Psst….

Right now in your lobby or lurking around a corner, or in a small room or closet is a potential thief, one that is ignored or unnoticed because of its ubiquity. That’s your ATM, sitting there as an attack vector against our guests and your reputation.
 
We all have them, that lonely old ATM kiosk. At first, they were welcomed into our properties as a guest convenience, then we turned them into potential revenue centers by charging our guests sometimes exorbitant fees to access their own money. After another report from one of my hotels finding a skimmer and a hidden camera near its ATM, I think it is time to ask the question: is having an ATM for our guests more of a liability than any benefit we or our guests receive?
 
The biggest threats are skimmers.

According to Rippleshot: “ATM skimming is reaching record levels, with no signs of slowing down.”
 
The definition from PC Magazine: “Skimmers are essentially malicious card readers that grab the data off the card's magnetic stripe attached to the real payment terminals so that they can harvest data from every person that swipes their cards. The thief has to come back to the compromised machine to pick up the file containing all the stolen data, but with that information in hand he can create cloned cards or just break into bank accounts to steal money. Perhaps the scariest part is that some skimmers don't prevent the ATM or credit card reader from functioning properly.”
 
Skimmers are getting smaller and smaller, and with the very common ATM hardware in hotels, mass production of a skin or cover that sits over the swipe mechanism can sit visually undetected. Couple this with a small camera (I just saw one that was built into a collateral display pocket that the thieves put hotel brochures in) to catch a PIN code and now we are literally inviting our guests to be stolen from. We might as well ask our guests to hand over their cards and PIN numbers; at least that would be more efficient.
 
OK, OK, I hear you; only a very select few of our hotels have been attacked in this manner. Facts are the attacks can happen over months and the data is often stored locally and collected quarterly by the thieves. You could have been attacked six months ago and still not know. Plus, the independent ATM company is not incentivized to even tell your hotel that it has been hacked. You might have dozens or hundreds of your clients that have been impacted.
 
Further, thieves are putting in cash traps that grab the moola before it is dispensed to the card holder. Money is dispensed, but the trap circumvents the money out slot and keeps the cash. Often the guest just thinks the ATM is empty, until they get their statement.
 
The first question is: are you making any money on the ATM? The 2016 Accenture ATM Benchmarking Study casts doubt, stating that: “…only a small portion of ATM operators are running their business profitably.”

Chances are the only one making money from your ATM is the independent ATM owner. They take a large cut of the fee, often giving less than $.50 per transaction to the hotel. Some even have contracts that only pay the hotel after a certain threshold is met.

The next question is: are your guests using the ATM? Given that hotels often put ATMs out of sight, out of high traffic areas, and out of mind for our guests, are you really providing a convenience to your guest? Is there another ATM close to your hotel? Is it worth the risk?

If you are not going to take that ATM out, make sure that your partner has deployed these anti-fraud techniques:
· Cameras, not on the key pad, but focused on the area around the machine, plus any egress or ingress points in the area. These should be obvious, as they provide a deterrent just by their presence.
· Anti-cash trapping physical prevention measures
· Anti-skimming jamming measures
· Remote monitoring for unusual ATM device behavior
· Anti-ram raid bollards
· Anti-skimming detection sensors
· Anti-card trapping detection sensors
· Place a larger mirror to help guests detect shoulder surfing
· Have PIN pad shields/guards to keep prying eyes/cameras blind
· ATM fascia and cabinet alarms

I know that there are several markets where having an ATM is a requirement, and I know that there are hotels that have ATMs that are getting a lot of use, providing a true amenity to your guests and profit center to the operation. I also know that many of our hotels should be examining their ATMs and making the determination that it is time to get rid of them.