In depth: Beware the skimmers

Dubai: Banks in the UAE have undertaken strict security measures ever since fraudsters stole millions of dirhams from ATMs here in 2003. But no system is foolproof and there is a constant battle between financial institutions and thieves to gain the upper hand. We speak to security and banking expertise to see what measures they are undertaking to safeguard your money and future

The latest attempt to hack an Automated Teller Machine (ATM) at a bank branch and steal customer data is a reminder of how vulnerable bank customers are to these attempts.

Although the bank was quick to detect the attempt and managed to minimise the damage, one cannot remain aloof, especially when it involves one's money, savings and future.

A group of Malaysian fraudsters stole a few million dirhams from some banks in the UAE in 2003, prompting banks and customers to take extra precautions.

Before the banks had realised what was going on, millions were siphoned off from some accounts.

That was the first major exposure of local UAE banks to skimming, a hi-tech method with which thieves access one's personal or account information from credit or ATM cards, driving licence or even passport.

Last year, a similar attempt was foiled before the skimmers could succeed, although they did manage to steal vital customers' data, prompting a stronger public appeal to strengthen banking security in the UAE.

Although the losses were minimal, the risks remain strong.

"In 2003, advanced security solutions to prevent such theft or fraud were not available to the banks in the UAE. But now they are," Danny Chew, regional director of Hong Kong-based RCG Group, which offers biometric solutions for ATM skimming, told Gulf News.

"Although biometrics, including fingerprint, iris scan as well as radio-frequency identification (RFID) solutions are currently available, most banks have not yet incorporated these solutions into ATM machines."

Some of the banks have, however, installed anti-skimming devices on ATMs, sources say.

"Thousands of bank customers in the UAE are still under constant threat of various forms of fraud, including skimming, which has become a common form of theft. Advanced security solutions are available to prevent these and I don't see any reason why the banks won't install the latest solutions," Chew said.

The company recently opened its regional office in Dubai to serve its customers closely.

Banking officials, however, say that skimming has largely remained minimal.

"ATM skimming in the UAE, I would say, is minimal," said David Horton, head of Information Security at Mashreqbank, one of the victims of the 2003 fraud.

"The incident in 2003 led to banks tightening the security against anti-skimming at the ATMs. So instances are low. Mashreqbank regularly assesses the security of our ATMs and is always trying to improve security for our customers. Security is an evolutionary and holistic process, and we are always looking at what new technologies are available to protect us against fraud."

Skimming is costing consumers billions of dollars in worldwide losses as most ATM cards are secured only through personal identification (PIN) numbers.

Dubai's booming economy has created a profitable business environment for foreign investment. "This leads to increasing demand for premium and secure banking services that both local and international banks are striving to pioneer in the sector," Danny Chew of RCG Group said.

The private wealth in the GCC states is estimated at $1.5 trillion, according to International Islamic Finance. Of this, $400 billion is managed by international institutions and $250 billion is with Islamic entities.

The UAE added 9,100 new millionaires in 2006, taking the total number to 68,100, while the Middle East had 300,000 with combined wealth of $1.2 trillion, according to data from the World Wealth Report produced by investment bank Merrill Lynch and consulting firm Capgemini.

A significant number of residents among the UAE's 4.5 million population hold bank accounts.

Biometric or RFID solutions

Despite repeated skimming attempts, most banks in the UAE have not yet installed the latest biometric or RFID technologies in improving security, leaving the customers' further exposed.

Consumer research commissioned by LogicaCMG, a major international force in IT and business services, and conducted by independent research company Vanson Bourne in 2006 revealed that the introduction of biometrics could lead to much greater consumer confidence when switching between different bank accounts and other financial products, for example.

The research found that on average, 57 per cent of people would be more likely to change their current account provider if all it took was an identity card and fingerprint to establish their identity.

"Regional interest in the potential of biometric technology is rising, as both organisations and consumers look for more comprehensive security and enhanced identity protection, according to one of the pioneers in this advanced field," a recent LogicaCMG release said.

Biometric electronic identity solutions - which are used to automatically identify or verify someone's identity based on physical or behaviour characteristics - are increasingly in demand across a broad range of industries.

The number of pilot and initial implementations of biometric technology in the Middle East has increased in recent months, with biometric processes being incorporated into national identity schemes, border controls and airport immigration gates.

