
to reach high numbers in the Near East/Africa.
The world's most
northerly
installed ATM is located at Longyearbyen
, Svalbard
, Norway
.
The world's most southerly
installed ATM is located at McMurdo Station
, Antarctica
.
While
India claims to have the world's
highest installed ATM at Nathu La Pass
, India
installed by
the Union Bank of India
at 4310 meters, there are higher ATM´s installed in Nagchu County
, Tibet at 4500 meters by Agricultural Bank of China .
While ATMs are ubiquitous on modern
cruise
ships, ATMs can also be found on some
US
Navy ships.
In the
United
Kingdom
, an ATM may be colloqually referred to as a
"Cashpoint", named after the Lloyds Bank ATM brand, or
"hole-in-the-wall", an expression after which the equivalent
Barclays brand was later named.
In
Scotland
the term Cashline has
become a generic term for an ATM, based on the branding from the
Royal Bank of
Scotland.
In the
Republic of
Ireland
, ATMs are also commonly referred to as a "Banklink", named after the Allied Irish Bank brand of machines.
Hardware

A block diagram of an ATM
An ATM is typically made up of the following devices:
- CPU (to control the user interface and
transaction devices)
- Magnetic and/or Chip card reader (to identify the customer)
- PIN Pad (similar
in layout to a Touch tone or Calculator keypad), often manufactured as part of
a secure enclosure.
- Secure cryptoprocessor,
generally within a secure enclosure.
- Display (used by the customer for performing the
transaction)
- Function key buttons (usually close
to the display) or a Touchscreen (used
to select the various aspects of the transaction)
- Record Printer (to provide the customer with a record of their
transaction)
- Vault (to store the parts of the
machinery requiring restricted access)
- Housing (for aesthetics and to attach signage to)
Recently, due to heavier computing demands and the falling price of
computer-like architectures, ATMs have moved away from custom
hardware architectures using
microcontrollers and/or
application-specific
integrated circuits to adopting the hardware architecture of a
personal computer, such as, USB
connections for peripherals, ethernet and IP communications, and
use Microsoft Windows operating systems. Although it is undoubtedly
cheaper to use
commercial
off-the-shelf hardware, it does make ATMs potentially
vulnerable to the same sort of problems exhibited by conventional
computers.
Business owners often lease ATM terminals from ATM service
providers.
The vault of an ATM is within the footprint of the device itself
and is where items of value are kept.
Scrip cash dispensers do not
incorporate a vault.
Mechanisms found inside the vault may include:
- Dispensing mechanism (to provide cash or
other items of value)
- Deposit mechanism, including a Cheque Processing Module and
Bulk Note Acceptor (to allow the customer to make deposits)
- Security sensors (Magnetic, Thermal, Seismic, gas)
- Locks: (to ensure controlled access to the contents of the
vault)
- Journaling systems; many are electronic (a sealed flash memory
device based on proprietary standards) or a solid-state device (an
actual printer) which accrues all records of activity, including
access timestamps, number of bills dispensed, etc. - This is
considered sensitive data and is secured in similar fashion to the
cash as it is a similar liability.
ATM vaults are supplied by manufacturers in several grades. Factors
influencing vault grade selection include cost, weight, regulatory
requirements, ATM type, operator risk avoidance practices, and
internal volume requirements.
Industry standard vault configurations include
Underwriters Laboratories UL-291 "Business Hours" and Level 1 Safes,
RAL TL-30 derivatives, and
CEN EN 1143-1:2005 - CEN III/VdS and CEN
IV/LGAI/VdS.
ATM manufacturers recommend that vaults be attached to the floor to
prevent theft.
Software
With the migration to commodity PC hardware, standard commercial
"off-the-shelf" operating systems and programming environments can
be used inside of ATMs. Typical platforms previously used in ATM
development include
RMX or
OS/2. Today the vast majority of ATMs worldwide use a
Microsoft OS, primarily
Windows XP Professional or
Windows XP Embedded, a small number of
deployments may still be running older versions such as
Windows NT,
Windows CE
or
Windows 2000. Notably,
Vista was not widely adopted in ATMs, and as at
October 2009 no bank has announced a
Windows
7 deployment.
Java,
Linux and
Unix may also be used in
these environments, but such deployments are rare.
Linux is also finding some reception in the
ATM marketplace.
