ATM Security Update: How To Enable TLS 1.2 Protocol

The Announcement

The PCI Security Standards Council has mandated that the use of SSL and Early TLS (i.e. TLS 1.0) protocols be discontinued effective June 26, 2018. All network providers and processors are making preparations to ensure they are compliant by the June 26, 2018 deadline. To prevent any downtime, make sure your ATM terminals have been updated with the latest software and security certificates. NOTE: This does not include TLS 1.1 or higher.

After this date, ALL ATMs using SSL or Early TLS (i.e. TLS 1.0) communications protocol will stop communicating to the Host and fail to process any transactions.

What Does This Mean?

  • Network providers are already handling the TLS 1.2 communications protocol. Therefore, as soon as possible, set the communication protocol on your ATMs to use TLS 1.2 communication protocol.
  • Anytime you visit a direct connect TCP/IP communicating ATM verify that TLS 1.2 is set.

In order to continue processing transactions …

  • TLS 1.2 Protocol MUST be enabled on your ATM Machine

Do I Need to Enable TLS 1.2?

You NEED to Enable TLS 1.2 if …

  • Your ATM is communicating via Hardwired Internet connection (TCP/IP)

You DO NOT need to Enable TLS 1.2 if …

  • Your ATM uses a phone line or wireless modem. Your machine will not be impacted if it is communicating via a phone line or cellular wireless device box already on TLS 1.2.
    • How do I know if my wireless box is TLS 1.2?

      • The chances of you having a wireless box that is not already on TLS 1.2 are low. If you are having trouble with your wireless device please call ATMDepot.com at 888.959.2269, or your Wireless Provider, with your device’s serial number. It is best to make the request while at the location where the device is in service. Our wireless department can update your device remotely.

Do I Have TLS 1.2?

If you are using software higher than the one listed below, your ATMs should function normally after April 30, 2018. It is still good practice to confirm TLS 1.2 is enabled on each of your machines.

Hyosung

– WinCE 5.0: AP V01.04.19
– WinCE 6.0: AP V6.01.13

Genmega/Hantle/Tranax

– V05.00.19

How to Enable TLS 1.2 Protocol

Hyosung

Customer Setup > Select Processor > TCP/IP Type

  1. SLS/TLS = Enable
  2. SLS/TLS Version = Up to TLS v1.2

Genmega/Hantle/Tranax

Customer Setup > Change Processor > SSL Pass Through > SSL > SSL Version = TLS 1.2


If you do not see these options, please check that you have the required software version that supports TLS 1.2 protocol for each manufacturer.

Recommendations

  • Keep Your Software Up-to-Date

    Keep your ATMs updated with the latest software to be compliant. Listed below are the latest software versions:

    Hyosung

    – WinCE 5.0:  V01.04.31
    – WinCE 6.0:  V06.01.31

    Genmega/Hantle/Tranax

    – V05.00.31a

  • Confirm EMV Enabled

    While you are updating the software on your terminal, it is important to also check that EMV is Enabled.

    The MasterCard EMV Liability Shift occurred on Friday, October 21, 2016. ATM owners are liable for fraudulent MasterCard transactions if machines are not EMV compliant.

    Hyosung

    Operator Functions > Customer Setup > Optional Function 1 > EMV > Enable

    Genmega/Hantle/Tranax

    Operator Functions > Customer Setup > Option Function > EMV – Enable

How to Enable TLS 1.2 – Infographic

How to Enable TLS 1.2

[VIDEO] Explosives Used to Break into Machine during ATM Robbery, Thieves Caught on HD Camera

On August 11, 2017, two criminals drove their SUV up to a Gas Station ATM Kiosk with a plan. They planned to execute an ATM robbery by blowing up the ATM with some sort of liquid explosive. It is clear from this video, it’s not the first time they are attempting this. They are wanted by the FBI. The authorities were very excited to see the quality of our security footage.

Authorities_On_Scene

Authorities at the Crime Scene of the ATM Robbery in San Diego, CA

When you start using explosives on an ATM, you attract a lot of attention. You get the local police, sheriffs, SWAT, the Bomb Squad, ATF, and the FBI involved. That’s a lot of manpower hunting you down.

These guys are wanted by the FBI. It’s not just a local crime.  Is a few grand worth having to hide and run for the rest of your life? I don’t think so.

The suspects think they got away with it. However, as time will tell, and with the help of this HD video, and the enhancement tools Federal Law Enforcement agencies have available, they will most likely do time behind bars for this ATM robbery.  Maybe they will save all the money they stole to pay for their lawyer. They will need it.

