ATM breach: How to take precautions pre and post debit or credit card use

ATMs or the automated teller machines have often been a platform for many fraudsters to hack away money from the customers’ bank accounts.

Earlier this week, about 40 people who used a Kotak Mahindra Bank ATM in Mulund (East), lost a total of around Rs 14.80 lakh fraudulently withdrawn from their bank accounts in three days from Sunday to Monday.

According to an Indian Express report, the customers got alerts saying their money had been withdrawn through ATMs in Saket in New Delhi and Ghaziabad in Uttar Pradesh. Bank officials, quoted in the report, told the police that the CCTV camera outside the ATM had not been working for the past 15 days and the police suspect the ATM data of the 40 people were stolen after someone put a ‘skimmer’ on the ATM machine.

A skimmer is an electronic reading machine that illegally steals the personal information stored on a magnetic card and records the PIN number or password entered while making a transaction.

Keeping this vulnerability in view, the RBI has asked all banks to completely shift all their debit and credit cards with Europay MasterCard Visa (EMV) chip and PIN based cards, of global standards, by December 31, 2018. These cards offer two-factor authentication that is considered as the most effective counter-measure for card cloning through skimming globally.

As per the Reserve Bank of India (RBI) norms, most banks have to install CCTV cameras in their respective ATM centres while state governments have asked to appoint security guards. The RBI has given the discretionary powers to bank managers to decide whether or not to deploy security guards.

• All debit card holders must change their ATM password/PIN immediately.

• Visit bank branch and check for safety of your money in your bank account.

• In case of any discrepancy or doubt, ask for a fresh new debit card or card replacement or re-carding from your bank manager.

In September last year, about 32 lakh cards used at over 90 ATMs reportedly of Yes Bank operated by a technology firm Hitachi Payment Services were infected with virus/malware in the “Switch” which links the transactions from one bank to the other on the backend server.

A total of 19 banks have suspected data compromise with State Bank of India, ICICI Bank, HDFC Bank, Axis Bank and Yes Bank mostly affected.

Keeping this vulnerability in view, the RBI has asked all banks to completely shift all their debit and credit cards with Europay MasterCard Visa (EMV) chip and PIN based cards, of global standards, by December 31, 2018. These cards offer two-factor authentication that is considered most effective counter-measure for card cloning through skimming globally.

As per the Reserve Bank of India (RBI) norms, most banks have to install CCTV cameras in their respective ATM centres while state governments have asked to appoint security guards. The RBI has given the discretionary powers to bank managers to decide whether or not to deploy security guards.

• Set up app based/SMS/ email alerts for every form of transaction
• Monitor your bank statements regularly
• Report to the bank immediately in case you have lost your cards or you know your credentials for online transactions have been compromised
• Don’t link accounts for automatic transfer of funds
• Don’t have passwords which are easy to guess
• Use a firewall, anti-virus software and update them as prescribed
• Change your ATM Pin and online passwords from time-to-time
• Update your current contact information all the time with your bank
• In case your card gets stuck in the ATM, call your bank immediately
• Sign up for paperless banking so there is lesser chance that other people have access to your financial statements
• Prefer ATMs attached to banks, they tend to have better security checks than others
• Globally, credit cards are more secure and it’s advisable to use them for point-of-sales gateways
• Always destroy your old ATM/ debit cards
• Don’t have all your money in a single account
• Always wait for ‘Welcome’ screen to be displayed after completing transaction
• Never give your card/card details at payment counters. Always get the card swiped in your presence.
• Avoid getting enticed by free offers and do not swipe your cards for availing them.
• For some domestic and international usage of debit cards, use the ON/OFF managing facility provided to you. This is provided by Axis Bank, Kotak Mahindra Bank, and State Bank of India among other banks.

The RBI’s annual report on banking ombudsman released on Tuesday highlighted that ATM/Debit card complaints comprised 16,434 or 12.5 percent of the total complaints received.

Rohit Rao, Spokesperson, Kotak Mahindra Bank said, "We are investigating few instances of unauthorised ATM cash withdrawals from the accounts of our Mulund East branch customers. The issue is restricted to one ATM in Mulund East…Shadow credit is being given immediately to complaints reported by Kotak customers and full credit will be given to them within three working days. As part of our standard compliance procedure, the incident has been reported to the RBI.”

“The ATM PIN has been reset for all affected customers to prevent any further misuse. We are also advising our customers to use the activate/deactivate feature of their debit card through the Kotak Bank mobile app to deactivate their debit card when not in use, which is an enhanced security feature to guard against potential misuse,” Rao added.