Is that sketchy ATM safe?

Sketchy ATM
Photo by photographia

You probably know the type of ATM that I am talking about — that skinny, stand alone ATM that sits outside of that neighborhood convenience store and looks like you could probably pick it up and take it with you . I walk past one of these every morning, always reaffirming my vow never to use it.

I have always wondered, however, just how safe these ATMs really are. As a general rule, I try to always use my bank’s branch ATM, but sometimes that is not the best strategy. Besides, I have been considering opening a checking account at a bank that refunds ATM fees. So are these non-branch ATMs significantly less safe?

Confirming The Obvious

As if answering my question, CNNMoney.com ran an article last month, following a breach of Citibank ATMs at 7-Eleven stores, entitled “How safe is your ATM?”, where on the issue of the safety of independent and stand-alone ATMs, they note that:

…an ATM’s safety depends on where it is. If it’s at a bank, an ATM is somewhat safer than it is in a public place, such as a ballpark, a train station or a convenience store.

You should never use ATM machines at convenience stores if you can help it because those are much more susceptible to tampering,” added Avivah Litan, a security analyst with the Gartner research firm.

The argument being that bank ATMs are safer since they are usually better protected and are under the watchful eye of trained bank employees. Unfortunately, the CNNMoney article is short on both statistics and on suggestions for protecting yourself. The few suggestions the article offers are:

  • Avoid convenience store ATMs if you can
  • Report any suspicious activity
  • Avoid using your PIN number as much as possible (so select “Credit” when you’re making purchases with your debit card)
  • Change your PIN number regularly
  • Monitor your statements carefully.

Of course, only the first three suggestions really help protect you from compromised ATMs; the other suggestions are simply meant to minimize the damage of being compromised.

The State of the Problem

It is surprisingly hard to find statistics on ATM fraud, however I was able to find this article from BankRate.com in 2003 on ATM skimming. Among the interesting facts:

  • At the time of writing (2003), there were approximately 360,000 ATMs nationwide and only half of them belong to banks.
  • ATMs with swipe readers are more susceptible to being compromised, as opposed to ATMs where you slide in your card.
  • Their additional suggestions include: look at the ATM before using it, don’t use ATMs with unusual signage or language, and contact your bank immediately if your card is not returned

Card skimming — where thieves don’t interrupt your transaction, but rather attach a device that copies your credit card information as you slide it — is unfortunately increasingly common; in fact, the DVD Kiosk service Redbox recently warned customers about potential credit card skimming on its Redbox devices.

I used to think that I could easily identify a card skimmer attached to an ATM, but this page from the University of Texas Police Department (found on Flexo’s post on skimming over at Consumerism Commentary) surprised me with how hard it can be to identify a skimming device. I’ll have to be more careful!

Skimming

If all of this is not scary enough, here is one final story from MSNBC that should drive this all home.

The article tells the story of a Secret Service investigation into a group of thieves that purchased fifty ATMS (remember, half of those ATMs out there aren’t owned by banks!), connected them to the ATM network so that they would function properly, while at the same time storing the information on users. As a result, over 21,000 accounts at 1,400 banks were compromised resulting in losses of almost $4 million. These crooks simply set up their own ATM and let users walk right into the trap. It is such a simple idea — why hack someone else’s ATM, when you can simply put up your own?

While the MSNBC article notes that banks are taking steps to make the system safer, I think its still worth asking — can you really trust that generic looking ATM?