I’ve been in the ATM business since 1994. Since then, I’ve helped hundreds of Independent ATM Deployers (IAD’s) start, run, and maintain successful ATM businesses. I’ve personally sold or installed hundreds and hundreds of ATM machines. I currently manage thousands of machines and hundreds of thousands of ATM transactions nationwide and I’ve never, ever seen anything like this.

This location has been a customer of ours for over a decade. We’ve never had any issue until we installed a new kiosk.  While this small kiosk does not appear to be bomb proof, the old kiosk building we used previously onsite was. Unfortunately for us the gas station – car wash is undergoing a remodel and needed to demolish the building, so we had to move the ATM to the other side of the parking lot.

In order not to inhibit the authority’s investigation, we won’t go into the details of what the authorities knew in this article.

However, now that we know all the details we can help others.

So, if you plan to install a kiosk and you are one of our customers (or want to be), please contact our office for some additional help.

We learned an expensive lesson, so we hope to use it to educate our customers.

ATM Depot can certainly help you avoid the same fate. We thought we prepared for every security scenario but they proved us wrong on this one. The key is that we learned an awful lot from this and can now assist our customers even better when dealing with outdoor ATMs.

**** UPDATE ****

September 28, 2017

After many calls between the account manager, Jeremy, and the FBI and ATF, on this situation, we learned that the authorities were able to issue a subpoena at the home of Scott Michael Petri. We are not sure how all this went down but we speculate that the FBI was able to leverage the information obtained in the video of the ATM robbery. According to law enforcement, one of the suspects bragged to a confidential informant about the crime. Upon serving a subpoena at the suspects home, the Law enforcement authorities say they found a drill, a gas cylinder, clothing and other incriminating evidence in his home that matched the items in the surveillance video during the crime.

Court documents allege (and video shows) Petri used a cordless drill to make two holes in the ATM machine’s housing. A second unidentified suspect (now in custody) approached the ATM with an open flame (see video, looks like a cigarette) and lit a fuse.  The suspects drove to the other side of the gas station and the ATM exploded. See the entire ATM robbery (edited for time) in the video above.

Suspect_Searching

The suspect (circled) is searching for the cash box after the ATM robbery explosion

The August robbery was the second time this year an explosive device was used on an ATM in San Diego, according to the FBI.

**** UPDATE ****

October 5, 2017

Scott Michael Petri faces a charge of using an explosive to damage property relating to a robbery at the Chevron Station and Pit Stop Car Wash on Miramar Road just south of the 15 Freeway entrance. The suspect was picked up and booked on October 5th and transferred into Federal custody and is being held in the Federal Prison in Downtown San Diego by the ATF. Bail has been set at $250,000.

ATM_Suspect_Arrested

Public arrest records for Scott Michael Petri. One of the suspects in the ATM robbery.

The 6 Basics of Starting an ATM Business

The Basics of Starting an ATM Business

Did you know that there are over 425,000 ATMs in the US and fewer than half of those are owned by banks?

The majority of them are owned by people like you and me. ATMs are very profitable businesses because there is very little to no overhead expenses. You don’t need employees.

No store front or rental space is needed, and there is a low start up investment. The best part is you can manage your ATM business from home at your own schedule. Are you ready to get started?

Follow these 6 basic steps to set the foundation for starting an ATM business to ensure maximum potential for success: Read more

10 Reasons Cash Still King In an Increasingly Digital World

In an Increasingly Digital World, Cash Still King & Reigns Supreme

Even as the number of digital payment methods available to consumers continues to rise, cash is still king.  Cash remains the number one choice for a large number of transactions. Some people prefer the ease of cash in completing transactions.  Others feel more confident in the security offered by using cash.  A minority of customers aim for perks and discounts by being a cash-oriented shopper.  With that in mind, the use of physical money is likely going to stay in the mainstream for the foreseeable future.

Infographic showing Cash still King

Source: CardTronics Cash Survey – Nov. 2015

A recent study1 indicated that when people are looking to pay someone back for borrowed funds, cash is still king. In fact, it is the payment form de jour 78 percent of the time. That means that, despite the best efforts of various banks and online payment management systems touting the ability to send money to anyone with an email address (you know who you are!), almost four out of five people would rather hand over cash to repay friends and family members over sending funds electronically.

Other areas where cash is king include convenience store purchases and snacks away from home.  Grocery store purchases, small business purchases, and restaurant bills also see cash taking the lead.