An example of this is Banrisul, the largest bank in the south of Brazil
, which has
replaced the MS-DOS operating systems in its
ATMs with Linux. Banco do
Brasil is also migrating ATMs to Linux.
Common application layer transaction protocols, such as
Diebold 911 or 912,
IBM PBM, and
NCR NDC or NDC+ provide
emulation of older generations of
hardware on newer platforms with incremental extensions made over
time to address new capabilities, although companies like NCR
continuously improve these protocols issuing newer versions (latest
NCR Aptra Advance NDC Version 3.x.y (Where x.y are subversions).
Most major ATM manufacturers provide software packages that
implement these protocols. Newer protocols such as
IFX have yet to find wide
acceptance by transaction processors.
With the move to a more standardized software base, financial
institutions have been increasingly interested in the ability to
pick and choose the application programs that drive their
equipment.
WOSA/XFS, now known as
CEN XFS , provides a common
API
for accessing and manipulating the various devices of an ATM.
J/XFS is a Java implementation of the CEN XFS
API.
While the perceived benefit of XFS is similar to the Java's
"Write once, run anywhere"
mantra, often different ATM hardware vendors have different
interpretations of the XFS standard. The result of these
differences in interpretation means that ATM applications typically
use a
middleware to even out the
differences between various platforms.
With the onset of Windows operating systems and XFS on ATM's, the
software applications have the ability to become more intelligent.
This has created a new breed of ATM applications commonly referred
to as programmable applications. These types of applications allows
for an entirely new host of applications in which the ATM terminal
can do more than only communicate with the ATM switch. It is now
empowered to connected to other content servers and
video banking systems.
Notable ATM software that operates on XFS platforms include Triton
PRISM,
Diebold Agilis,
CR2
BankWorld,
KAL Kalignite,
NCR
Corporation Aptra Edge,
Phoenix Interactive VISTAatm, and
Wincor Nixdorf Protopas.
With the move of ATMs to industry-standard computing environments,
concern has risen about the integrity of the ATM's software
stack.
Security

A Triton brand ATM with a dip style
card reader and a triple DES keypad
Security, as it relates to ATMs, has
several dimensions. ATMs also provide a practical demonstration of
a number of security systems and concepts operating together and
how various security concerns are dealt with.
Physical
Early ATM security focused on making the ATMs invulnerable to
physical attack; they were effectively safes with dispenser
mechanisms. A number of attacks on ATMs resulted, with thieves
attempting to steal entire ATMs by
ram-raiding. Since late 1990s, criminal groups
operating in Japan improved ram-raiding by stealing and using a
truck loaded with a heavy construction machinery to effectively
demolish or uproot an entire ATM and any housing to steal its
cash.
Another attack method,
plofkraak, is to
seal all openings of the ATM with
silicone
and fill the vault with a combustible gas or to place an explosive
inside, attached, or near the ATM. This gas or explosive is ignited
and the vault is opened or distorted by the force of the resulting
explosion and the criminals can break in.
Modern ATM physical security, per other modern money-handling
security, concentrates on denying the use of the money inside the
machine to a thief, by means of techniques such as
dye markers and
smoke
canisters.
A common method is to simply rob the staff filling the machine with
money. To avoid this, the schedule for filling them is kept secret,
varying and random. The money is often kept in cassettes, which
will dye the money if incorrectly opened.
Transactional secrecy and integrity
The security of ATM transactions relies mostly on the integrity of
the secure cryptoprocessor: the ATM often uses commodity components
that are not considered to be "
trusted
systems".
Encryption of personal information, required by law in many
jurisdictions, is used to prevent fraud. Sensitive data in ATM
transactions are usually
encrypted with
DES, but transaction
processors now usually require the use of
Triple DES. Remote Key Loading techniques may be
used to ensure the secrecy of the initialization of the encryption
keys in the ATM.
Message
Authentication Code (MAC) or
Partial
MAC may also be used to ensure messages have not been tampered
with while in transit between the ATM and the financial
network.
Customer identity integrity
There have also been a number of incidents of fraud by
Man-in-the-middle attacks, where
criminals have attached fake keypads or card readers to existing
machines. These have then been used to record customers' PINs and
bank card information in order to gain unauthorized access to their
accounts. Various ATM manufacturers have put in place
countermeasures to protect the equipment they manufacture from
these threats.
