By Walt Williams
ATMs have become lucrative targets for criminals, with the FBI reporting a significant increase in the number of bank ATM robberies beginning in 2020. As one banker noted during a panel discussion on ATM crime at ABA’s Annual Convention last year, it seems many would-be bank robbers have concluded there is less risk — and potentially more profit — in hitting an ATM than a teller window.
“Our adversaries are always watching, and this being a franchise crime, our adversaries learn from one another,” says Mary Gates, president of GMR Security. “So I think it’s really important that we become more proactive and that we learn from their actions and their mistakes.”
ATMs are tempting targets because they can be breached using unsophisticated tools and equipment, such as a pickup truck with chains, Gates says. And while many ATMs are equipped with engineering controls such as bollard gates or barriers, some criminals have figured out ways to compromise those devices.
At the same time, ATMs are sometimes placed in areas that offer low visibility, making criminals more confident that they can carry out their actions undetected, Gates adds. ATM thefts also typically only take a few minutes, and the legal penalties are significantly lighter than robberies carried out inside a bank.
“It’s very low-risk, very high-reward,” Gates says. “And if it’s possible for them to get a substantial amount of money and face a very low penalty, they’re going to focus on the ATM more than they’re going to focus on the branch.”
Crime trends
The FBI reports that the number of bank robberies focusing on ATMs jumped from 31 incidents in 2019 to more than 200 a year later, amid a broader spike in violent crime nationwide. That figure has dropped slightly since then, with the FBI reporting 138 incidents in 2022, according to the most recent data available.
There are steps banks can take to mitigate the crime and better protect their customers. They start by thinking about the physical design of ATM locations, taking into account elements such as lighting and vehicle access to the machines.
Of course, ATM crime involves more than physically breaking into the machines. The credit scoring service provider FICO reported that skimming at bank ATMs rose 103 percent year-over-year in the first half of 2023, with bank ATMs accounting for roughly a third of locations compromised by skimmers — an increase from the 20 percent of compromised locations that banks accounted for in the past. At the same time, law enforcement agencies in states such as California, Texas and Virginia have also reported a rise in incidents in which criminals stalk and rob bank customers after they withdraw money from ATMs, a crime known as “jugging.”
The rise in ATM-related crime has led some banks to rethink their approach to the management of the machines, according to Brian Stephens, senior managing director at management consulting company Teneo. For starters, some of the more proactive institutions are changing how they approach site inspections.
“Historically, there have been some inspection routines, but a lot of those were very much compliance related, especially in those states that have requirements for lighting and landscaping in ATM environments,” Stephens says. Now, he says, banks are going beyond regulatory check-offs to deeper analysis of how lighting and ease of access contribute to a customer’s sense of safety. Those same banks are also doing a better job of keeping an eye out for signs of damage that suggest a machine has been compromised or tampered with, such as damage that suggests the presence of a skimmer.
Banks are going beyond regulatory check-offs to deeper analysis of how lighting and ease of access contribute to a customer’s sense of safety. They are also doing a better job of keeping an eye out for signs of damage that suggest a machine has been compromised or tampered with.
Some banks are also expanding their risk intelligence capabilities, Stephens says. They’re “really getting a good understanding of the current environment where their assets are located, as well as understanding the trends of what the criminals are doing to attack these devices and what’s successful.”
Heat mapping — that is, creating visual representations of where certain crimes are most prevalent — is one form of intelligence gathering that has proven successful in helping banks deter ATM crime. One example cited during the ATM safety panel discussion came from Texas, where banks began tracking ATM crimes in real time through heat mapping. The banks were then to share those heat maps with the FBI and local law enforcement. Gates says she had a similar experience earlier in her career, where the institution she was then working for began tracking cash-out schemes targeting ATMs.
“We figured out a way to deploy assets to our investigators in the field to monitor for the cash-out activity through heat mapping,” she says. Those investigators then turned over their findings to law enforcement, “so that they could go arrest the people who were conducting the activity.”
Security strategy
ATM security begins by conducting a comprehensive risk assessment that evaluates the potential placement and type of machine to be installed, accounting for factors such as geographical area, crime rate and built-in countermeasures such as GPS tracking, surveillance and physical protection of the ATM, Gates says. An assessment should also identify moderate and elevated risk areas to apply effective physical security countermeasures and mitigation strategies. And when choosing ATMs, banks can consider alarm packages that include visible lights, audible noise and strobe light features.
Gates further suggests that banks conduct lighting surveys to determine the adequacy of the lighting covering the ATMs. Effective lighting not only provides increased safety for employees and customers, it also provides better visibility of the ATM, decreasing the likelihood of criminal activity, she says. Also, consider landscaping and construction features that deter hook-and-chain attacks in which criminals use vehicles to pry open ATMs.
All bank employees should be encouraged to report any concerns involving security, including ATM security, Gates says. While branch managers have an immediate responsibility for ATM security at their respective branch locations, security personnel at the corporate level have an inherent responsibility for ATM security, through their regional security councils or threat management teams, she adds.
Another component of ATM safety is consumer education. Many banks include such information on their websites, but Stephens suggests also considering putting at least some of that advice on the machines themselves.
“Some of that can be really simple,” Stephens says. “With today’s interactive screens, just a reminder: ‘Cover up your pin.’ Don’t leave that out for people to see. Make them aware of ‘see something, say something.’ I think a lot of banks are doing a much better job of including how to contact them right there on the machine so [customers] don’t have to figure it out or call the wrong number.”
Stephens further recommends that banks keep their ATM security strategy written down. And once that plan is in place, it shouldn’t sit on a shelf collecting dust. “As the threat environment changes, so should your policies and procedures associated with addressing those,” he says.
