Please enable JavaScript to view the comments powered by Disqus.

We use cookies on our website to give you the best online experience. Please know that if you continue to browse on our site, you agree to this use. You can always block or disable cookies using your browser settings. To find out more, please review our privacy policy.

About


Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.

Comment Standards:
Comments are moderated and will not appear until the moderator has approved them.

Please submit appropriate comments. Inappropriate comments include content that is abusive, harassing, or threatening; obscene, vulgar, or profane; an attack of a personal nature; or overtly political.

In addition, no off-topic remarks or spam is permitted.

December 13, 2021

Casinos as Technology Innovators

We don't normally think of payments and gambling casinos together, but a recent trip reminded me how the casino industry has adapted technology in a number of different ways to improve their operations and how some of those innovations have found their way to the banking industry. In October my wife and I took a road trip to see the leaf changes and found ourselves in Cherokee, North Carolina, whose economy is dominated by a casino. The greatest number of options for dining in the town were in the casino's food court, so we parked and went inside. While this casino did not have the variety of high-end shops and celebrity chef restaurants found in Las Vegas, it did have a lot of the technology that's evident in those Las Vegas casinos, including lots and lots of rows of slot machines and table games.

Over the years, I have noticed the significant changes that have taken place in casinos with regards to coin handling and slot machine technology. For one, coins have been almost eliminated for both inserting into the slot machines and payouts. Now, if you hit a payout and press the collect button, instead of hearing the loud clang, clang noise of coins hitting the tray, you hear an electronic version of coins being dispensed and then the whirring of a paper voucher being printed out. This change has largely been motivated by the expectation of substantial cost savings from reduced coin handling and storage, as well as transportation expenses.

Another major change in casinos has been the transition from mechanical to electronic in all aspects of casino games. Much to my dismay, it is almost impossible today to find a slot machine with a handle that you pull to start the reels rolling. Now, you press a "spin" button to start the game. I am willing to bet the casino operators have found that eliminating the pull handle increased the number of plays per minute as well as eliminated the breakdown of mechanical parts, for additional revenue and reduced operational expense. Winner, winner, chicken dinner. Anyone who has visited a casino in the last 10 or so years knows that the mechanical reel slot machines have long disappeared and been replaced with electronic video displays, whether those show a hand of cards or symbols you are trying to match.

ATMs have long been present in casinos as a means for customers to get extra cash—with surcharges often as high as $10—but these single-purpose machines have been replaced by multifunction kiosks. The virtual teller machines you often now see in banking offices are an evolution of the casino kiosks. Not only can these casino kiosks perform account withdrawals like an ATM, but they can also redeem those winning paper vouchers down to the penny, break large denomination bills to smaller denominations, and provide dining locations and other guest information.

You can see another technological innovation with table games. Recently, some casino table games—including craps, blackjack, and roulette—have started using virtual dealers. Players sit around the table and place bets electronically from their "stack" of virtual chips while the holographic dealer operates the game. Based on my observations, casino patrons still seem to prefer the games staffed by real people.

Of course, casinos were one of the early users of facial recognition technology to spot individuals who have been banned for cheating or for some other reason. And you'll see the high-definition surveillance cameras everywhere, watching employees as well as patrons, monitoring possible cheating activities, and looking for situations of possible customer conflict.

Incidentally, while I was researching the changes that have occurred in casinos, I came across a paper Adobe PDF file formatOff-site link written by my colleagues at the Federal Reserve Bank of Richmond back in 2005. Although the paper is more than a decade old, it still provides an excellent overview of the technology and coin/currency operational changes that have taken place in casinos.

November 22, 2021

We Are Thankful For…

Two years ago, prior to Thanksgiving, I asked each Risk Forum member to provide me the one thing they were thankful for in payments. This year, I posed a bit of a different question to my colleagues and asked them what payment innovation they are most thankful for. Without further ado, the Risk Forum presents our 2021 Thanksgiving week "What payment innovation are you thankful for?" list.

  • Nancy Donahue, project manager: I'm thankful for innovation in voices contributing to payments because it's through these different and diverse viewpoints that the industry develops solutions that are inclusive of all consumers!
  • Claire Greene, payments risk expert: I am thankful for the electronic receipt of bills and automatic bill pay. As a payments expert who doesn't want to think about her personal payments, I remember the monthly stack of envelopes on my dining room table.
  • Scarlett Heinbuch, payments risk expert: I am thankful for the innovation of dongles and payments apps that make it easy for small businesses and individual sellers to accept credit card payments.
  • Douglas King, payments risk expert: I am thankful for innovation in payroll that makes my payday afternoons more flexible through the ability to receive my paycheck via direct deposit. Prior to direct deposit, I distinctly remember receiving a check at my job and then heading to a bank only to wait in a long teller line on Friday afternoons with others to deposit our paychecks.
  • Dave Lott, payments risk expert: I am thankful for the ability to make contactless payments with my debit card at stores and gas pumps as it is much faster.
  • Sally Martin, senior business analyst: I am also very thankful to be able to schedule payments electronically, either once or as many times as I want out to infinity. Keeps me honest and doesn't allow me to rob Peter to pay Paul as easily. Also, I don't have to think about doing it every month when the due date comes along.
  • Catherine Thaliath, project management expert: I am thankful for digital wallets that make it convenient to store my credit cards, boarding passes, concert tickets, loyalty cards, etc., all in one place!
  • Jessica Washington, payments risk expert: I am thankful for mobile deposit capture. When I do get lucky enough for someone to give me money (outside employer) and it is a check (whah, whah) I love that I can pop that moolah into my account right after I open the mail or birthday card.