Though the number of payment alternatives only rises, general consumer sentiment seems to suggest that using cash for many transactions is going to stay the norm well into the future. Hence, cash is still king and will reign supreme for quite some time.

Tipping in Cash

A cash tip is often logical when the bill will be paid in cash.  However, cash tipping on card-based transactions also occurs frequently. For example, the aforementioned survey showed that 53 percent of restaurant-goers paid in cash.  Even though 48 percent of the customers used credit, cash tipping was common for 78 percent of those surveyed.

While tipping is not restricted to restaurants alone, many consumers choose to pay tips in cash due to a variety of other factors. Some consumers do not care for the idea of mandatory tip sharing, or pooled tips.  They feel that, by paying in cash, there is a higher likelihood their server will keep their fair share.

Even though certain pooling practices are technically illegal, it does not guarantee the activity will not occur.  Similarly, removing a percentage of a waiter’s tips to cover the corresponding exchange fees on card-based transactions is also illegal, but has been seen to occur.

Cash for Budgeting

One reason cash seems to stay a critical part of the financial marketplace is its ability to act as a built-in budgeting mechanism. The envelope system2, a budgeting technique pushed into the limelight by personal finance gurus such as Dave Ramsey, functions by having followers shift to a predominantly cash-based way of living.

Once a person determines how much of the funds available from their paycheck will be allocated to certain expenses, they physically place the corresponding funds in an envelope labeled for that purpose. The method states that, once an envelope is empty, no additional spending is allowed in that category.  Spending can continue once until the envelope funds are replenished with their next salary payment.

Pocket full of Cash Still KingThe survey also supported the fact that Millennials are not as resistant to paying in cash as the rumor mill would have you believe. Not only do many Millennials use cash as a method for staying on budget, they do so more often than those belonging to the Baby Boomer generation at a rate of 40 percent to 30 percent.

Women are more likely to take part in this cash budgeting trick than men, at a rate of 39 percent and 29 percent respectively, though the practice has decent footing across the board.

Confidence in Consumer Banking Institutions

Though budgeting is a significant contributor to the use of cash by Millennials, it is only part of the story.  In 2014, a study was completed between San Diego State University and the University of Georgia3.  The study determined one of the biggest influencers of the use of cash among this youngest working generation is the general distrust of banks and other financial institutions 4.

This distrust is bred from the constant flow of predominately negative information about business practices in the financial industry.   The ability to feel connected with a large digital network of others who feel similarly amplifies this effect. The feeling of connectedness makes younger generations feel more empowered that they can make a difference, as they are more aware of the number of like-minded people.

Recent high-profile data breaches5, such as the Target data breach in reported in 20136, have also increased consumer anxiety around the use of card-based payment methods, such as debit or credit card purchases, leading to an increase in the number of cash sales. Security concerns were most notably expressed by older generations but were also a significant presence across every generation.

Cash Offers Security

When it comes to a secure payment method for closing out a transaction, cash is almost unbeatable.  You do not have to worry about someone gaining access to your bank account when you hand the cashier a $20.  This remains true regardless of what happens to the store’s point-of-sale system on the backend.

Cash has maintained its popularity for smaller retail transactions, generally defined as those below $20.  Transactions under $10 are completed in cash about two-thirds of the time based on a study conducted by the Federal Reserve whose results were published in 2014 7. In contrast, across all transactions, mobile and text-based payment options only accounted for less than 0.005 percent of all payment activities.

Cash and Debit are NOT the Same

wallet with credit cardsThe use of cash should not be confused with the use of debit card.  The electronic component associated with debit cards automatically increases the risk associated with the transaction. Debit cards offer direct access to any cash you have associated with that bank account.  This includes any overdraft protection in place.  However, the nature of how the transaction completes sets it apart.

If an unscrupulous person gains access to your debit card number and your PIN, they essentially gain unfettered access until you or your bank notice something seems amiss. In contrast, if someone steals $50 from you, the thief has access to $50, and that is it. There is no more risk to your funds beyond the amount that was specifically taken.

Additionally, banks that offer consumer deposit accounts are also subject to hacking attempts and malware.  This is demonstrated by the discovery of an international hacking ring in 2015.  The ring was responsible for stealing as much as $1 billion from over 100 banks 8.  This helps cement the fact that even if a debit card is like using cash, it is not as safe as actually having cash-in-hand to pay for items.

The risk is associated with how the funds are stored (digitally in an account versus as paper money in your hand).  It has nothing to do with whether the funds are considered functionally like cash or an extension of credit.

