It seems frighteningly easy: Wheel a fake automatic-teller machine into a shopping mall and program it to record customers' personal-identification numbers and account numbers when they try using the machine. Then slap together some fake bank cards using the purloined numbers and pillage the customers' accounts. A simple scam, but that's exactly what a group of thieves did a few weeks ago in Connecticut.
So far, bankers say the bandits have made off with a little more than $50,000--small potatoes for a group of banks to absorb. But the ease with which the thieves pulled off the scam suggests that banks have a bigger problem on their hands than they want to acknowledge.
In the past decade, the number of ATMs in use has more than doubled, to 87,330, says the American Bankers Assn. Annual transactions, meanwhile, have more than tripled, to 7.2 billion (chart). Such volume and ubiquity make the cash dispensers increasingly tempting to thieves, putting the bank accounts of millions of customers at risk. "Fraud will continue to rise as the number of ATMs grows and people get more familiar with them," says H. Ray Ellis, a security expert at a major bank. Estimates of losses from ATM fraud vary. The American Bankers Assn. claims that losses are minimal. But Ellis, who has years of experience in the business, contends that big banks are at risk of losing millions of dollars apiece each year.
Bankers claim the vast majority of ATM fraud results from customers' carelessness. Many people write their PIN numbers on the backs of their cards, making them usable by anyone. Thieves also have used binoculars or videocameras to decipher customers' ID numbers. Then they match the PINs with account numbers on discarded receipts.The Connecticut caper, however, shows that a new problem is developing: the easy availability of used ATMs. Just about anyone can buy one through a network of resellers, and they can cost as little as $6,000. Other than the Connecticut heist, experts don't know of any U.S. thefts involving used ATMs. But some want ATMs to be registered to make it harder for thieves to get hold of them. "We all ought to be more vigilant," says Richard Yanak, president of Yankee 24, a Connecticut funds-transfer network.
Growing ATM fraud should be plenty upsetting to card users, since banks are often slow in reimbursing customers who get ripped off. Dr. Robert Lautin, a New York radiologist, found that out when he noticed that his monthly Citibank statement for August, 1990, included several ATM transactions for which he didn't have receipts. Lautin filed a written complaint, but it was more than a year before Citi credited his account for the fraudulent withdrawals and the interest he would have earned. A Citi spokeswoman says the bank does not discuss individual customers as a matter of policy and refused to comment.
RETINA SCANS? Banks and ATM makers, meanwhile, are searching for ways to make ATMs more secure. NCR, a big supplier of ATMs, is exploring using Smart Cards with imbedded microchips and silicon memory to make cards harder to copy. To make the cards foolproof, some companies also are looking into a system that would scan each customer's retina as a means of identification. But health concerns about mass use of a single eye cup have dampened enthusiasm for that technology. Electronic fingerprinting and voice recognition are other possibilities being considered.
High-tech solutions are expensive, and bankers may fear that changing ATM security will alarm customers unnecessarily. Still, for customers victimized by ATM scams, such as the one in Connecticut, setting off alarms now might be late--but worthwhile.