Friday 13 January 2012

ATM Security Part 1: Physical Access

Criminals attack ATMs on two fronts. One thief sees a big box of money, another sees financial data. In this post, I will be dealing with the security of physical access.

With freestanding ATMs holding as much as $20,000 they make an attractive target for attack. The most common is the "smash and grab", where the attacker removes the entire machine with a truck and rope.



American Special Risk is a company that insures ATMs. Of the 300 claims it covers annually 80% involve the entire machine being removed, with an average payout of $15,000. Thieves trying to open the safe on site will attack with heavy duty tools or explosive gas such as oxy acetylene, normally used as welding fuel. Alternatively, staff with the safe combination can either access the money for themselves, or be coerced through bribery or threat of harm.

Security measures centre around four features: Installation, safe strength, lock strength and recovery. With  ATM prices ranging from $2,000 to $10,000, the standard of protection varies greatly between machines.

Installation
All ATMs are installed with a concrete base. Though secure enough not to be carried off, concrete alone is no match for a powerful truck. A good quality installation will include steel rods on the base of the ATM buried deep into the ground. This has proved successful in countering smash and grab attacks.

Safe Strength
ATM safes come in two flavours: business hours and UL291 Level 1. Business hour safes are relatively weak, designed for when staff are in visual contact with the machine, with the money being stored in a stronger safe overnight. These are typical for smaller retail outlets and bars. Underwriters Laboratory is a testing an certification organisation and their 291 standard certifies an ATM safe to be suitable for 24 hour unsupervised storage. These are considerably stronger and can withstand heavy duty attacks for up to ten minutes, by which time police would likely be on the scene. Good quality installation and safe makes the machine invulnerable to ram raids and only gas attacks have any chance of success.

Lock Strength
No matter how strong your safe, somebody needs to have the code. Entry level ATMs come with simple dial locks. These are largely mechanical and have only one combination, making inside jobs easy and anonymous. More costly electronic locks can be programmed with multiple codes, one for each staff member, as well as duress codes that will open the safe but set of an alarm at a control centre. Top of the line are Cencon locks, designed to operate as part of a wider computerised system of machines with features such as one time access codes for single use by armoured cash replenishers. These are used only by the largest chain outlets and banks.

Recovery
If all fails, dye packs and GPS can be used to render the cash useless and track the thief. However, these have not been as widely adopted as one might expect. Dye packs rely on radio transmitters and magnetic plates to operate, installation costing around $3000 and each pack around $400. GPS devices require a direct line of sight to to a satellite and fail if encased too deep inside the machine or if kept in an enclosed space. While more advanced GPS systems that bypass these problems are on the market, these go for around $2000. Price alone puts both of these systems out of reach of the small business owner.

You get what you pay for. Cheap machines are a low-risk, low reward target for thieves while top of the line systems survived hurricane Katrina. Most owners will settle somewhere inbetween, leaving ATMs a popular choice for the determined, professional criminal.

No comments:

Post a Comment