Hardware

ATM security: Best practices for independent operators

Veteran ATM operators outlined safety and security measures, including having sufficient insurance, protecting physical assets, reconciling cash, meeting new PCI standards and more during the Amusement Expo International show.

Phil Webb, Mike Guthrie, Mark Cumming and Jonathan Dunn brainstorm ATM security issues at the Amusement Expo International show in Las Vegas.

April 5, 2023 by Elliot Maras — Editor, Kiosk Marketplace & Vending Times

With crime rising nationwide, ATM operators need to be vigilant to protect their assets. At the same time, new Payment Card Industry standards require operators to update their payment equipment to prevent fraudulent transactions. These were just some of the issues confronting today's ATM industry explored during a session, "Best Practices for Securing Your ATM Equipment and Funds," at last week's Amusement Expo International show at the Westgate Hotel in Las Vegas.

The well attended session, moderated by Bret Clostermery, president and owner of Modern Gaming Co. LLC in Madison, Wisconsin, began with an overview of the insurance coverages needed for ATMs.

Panelist Phil Webb, president of PDQ Merchant Enterprises Inc., a McHenry, Illinois-based ATM operator, said building insurance will cover cash in the building and in the safe.

Liability insurance will cover loss if an ATM is robbed or if cash is lost in transit. During COVID, Webb updated his liability policy to cover the cash threshold in each specific location. "On a monthly basis we update that list," he said.

It is also important to read the fine print in the policies, Webb said. An insurance company may require an ATM to be bolted to the floor or have surveillance cameras and alarms to cover it.

"You need to let your insurance company know how much money is going to be in the ATM," said panelist Michael Guthrie, vice president of sales at Spokane, Washington-based Cypress Advantage, which operates ATMs along the West Coast. Some ATMs in cannabis-related locations go through $50,000 to $75,000 per week, he said.

Liability insurance will also cover losses from someone getting hurt by an ATM.

"You have to secure yourself for any kind of lawsuit that could come your way," said Guthrie. He cited an instance where an ATM fell on a security guard who was pushing the machine back and forth.

Panelist Mark Cumming, owner of ATM Merchant Services, a Friendswood, Texas-based ATM provider, said he uses bolts in his ATMs that drive into the cement. The company uses TPI washers and TPI indoor and outdoor sleeves that go on the outside of the machine to provide extra security for the ATM. He recommended using half-inch bolts and driving them a minimum four inches deep in the ground.

"When we go into a new location, we're looking for alarm systems, we're looking for motion detectors," Cumming said. In some locations, he covers the cost of security around the ATM, while in others, the location covers the cost.

Cash reconciliation

On the topic of reconciling cash in the machine, the panelists agreed it is important to reconcile cash on a daily basis. They shared some stories about losing money from failing to reconcile the cash.

Webb said there is cash in the bank, cash in the safe, cash in the ATM and cash in the vehicles that need to be reconciled as part of a cash reconciliation report.

"If you're not reconciling on a regular basis your own ATMs you're doing yourself a huge disservice," Guthrie said.

"We do day reports every time we're out at an ATM," agreed Cumming, who requires route drivers to turn in their receipts daily. "It does throw our balances off because we're doing day reports, but we have cradle-to-grave tracking of all of our money. Mistakes happen.

"Make sure you're doing your reports if you're doing cash loading for other people … because the less information they give you it makes it harder for you to reconcile," he said. "If I'm going to cash load for Mike, I would require copies of the settlement setup reports before I put my money in a machine. It's not that I don't trust Mike (Guthrie), but it's my money."

"We require documentation for everything we do," Guthrie said with regards to ATM-related deposits. "We require the documentation so that everybody's protected."

PCI compliance

Panelist Jonathan Dunn, a service technician at Venco Business Solutions Inc. based in Bland, Virginia, offered a status report on PCI keypad compliance.

Dunn passed out a summary that noted the PCI standards help ensure that data is transferred securely though the ATM ecosystem.

He said Jan. 1, 2025 is the credit card networks' deadline for phase 3 "key blocks."

(Key blocks protect the secrecy integrity of an encrypted key, according to a document provided by Geobridge, an Ashburn, Virginia-based company that supports encryption, cryptography and payment applications to payment processors, issuers, terminal manufacturers and merchants.)

Failure to implement phase 3 (TR-31) key blocks can leave an ATM vulnerable to hacker attacks and compromise customer payment data, according to Venco Business Solutions.

The ATM networks (Visa and Mastercard) will be able to assess penalties on the independent sales organization, the company that acts as an intermediary between merchants and the acquiring banks that accept the payment from credit card transactions, and force non-compliant ATMs to shut down.

ATMs will require a software update prior to Jan. 1, 2025 and may, based on the age of the software, require ATM replacement or replacement of the electronic PIN pad.

Equipment supply chain issues

Upgrading payment equipment is complicated to some extent by supply chain issues, the panelists agreed.

"Do I want to upgrade, or do I want to throw it away?'" Webb said posing a question to his listeners. As an operator, he said he would start upgrading 10% of his ATMs every month.

"There are some supplies, but you need brackets, and sometimes they have brackets but they don't have wiring; sometimes they have harnesses but they don't have keypads … you're going to need the bracket, the keypad and the harness," he said. "It's going to be a challenge … do it as often and early as possible so you're not caught behind the eight ball."

Guthrie agreed there are supply chain issues and said by 2025 many ATMs could go dark because they don't have updated keypads.

Cumming said he has advised his ATM operator customers to get ahead of the curve, but many are assuming there will be extensions to the upgrade deadline.

"The way I've explained this to my customers is: look, right now the processors speak in English, and Jan. 1, they're going to speak Spanish and you're ATM's not going to work, so don't treat this as if it's a joke. Get ahead of it, because if you don't, your ATM's going down, and it's going to give somebody else an opportunity to get in there, and we all know how that works out," he said.

Guthrie noted that when you replace a keypad, you get a 90-day warranty, whereas when you buy a new ATM you have a two-year warranty on the full piece of equipment.

"I think you get a bigger bang for your buck," he said, by spending $1,900 or $2,100 and replacing the full machine versus spending $600 for a keypad.

Dynamic currency conversion

Dynamic currency conversion, a point-of-sale payment option that allows cardholders from abroad the option to pay in their own currency, is yet another issue ATM operators need to think about.

DCC is a merchant-provided service that lets customers see their foreign credit card transactions in their home currency at the point of sale, according to Investopedia. With DCC, the customer is still subject to foreign transaction fees levied by their credit card in addition to the processor's foreign transaction fee.

For the customer, the benefit of DCC is the currency exchange rate is locked in. The disadvantage is that the markup is unknown, transaction fees apply and the foreign exchange fee may be higher.

DCC is optional for the customer, and they have the right to decline it.

"If you have DCC conversion turned on you're actually going to upcharge that client a percentage on that transaction," Guthrie said. "Most of the time the processor takes a piece of that for making that conversion happen on your behalf."

Cumming pointed out that Visa and Mastercard fine ATM operators for not following their DCC rules when offering customers the choice to use DCC. He received a notice from one of the card networks advising that DCC would be suspended for terminals not operating certain ATM software versions. The notice said the DCC would be reinstated upon validation that the software was updated to a compliant version.

Cumming said he is aware of cases where ATM operators got fined $20,000 for not abiding by the card networks' DCC rules.

"If you're going to enable DCC, you need to know exactly what Visa or Mastercard require, and the transaction cannot lead a person to make a 'yes' or 'no' choice," Cumming said. "If you're going to take the risk to make the money, make sure that you know what you need."

Photo: Networld Media Group.