Alternate methods to verify cardholder identities have been tested
and deployed in some countries, such as finger and palm vein
patterns,
iris, and
facial recognition technologies. However,
recently, cheaper mass production equipment has been developed and
being installed in machines globally that detect the presence of
foreign objects on the front of ATMs, current tests have shown 99%
detection success for all types of
skimming devices.
Device operation integrity

ATMs that are exposed to the elements
must be vandal and weather resistant.
Openings on the customer-side of ATMs are often covered by
mechanical shutters to prevent tampering with the mechanisms when
they are not in use. Alarm sensors are placed inside the ATM and in
ATM servicing areas to alert their operators when doors have been
opened by unauthorized personnel.
Rules are usually set by the government or ATM operating body that
dictate what happens when integrity systems fail. Depending on the
jurisdiction, a bank may or may not be liable when an attempt is
made to dispense a customer's money from an ATM and the money
either gets outside of the ATM's vault, or was exposed in a
non-secure fashion, or they are unable to determine the state of
the money after a failed transaction. Bank customers often complain
that banks have made it difficult to recover money lost in this
way, but this is often complicated by the bank's own internal
policies regarding suspicious activities typical of the criminal
element.
Customer security
In some countries, multiple
security
cameras and
security guards are a
common feature.
In the United States
, The NY State Comptroller's Office has criticized
the NY State Department of Banking for not following through on
safety inspections of ATMs in high crime areas.
Critics of ATM operators assert that the issue of customer security
appears to have been abandoned by the banking industry; it has been
suggested that efforts are now more concentrated on deterrent
legislation than on solving the problem of forced
withdrawals.
At least as far back as July 30, 1986, critics of the industry have
called for the adoption of an emergency PIN system for ATMs, where
the user is able to send a
silent alarm
in response to a threat.
Legislative efforts to require an emergency
PIN system have appeared in Illinois
, Kansas
and Georgia
, but none have succeeded as of yet.In
January 2009, Senate Bill 1355 was proposed in the Illinois Senate
that revisits the issue of the reverse emergency PIN system. The
bill is again resisted by the banking lobby and supported by the
police.In 1998 three towns outside of Cleveland Ohio, in response
to an ATM crime wave, adopted ATM Consumer Security Legislation
requiring that a 9-1-1 switch be installed at all outside ATMs
within their jurisdiction. Since the passing of these laws 11 years
ago, there have been no repeat crimes. In the wake of an ATM Murder
in Sharon Hill, Pennsylvania, The City Council of Sharon Hill
passed an ATM Consumer Security Bill as well, with the same result.
As of July 2009, ATM Consumer Security Legislation is currently
pending in New York, New Jersey, and Washington D.C.In China, many
efforts to promote security have been made. On-premises ATMs are
often located inside the bank's lobby which may be accessible 24
hours a day. These lobbies have extensive CCTV coverage, an
emergency telephone and a security guard on the premises. Bank
lobbies that aren't guarded 24 hours a day may also have secure
doors that can only be opened from outside by swiping your bank
card against a wall-mounted scanner, allowing the bank to identify
who enters the building. Most ATMs will also display on-screen
safety warnings and may also be fitted with convex mirrors above
the display allowing the user to see what is happening behind
them.
Alternative uses
Although ATMs were originally developed as just cash dispensers,
they have evolved to include many other bank-related functions. In
some countries, especially those which benefit from a fully
integrated cross-bank ATM network (e.g.:
Multibanco in Portugal), ATMs include many
functions which are not directly related to the management of one's
own bank account, such as:
- Deposit currency recognition, acceptance, and recycling
- Paying routine bills, fees, and taxes (utilities, phone bills,
social security, legal fees, taxes, etc.)
- Printing bank statements
- Updating passbooks
- Loading monetary value into stored
value cards
- Purchasing
- Games and promotional features
- Donating to charities
- Cheque Processing Module
- Adding pre-paid cell phone
credit.
Increasingly banks are seeking to use the ATM as a sales device to
deliver pre approved loans and targeted advertising using products
such as ITM (the Intelligent Teller Machine) from CR2 or Aptra
Relate from NCR.ATMs can also act as an advertising channel for
companies to advertise their own products or third-party products
and services.
