14 DAY TRIAL // The methods used for stealing card details straight from automated teller machines (ATM) continue to evolve as NCR Corporation, a global manufacturer of ATMs, warns of a variation of an older type of attack that has been confirmed at machines in several regions.
Collecting card data from these machines is an old practice that affects through-the-wall systems, which are considered safer because they are less exposed. However, ATM fraudsters resorted to gaining forced access to reach their goal.
The endeavor consisted in drilling holes in the ATM large enough to allow hooking a data-intercepting device to the card reader in the machine. Traces of tampering would then be covered up with a sticker or something that would not raise suspicion.
New attack leaves no trace on the outside
In the new variation of the attack discovered by NCR, fraudsters target free-standing ATMs, such as those placed in retail locations. Access to the inside card reader is done by opening the top box of the machine by picking the locks.
Compromising ATMs this way leaves no evidence of intrusion from the outside and the data collection device could remain unnoticed by bank employees filling the money cassettes or by service personnel, who generally inspect the systems for tampering signs on the external fascia.
According to NCR, attacks have been observed on Personas ATMs in the United Arab Emirates and Europe.
While most freestanding cash machines are located in places with great visibility, thus discouraging any tampering attempts, some of them are present in less trafficked areas with video surveillance.
The alert from NCR does not provide information on how fraudsters managed to install the eavesdropping devices, but they could pose as service personnel or target more secluded machines where individuals accessing them are caught on camera. Video recordings are generally watched only when an incident occurs, allowing the attack to go undetected, at least for a while.