The Disappearance of the Check

While the check hasn’t officially disappeared from the payment option landscape, it has certainly lost a significant amount of ground. In 2014, grocery retailer Whole Foods expanded their no-check policy to include stores in the Southwest region of the United States9.  The continues the trend in place with major retailers, including Gap Inc. stores.  Additionally, many specialty stores, such as Lululemon Athletica, also do not accept checks.

Cash Use Survey

Click to View

In fact, the Federal Reserve estimated a decline of over 50 percent in the number of checks written between the years 2003 and 201310. This decline is partly due to the reduction in checks being accepted at the point of sale.  The rise in popularity of the debit card is also a factor.  However, checks remain common for payments of large-value consumer bills.

Customers who preferred checks as a form of payment generally shifted to either use cash or debit card.

Debit Cards versus Credit Cards

There are instances where credit cards can offer more security than its debit card brethren11.  Credit purchases often come with higher levels of fraud protection. Additional benefits may also be available to credit card users.  This includes institutionally offered cash back or travel rewards.

Some cards include special access based on the card issuer in use.  For example, American Express is often the most famous for this, especially in relation to the infamous “Black Card”12.  Often, these extra offerings cannot fully offset the challenges associated with a compromised card.  Benefits also do not compensate for the costs associated with taking on, and carrying a debt.

Cash Only Small Businesses

Even in today’s digital age, some small businesses choose to run as cash-only businesses or retailers. The most common benefit is avoiding transaction fees associated with credit and debit card purchases.  It can also lead to simpler bookkeeping requirements 13.

Suitcase - cash still kingAdditionally, the likelihood the business will be the subject of various fraudulent transaction attempts is also limited.  Fewer fraudulent transactions may translate into lower prices.

If a consumer is interested in items from a cash only small business, they will have to pay in cash or walk away without making the purchase. Many would consider this risky, as a business may lose customers in the process.  A business can mitigate the risk through installing on-site ATMs.

Small Businesses and On-Site ATMs

For businesses that choose to use a cash only payment model, adding an on-site ATM can be enticing.  A buyer who would otherwise not have the cash on-hand can withdraw the funds to complete the purchase.

Many service oriented businesses lead the way when it comes to on-site ATMs. These ATMs are often designed to have a low surcharge, or be surcharge free.  Most commonly, these ATMs are seen in service-based businesses such as barber shops, hair salons, and nail salons. The practice is also common in small bars as well as casinos.

Adding on-site ATMs shows to be profitable for many small businesses14. This is supported by the fact that many retail transactions are still completed in cash.  An on-site ATM allows customers easy access to their funds without requiring a card as the form of payment at the point of sale.

Additionally, an on-site ATM is often more cost-effective for small businesses.  It provides an alternative to those who would otherwise be unable to support the transaction fees associated with accepting debit or credit cards. It can also help a business to run more efficiently.  There is no need to dedicate the time to verify a customer’s information to assess whether a check or card-based transaction is initiated by an authorized account holder when cash is the payment method.

The cash market continues to show enough strength to keep many of these businesses running.  This suggests we will not see the end of cash in the marketplace any time soon.

Cash Payer Discounts and Card-Based Surcharges

In 2013, updated agreements between credit card giants MasterCard and Visa changed the terms associated with processing card-based transactions.  The processing costs are referred to as interchange fees.

Many retailers passed this increase on to consumers through surcharges.  The surcharge (at times called the innocuous sounding “convenience fee”) is designed to help cover the costs associated with increased interchange fees.

Cash Survey Graph shows Cash Still King

Click to View

This led to some retailers to essentially offer discounts to cash customers. This trend was most noticeable as people drove their cars up to the pump for fuel. While the price difference between cash and card-based payments for gasoline may vary, it is not uncommon to see a difference of about $0.10 per gallon.

The discount to cash payers functions as a reward for not using the other systems.  It also looks to encourage more consumers to see cash as king. This operates, psychologically, in a similar fashion to offering a sale15.  Consumers enjoy feeling as though they have gotten a deal, even if it is as small as 3 or 4 percent.

This is not the case in all states.  Some, including California and New York, have banned the use of credit card surcharges.