In Canada, ATMs are called
guichets automatiques in
French and sometimes "Bank Machines"
in English. The
Interac shared cash network
does not allow for the selling of goods from ATMs due to specific
security requirements for PIN entry when buying goods. CIBC
machines in Canada, are able to top-up the minutes on certain pay
as you go phones.
Manufacturers have demonstrated and have deployed several different
technologies on ATMs that have not yet reached worldwide
acceptance, such as:
- Biometrics, where authorization of
transactions is based on the scanning of a customer's fingerprint,
iris, face, etc. Biometrics on ATMs can be found in Asia.
- Cheque/Cash Acceptance, where the ATM accepts and recognise
cheques and/or currency without using envelopes Expected to grow in
importance in the US through Check 21
legislation.
- Bar code scanning
- On-demand printing of "items of value" (such as movie tickets,
traveler's cheques, etc.)
- Dispensing additional media (such as phone cards)
- Co-ordination of ATMs with mobile phones
- Customer-specific advertising
- Integration with non-banking equipment
Reliability
Before an ATM is placed in a public place, it typically has
undergone extensive testing with both
test
money and the
backend computer systems
that allow it to perform transactions. Banking customers also have
come to expect high reliability in their ATMs, which provides
incentives to ATM providers to minimize machine and network
failures. Financial consequences of incorrect machine operation
also provide high degrees of incentive to minimize
malfunctions.
ATMs and the supporting electronic financial networks are generally
very reliable, with industry benchmarks typically producing 98.25%
customer availability for ATMs and up to 99.999% availability for
host systems. If ATMs do go out of service, customers could be left
without the ability to make transactions until the beginning of
their bank's next time of opening hours.
This said, not all errors are to the detriment of customers; there
have been cases of machines giving out money without debiting the
account, or giving out higher value notes as a result of incorrect
denomination of
banknote being loaded in the money cassettes.
Errors that can occur may be
mechanical
(such as card transport mechanisms; keypads; hard disk failures);
software (such as
operating system;
device driver;
application);
communications; or purely down to
operator error.
To aid in reliability, some ATMs print each transaction to a roll
paper journal that is stored inside the ATM, which allows both the
users of the ATMs and the related financial institutions to settle
things based on the records in the journal in case there is a
dispute. In some cases, transactions are posted to an electronic
journal to remove the cost of supplying journal paper to the ATM
and for more convenient searching of data.
Improper money checking can cause the possibility of a customer
receiving
counterfeit banknotes from an
ATM.
While bank personnel are generally trained
better at spotting and removing counterfeit cash, the resulting ATM
money supplies used by banks provide no absolute guarantee for
proper banknotes, as the Federal
Criminal Police Office of Germany
has confirmed that there are regularly incidents of
false banknotes having been dispensed through bank ATMs.
Some ATMs may be stocked and wholly owned by outside companies,
which can further complicate this problem.
Bill validation technology can be used by ATM
providers to help ensure the authenticity of the cash before it is
stocked in an ATM; ATMs that have cash recycling capabilities
include this capability.
Fraud
As with any device containing objects of value, ATMs and the
systems they depend on to function are the targets of fraud. Fraud
against ATMs and people's attempts to use them takes several
forms.
The first
known instance of a fake ATM was installed at a shopping mall in
Manchester,
Connecticut
in 1993. By modifying the inner workings of
a
Fujitsu model
7020 ATM, a criminal gang known as The
Bucklands Boys were able to steal information from cards inserted
into the machine by customers.
In some cases, bank fraud could occur at ATMs whereby the bank
accidentally stocks the ATM with bills in the wrong denomination,
therefore giving the customer more money than should be dispensed.
The result of receiving too much money may be influenced on the
card holder agreement in place between the customer and the
bank.
In a
variation of this, WAVY-TV
reported an incident in Virginia Beach of September
2006 where a hacker who had probably obtained a factory-default
admin password for a gas station's white label ATM caused the unit
to assume it was loaded with $5 USD bills instead of $20s, enabling
himself—and many subsequent customers—to walk away with four times
the money they said they wanted to withdraw. This type of
scam was featured on the TV series
The
Real Hustle.
ATM behavior can change during what is called "stand-in" time,
where the bank's cash dispensing network is unable to access
databases that contain account information (possibly for database
maintenance). In order to give customers access to cash, customers
may be allowed to withdraw cash up to a certain amount that may be
less than their usual daily withdrawal limit, but may still exceed
the amount of available money in their account, which could result
in fraud.
