Germany had never before so many gas attacks at ATMs as in 2016, with predicted 300 attacks ninety per cent more than in 2015. Due to not adapted and implemented security concepts in banks a further increase is expected for 2017.
Criminals seem to know that they have a walk-over at German cash points, because banks avoid an appropriate protection based on cost reasons. In addition, ATMs in Germany are attractive for robberies because of their high loading amounts of ATM cassettes and high density of 58.000 ATMs countrywide.
Perpetrators act mainly between 2 am and 5 am in the morning. The progression on-site needs often less than 5 min. They pour an explosive gas by tubes through shutters or drill holes into the ATM vaults. Thereby, a bigger portion of gas escapes also in the surroundings. A fuze detonates the gas inside and outside the ATM. The criminals can estimate the blasting force just roughly, and they accept collateral damages on buildings and individuals, by blast or triggered fire. Up today, only some perpetrators died by risk-involved blasts or on the run. Nevertheless, non-involved tenants of an effected building in the Netherlands were impacted and had to be evacuated as a complete building burnt down - as a result of an ATM blast.
The Federal Criminal Police Office (BKA) classifies theses acts as high level gang-related crime, assigned to several gangs from eastern Europe and meanwhile northern Africa. The gang size is expected with more than 200 persons acting via the Netherlands.
German banks still hope that initiated police tracing will be more successful as it was in the past, and that criminal actions will be coordinated in future internationally to browbeat the criminals. But the outlined ATM attacks show that the criminals are not getting nervous and jumpy due to a higher intensiv investigative work by the police. Therefore, the police reviews the low level ATM protection and outlines the overall responsibility of banks to secure their properties. This is reasonable, jewelers are protecting their valuables over night as well.
Security concept has to eliminate action incentive
For Germany, a consistent security concept is not implemented. Insurance industry in cooperation with the police worked out guidelines for ATM security and ATM risk assessment in 2012 (VdS 5052 - with current update from Jan. 2017). But these recommendations are not mandatory and each financial institute decides by itself about the protection level for ATMs. It seems, that the legislator has to become active for Germany. The German government explained on a minor interpellation of a parliamentary group in the Bundestag that ATM blasts have grave impact on pedestrians, customers and residents of affected buildings, which the perpetrators accept approbatory (Document 18/7313).
The core message is to eliminate in advance the incentives for criminal actions. And the incentive for ATM attacks is the cash inside. This means in first place to demonetize the banknotes by each attack. This is why German investigators opt for implementation of ink dye technology. Consistently, a statutory rules exist for Sweden, Belgium and France that ATM must be protected with IBNS technique (Intelligent Banknote Neutralization System). In the Netherlands, insurances commit the banks for ATM protection with IBNS in risky zones and they discuss further statutory rules.
Regarding the cash supply chain, always the weakest point gets attacked. Therefore, a complete review of all security issues is necessary. A single improved ATM armoring will not help due to excellent tools and expertise of main perpetrators. Examples from Sweden show that additional armoring of ATM vaults result in higher force within next attacks. It will be necessary to combine techniques and procedures to interrupt arms race of the criminals. The State Office of Criminal Investigation in North Rhine-Westphalia warns against a dangerous trend concerning gas attacks. In the Netherlands, first gangs are not using gas, but rather dynamite, Semtex or C4. In Brasil, this attack scenario is common, because of the many mines where explosive agent is in use and organizable. It is a matter of time until criminals will use explosive agents in Germany too.
Some banks react with closing their ATM locations in high risk zones during night times. They argue, this procedure should not have a negative impact to customer service, because of a low transaction rate of approx. 5 per cent from mid night to 5 am in the morning. For organizational convenience banks close their branches including ATM self-service area outside opening hours, means also during weekend. After heavy complaints of customers, some banks withdrew this measurement.
The insurance industry exerts pressure on ATM operators as well. The damage account includes the attacked ATM and cash holdings, as well as the collateral damages on building, which is regularly higher than the captured cash amount.The insurer demands improved counteractions to eliminate the incentive on cash holdings, which logically should reduce ATM blasts. Otherwise the insurability of ATM networks is at risk. Supposedly, insurer will give financial reductions on the insurance premium, if appropriate concepts including security technique for ATM locations is in operation.
Security concepts for implementation
Currently, financial institutes review their risk assessments for each branch and ATM site, defining which ATM type and location needs further security upgrades. This evaluation is a first step. In next step a concept must be specified and implemented based on constructional, technical and organizational measurements. In this process, such actions shall be preferred which minimize the incentive on cash amount substantially.
Today, only the IBNS technology fulfills this requirement for all kind of physical attacks and for internal theft, avoiding:
- attack to ATM safe by drilling, welding, cutting
- remove of complete ATM
- explosive attacks on ATMs
- not correct authorized access operations to ATM on site or ATM cassette on site or in transport
[more detailed information in "Ink technology underestimated in ATM and CiT", Jens Eberhardt, news from Feb. 2016]
Important is to integrate IBNS into overall ATM security concept. In case of gas attacks an additional installed gas sensor detects escaping gas and if connected with IBNS control board the ink dye for banknotes can be activated automatically. The IBNS activation can be also shown on ATM display, demotivating the perpetrators to ignite the fuze. It remains fact, that the professional gangs know exactly, how banks and ATM operators protect their ATM locations, and looking always for the weakest point in the supply chain. Currently, the main incentive is focussed on cash holding of ATMs and gas attacks are fast and simple for gang’s action.
Source: Federal Criminal Police Office (Bundeskriminalamt/ BKA, Landeskriminalamt Nordrhein-Westfalen), VdS-Guidelines for Security, gi-Geldinstitute, Frankfurt Allgemeine Zeitung, express.de, Wirtschaftswoche, genossenschaftsverband.de, etc.