References
  1. “Cash Remains a Leading Payment Form,” CardTronics.com, January 14, 2016, accessed August 29, 2016, http://ir.cardtronics.com/releasedetail.cfm?releaseid=950285.
  2. “Dave Ramsey’s Envelope System,” DaveRamsey.com, accessed August 29, 2016, http://www.daveramsey.com/blog/dave-ramseys-envelope-system/.
  3. “Study: Millennials Less Trusting Then Gen x Was,” CBSNews.com, September 4, 2014, accessed August 29, 2016, http://www.cbsnews.com/news/study-millennials-less-trusting-than-gen-x-was/.
  4. “6 Money Myths for Millennials to Stop Believing,” HuffingtonPost.com, last modified May 19, 2015, accessed August 29, 2016, http://www.huffingtonpost.com/learnvest/6-money-myths-that-millen_b_6902078.html.
  5. Paula Rosenblum, “In Wake of Target Data Breach, Cash Becoming King Again,” Forbes.com, March 17, 2014, accessed August 29, 2016, http://www.forbes.com/sites/paularosenblum/2014/03/17/in-wake-of-target-data-breach-cash-becoming-king-again/#5956194242ec
  6. “Target: 40 Million Credit Cards Compromised,” CNN.com, December 19, 2013, accessed August 29, 2016, http://money.cnn.com/2013/12/18/news/companies/target-credit-card/index.html
  7. Barbara Bennett et al., “Cash Continues to Play a Key Role in Consumer Spending,” FRBSF.org, April, 2014, accessed August 29, 2016, http://www.frbsf.org/cash/files/FedNotes_Evidence_from_DCPC.pdf.
  8. “Whole Foods Market Is Latest Retailer to Reject Checks,” DallasNews.com, August 25, 2014, accessed August 29, 2016, http://www.dallasnews.com/business/retail/20140825-whole-foods-market-is-latest-retailer-to-reject-checks.ece.
  9. Mike Snider and Kaja Whitehouse, “Banking Hack Heist Yields up to $1 Billion,” USAToday.com, February 16, 2015, accessed August 29, 2016, http://www.usatoday.com/story/tech/2015/02/15/hackers-steal-billion-in-banking-breach/23464913/.
  10. “The 2013 Federal Reserve Payment System Study,” FRBServices.org, December 19, 2013, accessed August 29, 2016, https://www.frbservices.org/files/communications/pdf/research/2013_payments_study_summary.pdf.
  11. “4 Reasons Credit Cards Are Better Then Cash,” HuffingtonPost.com, last modified November 15, 2014, accessed August 29, 2016, http://www.huffingtonpost.com/simple-thrifty-living/4-reasons-credit-cards-ar_1_b_5824482.html.
  12. Patrick Morris, “American Express Black Card: The Wild Benefits of the Credit Card That Costs $2,500 a Year,” Fool.com, August 24, 2014, accessed August 29, 2016, http://www.fool.com/investing/general/2014/08/24/american-express-black-card-the-wild-benefits-of-t.aspx.
  13. Lou Hirsh, “Importance of Atm Machines in a Small Business,” Chron.com, accessed August 29, 2016, http://smallbusiness.chron.com/importance-atm-machines-small-business-63116.html.
  14. “Accepting Cash Only,” SBA.gov, accessed August 29, 2016, https://www.sba.gov/managing-business/running-business/managing-business-finances-accounting/accepting-cash-only.
  15. Anita Campbell, “Pros and Cons of Offering Discounts for Paying in Cash,” SmalBizTrends.com, July 11, 2013, accessed August 29, 2016, http://smallbiztrends.com/2013/07/pros-cons-discounts-for-paying-in-cash.html.

Investing in an ATM for Business or Profit

Custom Branded ATM Machine for a BusinessInvesting in an ATM

Do you have customers asking you for the nearest ATM location? If you answered yes, then it is time to consider buying or investing in an ATM machine for your business. Instead of sending your customers around the corner or down the block to the nearest ATM machine, wouldn’t you rather offer them the convenience of never having to leave your store? Plus, you get to keep the great profits of owning your own machine. Investing in an ATM can generate surprising amounts of revenue.

Up until now, you’ve been sending this revenue around the corner and down the block, but it is time to take this reliable source of constant income, and make it yours. From now on, when somebody asks you where the nearest ATM is, you can direct them to the one located right in your store. Your customer benefits from the convenience and so do you. After all, when a customer leaves your store, even if they are headed to grab some quick cash for their purchase, there is no guarantee that they will return. This can potentially result in a loss of sales and is easily prevented. The majority of start up ATM business owners earn their entire investment back inside of six months or so. After that they earn profits month after month, year after year. The ATM revenue you can potentially earn comes from the ATM surcharge. When you own your own machine the surcharge is 100% yours. Read more