How Community Banks Can Better Protect Their ATMs

The attack is simple, brazen and usually takes less than five minutes: A truck or other large vehicle (which frequently turns out to be stolen) pulls up to a freestanding ATM, hooks a chain around the machine, guns the gas and pulls the ATM off its foundation. Even if the bank recovers the stolen cash, the institution still faces serious damage and replacement costs. 

“When one considers replacement of doors, walls and damage to the actual ATM, the costs from an ATM attack can exceed $100,000,” says Barry Thompson, managing partner at Thompson Consulting Group in Oswego, N.Y. He adds that repeated attacks can also affect insurance premiums. 

Such brute-force physical attacks on ATMs have been increasing in number and destructiveness over the last few years. The FBI reports that from 2018 to 2019, the number of ATM burglaries rose from 41 to 381, and then to 610 in 2020. 

ATM security risk factors

The “hook and chain” attack described above remains popular. Stand-alone ATMs, whether at bars, convenience stores, bank branches or banks’ drive-through lanes, are the most vulnerable. “These circumstances look like an easy win to bad actors,” says Jack Burns, executive director, ATM security and forensics at NCR, a fintech in Atlanta.

Criminal rings appear to be a key driver in the escalating number and sophistication of the attacks, according to a Texas Bankers Association crime task force report. The rings attack numerous ATMs in one area and then migrate across city and state lines. 

“There’s been an outbreak with these gangs,” observes Dana Yarbrough, president of the Baton Rouge Area Bank Security Association. “A lot of attacks happen in one area over a period of time. Then they go to another area.”

Matt Dunlap, director of banking product SME for Diebold Nixdorf, describes the rings as well-organized and methodical. “They have a specific method or target. They move from one unit to another. They move around until they’re caught or the weakness is fixed.”

As threats grow more organized, banks must prioritize obtaining good threat intelligence.  

The Baton Rouge Area Bank Security Association actively facilitates information sharing and education, as do many state and local banking associations. “We invite law enforcement officials to speak, and we also bring in vendors to speak about what they’re doing and get the word out,” says Yarbrough.  

In addition, ATM manufacturers and trade associations frequently sponsor webinars, forums and briefings on current threats. “Bankers should be actively talking to each other and meeting with law enforcement organizations,” says Thompson. “Take a look at what’s going on in the community and find out what police are seeing.”

How to strengthen ATM security

Deterrence is the first line of ATM defense. Barriers, bollards or other obstacles restrict vehicle access to an ATM and can help ward off attacks. They also signal to would-be robbers that this job may not be worth the risk. Similarly, signage that announces the use of alarms and video surveillance warns off and can deter perpetrators. 

“ATM attacks are seldom random,” Dunlap explains. “Anything banks can do to make their solution known discourages an attack.”

Detecting and hindering attacks is the next stage and can decrease the likelihood of an attack’s success. Sensors are available that monitor vibration or motion and trigger an alarm. Video surveillance, including smaller cameras that fit inside the ATM, can also trigger alarms or provide important evidence for law enforcement. 

Products such as “safe blocker kits” or ATM cages make it more difficult to access the ATM or make it harder to pull the ATM off the ground. 

If an ATM is seized, GPS packs in the ATM itself and/or the cash cassettes can allow law enforcement to track and recover the cash and/or bring the perpetrators to account. Alternatively, various ink and dye technologies will deface and/or degrade the cash, rendering the crime less rewarding. 

In the end, a strong security program will take a layered approach, combining barriers, surveillance, alarms, lighting and other tools to create a secure location. Selecting the best technologies and tools should be guided by the most likely threats for your bank. “Take a threat intelligence-driven response,” Burns advises. “Tailor and focus your budget on those immediate threats to get the most impact.”