Card fraud

ATM lineup

180 px
In an attempt to prevent criminals from
shoulder surfing the
customer's
PINs, some banks draw privacy areas
on the floor.
For a low-tech form of fraud, the easiest is to simply steal a
customer's card. A later variant of this approach is to trap the
card inside of the ATM's card reader with a device often referred
to as a
Lebanese loop. When the
customer gets frustrated by not getting the card back and walks
away from the machine, the criminal is able to remove the card and
withdraw cash from the customer's account.
Another simple form of fraud involves attempting to get the
customer's bank to issue a new card and stealing it from their
mail.

Some ATMs may put up warning messages
to customers to not use them when it detects possible
tampering
The concept and various methods of copying the contents of an ATM
card's magnetic stripe on to a duplicate card to access other
people's financial information was well known in the hacking
communities by late 1990.
In 1996 Andrew Stone, a computer security consultant from Hampshire
in the UK, was convicted of stealing more than £1 million (at
the time equivalent to US$1.6 million) by pointing high definition
video cameras at ATMs from a considerable distance, and by
recording the card numbers, expiry dates, etc. from the embossed
detail on the ATM cards along with video footage of the PINs being
entered. After getting all the information from the videotapes, he
was able to produce clone cards which not only allowed him to
withdraw the full daily limit for each account, but also allowed
him to sidestep withdrawal limits by using multiple copied cards.
In court, it was shown that he could withdraw as much as £10,000
per hour by using this method. Stone was sentenced to five years
and six months in prison.
By contrast, a newer high-tech
modus
operandi involves the installation of a magnetic card
reader over the real ATM's card slot and the use of a wireless
surveillance camera or a modified digital camera to observe the
user's PIN. Card data is then cloned onto a second card and the
criminal attempts a standard cash withdrawal. The availability of
low-cost commodity wireless cameras and card readers has made it a
relatively simple form of fraud, with comparatively low risk to the
fraudsters.
In an attempt to stop these practices, countermeasures against
card cloning have been developed by the
banking industry, in particular by the use of
smart cards which cannot easily be copied or
spoofed by un-authenticated devices, and by attempting to make the
outside of their ATMs
tamper evident.
Older chip-card security systems include the French
Carte Bleue,
Visa Cash,
Mondex,
Blue from American Express and
EMV '96 or EMV 3.11. The most actively
developed form of smart card security in the industry today is
known as
EMV 2000 or EMV 4.x.
EMV is widely used in the UK (
Chip and PIN) and other parts of Europe, but
when it is not available in a specific area, ATMs must fallback to
using the easy to copy magnetic stripe to perform transactions.
This fallback behaviour can be exploited. However the fallback
option has been removed by several UK banks, meaning if the chip is
not read, the transaction will be declined.
In February 2009, a group of criminals used counterfeit ATM cards
to steal $9 million from 130 ATMs in 49 cities around the world all
within a time period of 30 minutes.
Card cloning and
skimming can be detected by the
implementation of magnetic card reader heads and firmware that can
read a signature embedded in all magnetic stripes during the card
production process. This signature known as a "MagnePrint" or
"BluPrint" can be used in conjunction with common two factor
authentication schemes utilized in ATM, debit/retail point-of-sale
and prepaid card applications.
Related devices
A
Talking ATM is a type of ATM that
provides audible instructions so that persons who cannot read an
ATM screen can independently use the machine. All audible
information is delivered privately through a standard
headphone jack on the face of the machine.
Alternatively, some banks such as the
Nordea
and
Swedbank use a built-in external
speaker which may be invoked by pressing the talk button on the
keypad. Information is delivered to the customer either through
pre-recorded
sound files or via text-to-speech
speech synthesis.
A postal
interactive kiosk may
also share many of the same components as an ATM (including a
vault), but only dispenses items relating to postage.
A
scrip cash dispenser may
share many of the same components as an ATM, but lacks the ability
to dispense physical cash and consequently requires no vault.
Instead, the customer requests a withdrawal transaction from the
machine, which prints a receipt. The customer then takes this
receipt to a nearby sales clerk, who then exchanges it for cash
from the till.