Tim Best, director of Global Identity Solutions, LogicaCMG, said: "Biometric technology can play a key role in providing physical access to buildings and vehicles to legitimate users, offering remote identification for people shopping online and even protecting the users of automated teller machines.

"Identity theft currently costs $50 billion per year in US alone and £1.7 billion in UK and with the growing usage of biometrics as a method to identify and verify someone's identity, the accuracy of these biometric algorithms and the proper application of them are becoming more important.

"We're encountering strong demand from organisations in the Middle East because of the potential for biometrics to reduce identity theft and ensure accurate verification."

The applications for such innovative technology are extensive. Across the Middle East, governments are investing significantly in identity schemes to register the overall population levels, Best said.

Solution

Is biometrics or RFID the ideal solution? It might not be.

"The use of biometrics and RFID at ATMs is relatively new, and if you take a look at what happened with the use of this technology in passports, you would see that it comes with concerns of its own," David Horton said.

"Because of the very nature in which the ATM network operates it is not something that can be implemented overnight."

To meet the growing demand of premium and secure banking service, RCG, the Hong Kong-based company, has combined the biometrics and RFID technologies to create an essentially non-intrusive experience for customers, Chew said.

"We have introduced the latest biometric and RFID technologies in securing customer data, ATM machines and bank accounts," he added.

"Banks can either go for the biometric solution or RFID or a combination of both. It involves facial recognition, fingerprint and, of course, the PIN code.

"These eliminate the threats of skimming or any other fraud, as in such cases the customers will have to be physically present to withdraw cash or handle the transaction.

"This essentially means anyone stealing the card or duplicating it with PIN code won't be able to steal money as it involves the actual customer's fingerprint and scanned facial recognition to match.

"Hypothetically, even if the fraudster cuts one's finger and uses the stolen finger for fingerprinting purpose, it won't work."

Best said the company recently designed, tested and implemented a national e-Identity card programme for the Saudi Arabian government.

"We are currently in talks with Dubai airport authorities about deploying our solutions in identity verification programmes and with the Dubai Government to deploy electronic national identity card and e-passports.

"Given the rapid and ongoing development of projects the Middle East, we're anticipating strong demand in coming months," said Best.

Heavy investments

Banks globally are investing heavily to protect their customers and, more importantly, their reputation.

"However, our products and solutions are not expensive. These are relatively cheap," Chew of RCG Group, said.

"Cost of security is a lot less than the cost of theft or fraud."

RCG is currently implementing its security system in a bank in the UAE.

"We have been contacted by a bank to install our latest security solutions to protect the bank's customers and money. In six months, customers of that particular bank will be able to use the biometric and RFID-powered security solutions while withdrawing cash from the ATMs."

What is the best solution then?

"For now, the most effective solution is the simplest - education, Horton said.

"Banks need to educate their customers on security awareness and in order to really counter this threat, it really requires close cooperation between banks, the ATM hardware vendors and the customer."

Fraudsters are always on the lookout for security holes, and there will always be new and creative ways to defraud the system, he says.

"Unfortunately for criminals, banks are also always looking for new and creative ways to counter this threat, and our purpose is to make it more difficult for any fraudster to benefit from skimming. Our approach is to make the return of investment of the effort to defraud so low that they will give up altogether," said Horton.

Primer: what is it about?

Skimming is based on stealing the customer's information. All a skimmer needs is the card number and the PIN code. An electronic device used to capture this information is called a "skimmer" and can be purchased online for less than Dh183 ($50).

A card is swiped through the skimmer and the information contained in the magnetic strip on the card is then read and stored on the device or an attached computer.

Skimming is predominantly a tactic used to perpetuate credit card fraud — but is also a tactic that is gaining in popularity among identity thieves.

It is a global problem. As the use of smart card technology grows, as evident with its integration with drivers licences and passports, it is likely that skimming will continue to grow as a popular tactic of identity thieves.

According to reports, incidents of credit card skimming in Asia have risen 45 per cent against Japanese victims, targeted because of their high card limits. Malaysia, Hong Kong, Belarus, Colombia and Egypt are some of the places considered high risk to travellers making credit card purchases. The UAE is relatively new to this.

Fast fact: massive scale

- Source: First Data/Western Union

Key data: A growing problem