And we are thankful for YOU, our readers of Take On Payments and supporters of the Risk Forum. We sincerely appreciate your comments, kudos, and criticism, and hope that you all find value in the information we provide and share. As we enter into these crazy last weeks of 2021, we wish you and yours a wonderful holiday season.

September 7, 2021

Happy 50th Birthday, ATM

I am an old ATM (automated teller machine) guy, having managed a small network early in my banking career in the 1970s. That was when ATMs first began making their appearance on the walls of banking offices as a way to extend banking convenience to customers. During my years as a management consultant, I was fortunate to have been involved in the formation of several statewide ATM networks that evolved into regional, national, and international debit (ATM and debit POS) networks. Now that the ATM in the United States has passed its 50th birthday, what has it become and what does the future hold for it?

While the ATM has always been primarily a cash dispenser, there were efforts over the early years to introduce new functionality to generate additional revenue. Several banks unsuccessfully attempted to use it to sell postage stamps or transit fare cards. They realized that these types of alternative products required frequent resupply visits, which drove up servicing costs. Another marketing effort included selling advertisements on the back of transaction receipts, but since most receipts ended up in the ATM’s trash can, this, too was short-lived.

The introduction of a Windows operating system with its graphical capability opened a new range of functionality, with on-screen advertising now being played during previous "Please Wait" static instruction screens. Some ATM operators experimented with selling concert and other local event tickets. Such efforts were quickly abandoned when customers wanting quick access to their cash were forced to wait for minutes behind someone deciding on the best seat selection.

A major change in the ATM landscape took place in 1996, when Congress expressly excluded ATMs from being considered branches and eliminated geographical restrictions. Not only did this change create a major expansion of bank-owned, off-premise ATMs, but it also created the opportunity for independent ATM deployers to place ATMs in retail locations. Today, ATMs/cash dispensers owned and operated by nonfinancial institutions represent more than 60 percent of the machines in the United States.

ATMs have played a vital role during the COVID-19 pandemic in maintaining banking services for consumers while banking offices were closed or operating with reduced hours or staffing levels. Many ATMs use imaging for check and cash deposits. Reported usage has increased significantly. With all the successes and failures throughout the ATM’s history, one thing has been consistent for 50 years: the cash dispensers. They are and have always been an excellent tool to handle that functionality 50 years after their introduction. Talk about standing up to the test of time!

So, what is next for the ATM? The Consortium for Next Gen ATMsOff-site link, representing more than 400 companies in 55 countries, has been working for the last five years to develop a globally interoperative software platform for APIs (for application programming interface) for the ATM to support additional functionality such as interactive teller sessions and cardless and contactless transaction support. Our readers have seen previous posts documenting the reduced usage of cash, especially by millennials. The ATM industry is looking to explore new avenues of service and revenue to offset reduced transaction volume.

Are there any additional functions you would like to see at your ATM? We would enjoy hearing your perspective on the ATM’s future.

  

December 16, 2019

ATM Cash-Out Attacks Return

I first wrote about ATM cash-outs back in 2013 when these attacks were escalating. But the frequency of the attacks quickly declined when card issuers and their processors and networks hardened their defenses. So why am I writing about it again? There were some major attacks in mid-2018. A bank in India, for example, lost approximately US$13 million from more than 12,000 fraudulent transactions at ATMs located in Canada, India, and Hong Kong. The United States has seen isolated attacks in recent years, but law enforcement is concerned that these attacks will grow because perpetrators stand to obtain a large amount of money. It's critical that financial institutions and other transaction processors remain vigilant, so I'd like to bring some attention back to this especially costly crime.

These attacks require careful planning and a synchronized effort, but the payoff for the criminals can make it worth all the work. First, the criminal gains remote access to an issuer's card management system and transaction controls. Next, the criminal uses a money mule network to open new accounts with a chip card or distributes debit or prepaid cards with cloned magnetic stripes and compromised PINs to the money mules spread across the globe. In a carefully synchronized operation, the money mules begin making withdrawals at numerous ATMs. With access to the card management system, the criminal keeps resetting balances and transaction counters to get around amount and transaction limits, and withdrawals continue to be authorized. The mules continue to make withdrawals until the cash supply in the ATM is exhausted. This is how such attacks can result in a loss to issuers in the millions of dollars worldwide in just a couple of hours. Most networks have now implemented transaction monitoring capabilities that can detect abnormal transaction traffic both at the account and the financial institution levels. If the networks identify abnormalities, they contact the issuer or processor to examine the transactions more closely. Some networks, if they can't contact the financial institution or processor, are authorized to block the activity right away to prevent additional transactions until the situation can be evaluated. Some criminals have responded by increasing the number of targeted accounts so the activity is spread across more accounts and the detection thresholds are not crossed as quickly.

Here are some steps that issuers and processors can take to defend against cash-out attacks:

  • Follow standard cybersecurity protocols related to password strength and management of system access controls to prevent compromise of system access credentials.
  • Evaluate adding further layers of authentication/approval for remote changes to card management data fields such as account balances and transaction counters.
  • Discuss with processors and networks any additional monitoring capabilities they may have to mitigate such attacks.

As the ATM celebrates its golden anniversary, cash-out attacks remind us of the constant efforts by criminals to defraud financial institutions and other stakeholders in the payments industry. Cash-out attacks are not new, but they can still result in huge losses, so the industry needs to remain vigilant and continue to look for ways to defeat them.