A
Teller Assist Unit may also
share many of the same components as an ATM (including a vault),
but they are distinct in that they are designed to be operated
solely by trained personnel and not the general public, they do not
integrate directly into interbank networks, and are usually
controlled by a computer that is not directly integrated into the
overall construction of the unit.
See also
References
- Automated Transaction Machine, US patent 6,945,457
- Inventor of the Week: Luther George Simjian
MIT
- Wetzel recognized by Docutel and Smithsonian
- Eicon Networks Develops SSL-VPN For Secure Remote
Working IT Observer
- Number of ATMs worldwide expected to hit 1.5
million in December www.atmmarketplace.com article
- Statistics -> ABM Stats Interac website
- Statistics on payment and settlement systems in selected
countries - Figures for 2004 Bank for International
Settlements
- Central bank payment system information Bank for International
Settlements
- Assessing payments systems in Latin America
The
Economist Intelligence Unit Limited
- Bank for International
Settlements, Penelope Hawkins
- Mastercard.com
ATM locator
- Antarctica Sun Times - Online U.S.
Antarctic Program December 15, 1996 newsletter
- [1] April 2007
- [http://en.tibet.cn/news/tin/t20071228_292098.htm>
- [2]
- Navy/Marine Cash - Next Generation ATMs-at-Sea
Rolls Out United States
Department of the Treasury website
- BBC World Service - Learning English
- ATMDepot.com questions and answers
www.atmdepot.com
- "Automated Teller Systems - UL 291"
Underwriters Laboratories
website
- "NCR Personas 75 Technical Specification"
NCR
website
- "CEN On-line catalogue - ICS: 13.310 Protection against
crime" Comité Européen de
Normalisation
- Item Summary British Standards
Institution
- "Messaging standard to give multiple channels a
common language"
- J/XFS
homepage
- "Windows Cash-Machine Worm Generates Concern"
www.technewsworld.com, Jay Lyman, 12/09/03
- "An end to ram raids?"
- "STAT-USA Market Research Reports - ATM Thefts"
US Economics and Statistics
Administration report summary via Industry Canada
- "Security" TraceTag UK
- "Getting Triple DES compliant"
www.atmmarketplace.com
- "The No. 1 ATM security concern"
www.atmmarketplace.com
- a Diebold report via
Credit Union National
Association
- "Japan Seeks To Standardize Biometric ID Method For
ATMs" International Biometric
Industry Association
- "Cards: Biometrics Stalled Amid The Hype"
International Biometric Industry
Association
- "Consumer Complaint Board: Banks also responsible
for the success of ATM withdrawals abroad" Kuluttajavirasto
(Finnish Consumer Agency
& Ombudsman)
- "New reasons to guard your ATM card" Christian Science Monitor via
MSN
- "Text of the ATM Safety Act" State of New York
Banking Department
- DiNapoli Calls for Better Oversight of Bank
ATMs
- "Consultants Call for Increased ATM Security
Measures" www.atmmarketplace.com, Jane Blake, 4 December
2000
- "Politics (not) as usual, with ATMIA's help"
www.atmmarketplace.com, John McGill, 7 September 2004
- See comments of Representative Mario Biaggi, Congressional
Record, July 30, 1986, Page 18232 et seq.
- "ATM Report" Illinois Department of Financial and Professional
Regulation
- "CU t-t News - 2/16/04" Credit Union National
Association
- "06 LC 34 0466 - Senate Bill 379 PRE-FILE
Georgia General Assembly
-
http://www.ilga.gov/legislation/BillStatus.asp?DocNum=1355&GAID=10&DocTypeID=SB&LegId=42570&SessionID=76&GA=96
-
http://www.pjstar.com/news/x1745367387/ATM-software-aimed-at-reversing-crime
- Rising interest rates, gas prices hit vault-cash
providers
- NCR and Fujitsu Develop Cash Deposit and Bill
Recycling Module for ATMs Fujitsu
- * Fastloans * CRM at the ATM Bank puts the 'fun' into 'funds' BBC article about Ogaki Kyoritsu
Bank ATMs]
- "Indonesians make ATM sacrifices" Bank puts the 'fun' into
'funds' BBC article about
purchasing livestock for the poor in Indonesia
- Bank puts the 'fun' into 'funds'
- "Consumers' FAQ, IDP Point 4" Interac
- Japan Post to go with fingerprints for ATMs
The Japan
Times
- "Place your hand on the scanner" Web Japan
- Sensar has its eye on the prize with $42 million
Japanese deal American City Business
Journals
- Higher Sales, Lower Costs, Better
Experience—Self-Service Promises It All BAI
- The Check is not in the Mail—Banking in Brazil
Accurapid
- Japanese bank to allow cellphone ATM access
Engadget
- Welcome to Wincor Nixdorf Wincor Nixdorf
- Automated Gas Pumping Station and ATM MCF547x
ColdFire Freescale
- Gaming and casino solutions: QuickJack
NRT
Technology
- Barking Up the Wrong Tree – Factors Influencing
Customer Satisfaction in Retail Banking in the UK - Page 5
International Management
Journals
- "ATM gives out free cash and lands family in
court" Guardian Unlimited
- NCR publication
- BoC program gives merchants upper hand on
counterfeiters Ottawa Business Journal
- The Bank of Canada offers a range of free materials
that explain the security features in genuine bills.
