Banks adopt EMV chip technology to counter ATM card ‘cloning’

AP FILE PHOTO

MANILA, Philippines—Local banks would have to adopt a new security feature in ATM cards soon to combat card fraud that cost depositors more than P200 million last year.

The ATM security feature is on top of installing closed-circuit television (CCTV) cameras and posting guards at ATM booths.

At the Senate hearing on ATM fraud, Bangko Sentral ng Pilipinas (BSP) officials on Wednesday said it was about time banks started using EMV chip technology in ATM cards to counter card “cloning” or “skimming.”

Bank executives agreed with the idea as some 1,272 cases of ATM card fraud were reported in 2013 involving P220 million.

EMV, a technology developed by Europay, MasterCard and Visa, has a chip that contains information needed to use the card for payment and is protected by various security features.

Vicente de Villa III, director for BSP’s Supervisory Data Center, said the body had issued Circular No. 808 requiring all banks to shift from the magnetic strip technology to EMV chip technology.

All banks should have issued EMV-capable cards by January 2017, he said.

“The difference between the two is that the information in the magnetic strip is static and permanent, and hence, easy to copy, while EMV chip is more dynamic. Every time you use it, there’s an algorithm being computed,” he said.

Deadline

De Villa said the BSP had set 2017 as the deadline because the shift to the EMV chip was costly and would entail replacing hardware and software.

“Thank you for giving us the heads up. This is certainly good progress,” Sen. Grace Poe, chair of the investigating committee on public order and dangerous drugs, said of the BSP circular.

Arrested

Last week, Presidential Security Group member Raphael Marcial was arrested for alleged cloning of ATM cards in Makati City. He was brought to a local court for inquest on charges of violating the e-commerce law.

He was allegedly carrying a scanner device supposedly used to copy ATM cards, as well as cards bearing different names.

In a recent Inquirer report, police in Angeles City arrested an Italian man, Roberto de Cecco, caught installing a card-skimming device in an ATM machine in a PSBank branch in Barangay (village) Malabanias in that city.

Police said the two Caucasian men with De Cecco fled after the latter was arrested.

Victim

One victim of ATM card fraud is a journalist, who lost P27,000 on Feb. 1.

On Feb 2, Elsa (not her real name) tried to withdraw P5,000 from a PSBank ATM machine at the Ayala MRT on Edsa and found that her account had an insufficient balance.

“I inquired about my balance and was told my account only had P499.49. Knowing I had a balance of well over P20,000 in that account and thinking there may have been something wrong with the machine, I went to the BPI Expressteller machine at the Enterprise Center at 7:03 p.m. to inquire about my balance. I was given the figure P487.49,” she said.

Elsa said she immediately reported the matter to the PSBank branch on Chino Roces, Makati City. She was informed by PSBank that according to its investigation, P27,000 had been “successfully dispensed” on Feb. 1 by an ATM machine in an unnamed Metrobank branch.

“I was not anywhere near a Metrobank branch, much less withdrawing money, on that date or time. That P27,000 that was dispensed by your machine was not withdrawn by me and I am really anxious to get that money back,” she said in a letter to Metrobank dated Feb. 7.

Elsa requested Metrobank for the CCTV footage of its branch and machine involved on the date in question to see who withdrew the money.

Reply awaited

Metrobank has yet to reply to Elsa’s request.

Miguel Bernabe, vice president of Bank of the Philippine Islands and chair of the Internetwork Anti-Fraud Committee, said the bank had begun preparing to move toward the chip-based technology.

“We’re now already doing our pencil pushing as far as how we’re able to migrate our ATM cards into a chip-based technology. Definitely, we will be complying with the circular,” he said.

Rene Natividad, vice president of operations for Bancnet, agreed with the BSP circular. “Some banks have started using it,” he said.

Ways to clone ATM card

In a PowerPoint presentation, Chief Insp. Jay Guillermo of the Police Anti-Cybercrime Group showed slides depicting the different ways of ATM card cloning.

According to him, cloning is the method used by criminals to capture data from the magnetic tape on the back of an ATM card, and is a worldwide problem.

This is done by attaching a gadget to the ATM card entry slot that looks like an entry slot itself, minus the flashing card indicator, Guillermo said.

Other ways are “piggybacking” a card-reading gadget onto the card reader, attaching a device to the ATM rain cover, and installing a device to the card reader, he said.

Pinhole camera, skimmer

This is complemented by devices attached either to the top of the ATM machine, a pinhole camera hidden behind a brochure holder, and a skimmer plate placed over the keyboard, all to capture the PIN (personal identification number), he said.

A successful cloning requires both a card skimmer or reader, and a camera fitted to the ATM, the police official said.

“They put skimming device early morning or late evening, depending on the location of the bank,” he said, pointing out that the criminals targeted banks that lacked surveillance cameras or security guards.

The copied information is used to produce a duplicate ATM card.

A recent attempt showed a fraudster wearing a helmet to hide his face from the CCTV camera.

But the majority of banks have CCTV cameras that come with the ATM machine, according to bank officials.

Cloning at night

Fraudsters do the cloning at night “because they know the cut-off of the banks,” Natividad said.

“At 12 midnight a bank changes limit. Let’s say a bank has a P20,000 withdrawal limit every day. If I go there, and I have a clone card, I’ll do the transaction starting at 11:30 and use it up. I’ll do a P20,000 withdrawal. After 12 o’clock, I can do another P20,000. If the bank has more limits, there’s more exposure,” he said. “That’s why banks now are thinking of limiting the limits on ATM.”

Hearing this, Poe said: “I hope we don’t do it because of the high prices of commodities. Maybe, it should be only one of the options. Depositors with certain credit balance should have a certain limit.”

Natividad later told reporters that this was a precautionary measure being explored by banks “to limit the exposure.”

“Whenever there are cases like this, the exposure would just be limited to that amount,” he said. But he said it would depend on the individual banks whether to adopt this.

RELATED STORY

Over P200M lost to ATM thieves in 2013—BSP