Keeping an ATM route secure: four kinds of loss and the controls for each

What to take away

This page is written from the defender's side. It does not describe how any attack is carried out, because that information helps nobody who is trying to protect a machine.

The four kinds of loss

Attack on the machine. Someone attempting to get into the safe or damage the unit, at the site, usually out of hours. It is loud, obvious afterwards, and mostly deterred by where and how the machine is installed.

Tampering with the card entry or fascia. Quiet, aimed at the cardholder rather than at your cash, and the one with the heaviest consequences for you afterwards even though you may lose nothing directly.

Loss during the run. Robbery or an attempt at it, while cash is being carried. The rarest and by far the most serious.

Internal loss. Money going missing in the process rather than in an event, which is what the reconciliation and custody controls exist to detect.

Preventing an attack on the machine

Most of this is decided before the machine is installed.

Choose sites where the machine is visible, lit, and somewhere people are. Anchor the machine properly, to whatever the manual specifies, and check the anchoring rather than assuming it. Ask the venue about their own closing routine, alarms and cameras, and about what happens to the building overnight.

After installation, check on every visit for changes: something stacked against the machine, a failed light, a camera turned elsewhere, a propped door. The site drifts, and that drift is the exposure.

Industry guidance on protecting the machine and its data is in the PCI ATM security guidelines supplement. Your processor and sponsoring bank will have their own requirements. Hold them in writing.

Detecting tampering

The whole of this is knowing what your machines look like.

Look at the card entry and the fascia deliberately on every visit, from the position a customer stands, before you open anything. Look at the ceiling and fittings above and around the machine. Compare against what you know rather than against what seems normal.

If anything is unfamiliar, stop. Do not handle it, do not attempt to remove it, and do not decide on the spot whether it matters. Follow your incident procedure, which should already name who you call and in what order.

Customers and staff will sometimes tell you first. Take that seriously every time, including the times it turns out to be nothing, because the cost of checking is a trip and the cost of not checking is not.

The run is the dangerous part

This is where operators get complacent, and complacency here is different in kind from complacency about a jam.

Six rules, and they only work if they are decided rather than remembered.

Decide now, while nothing is happening, that anything wrong at a site means you leave. Do not plan to assess it. Under pressure people do what they decided beforehand, not what they intended.

If the cash, the hours or the distance make you uncomfortable, that discomfort is evidence. A cash-in-transit arrangement costs money and removes the risk you are least able to carry.

Internal loss, and how it is actually found

Internal loss is not found by trusting the right people. It is found by a process that would notice.

Separate authorization, preparation, transport, loading and reconciliation as far as your size allows. Where one person does everything, put a second pair of eyes on the reconciliation and write down that you know this is the weak point. Log every difference on the day, however small, and read the log for patterns rather than for incidents.

A difference that follows one machine is usually hardware. Scattered differences are usually process. A difference that follows one person is a conversation you hold immediately and document. The routine that produces this evidence is set out in the repair and security guide and in the interval work in the preventive maintenance checklist.

The systems, not just the cash

Your monitoring, your reporting and your records hold site addresses, access notes and transaction data. Losing control of those is a loss of a different kind and it is easy to ignore because nothing visibly disappears. The NIST small business quick-start guides are a reasonable starting point for how an operation this size approaches it.

What you owe after an incident

Do not guess this, and do not learn it during the incident.

Ask your processor, sponsoring bank, insurer, and a qualified adviser now: what must be reported, to whom, and how quickly for each of the four kinds of loss above.

Write the answers as an ordered call list, and keep it where you can reach it from the road. Where a regulatory duty attaches, it belongs in the register described in the licensing and compliance overview.

Emergency services come first whenever anyone is at risk. After that, preserve everything, including the machine's own records, and write down what happened while it is fresh.

Reviewing it as the route grows

More machines means more cash, longer runs, later hours and more sites you visit rarely. Every one of those changes the exposure, and none of them announce themselves. Set a review point tied to route size rather than to the calendar, using the growth signals in the material on expanding a route.

Common questions

Should I tell hosts about security arrangements?

Tell them what they need to do and what they must not do. Do not discuss your run timings, your cash amounts or your routine with anyone who does not need to know them.

Is a camera at the site enough?

A camera helps afterwards and deters some attempts. It does not replace a well-chosen position, proper anchoring, or a person who looks at the machine.

What if a host asks to be given a key?

No. Access to the machine is yours alone, and the agreement should say so plainly. A host who needs something from inside the machine needs you, not a key.

How often should I review this?

Whenever the route changes shape, and after every incident however minor. An incident that cost nothing is the cheapest information you will ever get about where the gap is.