Bank of
Canada
- Blüten aus dem Geldautomat? Stern.de report of
2004-05-05 (in German)
- Welcome to Wincor Nixdorf Wincor Nixdorf website
describing Cash Recycling
- The Bucklands Boys and Other Tales of the
ATM
- Double money in cash point error BBC
- Client Agreement – Client Card and Personal
Identification Number Royal Bank of Canada Client Card
Cardholder Agreement
- "Mad rush to faulty ATM in France"
BBC report about a cash machine
not being stocked correctly
- "ATM turns $5s into $20s" CNN/WAVY
report, 9/14/06, about a hacked ATM at a gas station
- Ibid, mirrored on YouTube
- Kennison v Daire [1986] HCA 4; (1986) 160 CLR 129 (20
February 1986) Australasian Legal Information Institute
- Fun with Automatic Tellers Phrack Magazine
Volume One, Issue Eight
- "Automatic Teller Machine Cards" Phrack Magazine,
Phrack Classic Volume Three, Issue 32
- Seeking after the truth in computer evidence: any
proof of ATM fraud? Oxford Journals ITNOW
- Snopes.com Snopes
- What the Hell Do Smart Cards Do? Fast
Company
- Four more held in fake credit card racket case
The Hindu
- Debit Card Cloning Ring Nets $9 Million in ATM
Heist, ABC News, February 5, 2009
- http://www.magneprint.com/
- http://veritechsecurity.com/default.aspx
- Postal Service Mailing Kiosks now in every
state United States Postal Service
news release
- Automated Postal Centers PostalReporter.com news report
- What is Scrip ATM Merchant Payment Services,
Inc.
Books
- Brain, Marshall Marshall Brain's More How Stuff Works,
John Wiley and Sons Ltd, New York, October 2002, ISBN
0-7645-6711-X
- Donley, Richard Everything has its price, Fireside
Books /Simon & Schuster, New Jersey, March 1995, ISBN
0-671-89559-1
- Guile, Bruce R., Quinn, James Brian Managing Innovation
Cases from the Services Industries, National Academy Press,
Washington (D.C.), January 1988, ISBN 0-309-03926-6
- Hillier, David Money Transmission and the Payments
Market, Financial World Publishing, Kent UK, January 2002,
ISBN 0-85297-643-7
- IESNA Committee Lighting for Automatic Teller
Machines, Illuminating Engineering Society of North America,
January 1997, ISBN 0-87995-122-2
- Ikenson, Ben Patents: Ingenious Inventions How They Work
and How They Came to Be, Gina Black Dog & Leventhal
Publishers, Inc., April 2004, ISBN 1-57912-367-8
- Mcall, Susan Resolution of Banking Disputes, Sweet
& Maxwell, Ltd., December 1990, ISBN 0-85121-644-7
- Peterson, Kirk Automated Teller Machine as a National Bank
under the Federal Law, William S. Hein & Co., Inc., August
1987, ISBN 0-89941-587-3
- Zotti, Ed Triumph of the Straight Dope, Random House,
February 1999, ISBN 0-345-42008-X
- The Fraudsters - How Con Artists Steal Your
Money (ISBN 978-1-903582-82-4)by Eamon Dillon, published
September 2008 by Merlin Publishing
External links