No easy technological fix for ATM attack scenarios
By Michelle Singletary
WASHINGTON — I've played out in my head many times what I would do if I were abducted and forced to withdraw money from an ATM.
Well, first, if the low-life took me to an automatic teller machine not owned by my bank, I'm sure an alarm would go off because I never use other bank ATMs to withdraw money. The machine would say, "What!?" — and immediately spit out my card.
OK, that wouldn't really happen, but it's my delusion.
I've thought about plugging in the wrong PIN so many times that the ATM would lock up. But I would surely anger my abductor if I did that.
I've imagined pushing a panic button on the ATM that would summon the police.
Interestingly, within the Credit Card Accountability Responsibility and Disclosure Act of 2009 or Credit CARD Act was a provision for the Federal Trade Commission to study and report to Congress the cost-effectiveness of making available ATM emergency PIN technology that would enable a banking customer who is under duress to electronically alert a local law enforcement agency.
This week, the FTC issued the report, more than two months overdue. With a lot of "we don't know," the agency couldn't recommend anything.
Specifically, the FTC was asked to look at "emergency PIN" or "reverse PIN" and "alarm button" technologies. An emergency PIN would allow a customer in trouble to enter some variant of their regular bankcard PIN in the keypad and that would summon police. With a reverse PIN, a customer would punch in his or her PIN backward, which would alert authorities that a robbery was in progress. So if your PIN was "1234," you would hit "4321."
The reverse PIN has been rumored for years to be installed on ATMs. But this is an urban legend.
The FTC discussed another emergency PIN system that has been unsuccessfully marketed to banks. The "ATMOnGuard" requires a customer to punch one number after his or her PIN. The additional number would indicate whether the transaction was being conducted under duress.
Really, all the electronic alert options sound feasible to me.
But it took the FTC 38 pages to conclude that the available technology probably wouldn't "deter any type of ATM crime, and in some instances may actually increase the risk of danger to ATM customers." Oh, and even if the technology was effective, the costs of implementing an emergency PIN system could be substantial, although the agency couldn't give any estimates.
Although there seem to be regular news reports of robberies of ATM customers, there is little data that specifically tracks ATM robberies where a victim is compelled to withdraw funds. What evidence there is suggests that the majority of ATM robberies occur after the victim has already withdrawn funds and isn't using the keypad, which means an emergency activation system wouldn't help.
The banking industry hasn't been persuaded that ATM emergency alert systems would work either.
"The findings of the FTC report confirm what we have been saying for years," said Margot Mohsberg, a spokeswoman for the American Bankers Association. "The reverse PIN technology does not improve the safety of ATM users. ... We are always looking for new ideas to improve the safety of our customers, but research by several banks across the country has found that the reverse PIN technology does not do this."
Mohsberg said the banks that have looked into the available technology concluded that it doesn't improve customer safety. On the contrary, she said, the institutions felt the technology could further endanger customers by giving them a false sense of security.
Mohsberg raised some good questions about the technology.
What if a customer fumbles trying to remember her PIN backward?
If the customer was able to punch in the coded PIN, would there be enough time for the police to respond?
"The best thing a person can do in an attempted robbery is hand over the money, get as far away from the robber as possible and when you are in a safe place, contact the police," she said. "No amount of money is worth endangering your life."
The concerns raised in the FTC report and by the banking industry are reasonable. It's just that we've become so used to technology solving so many of our problems that it seems implausible that we can't find a safe technological way to thwart this particular crime.
Ultimately in my ATM attack scenarios, I just hand over the money and pray that I'll be let go unharmed. It is just money.
Michelle Singletary writes for the Washington Post. Her e-mail address is sin firstname.lastname@example.org.