The other side of the chip

Even if you’re only tangentially part of the credit union movement, you’ve surely been exposed to the letters EMV on pretty much a daily basis.  And, with the October deadline looming, the coverage and discussion surrounding these little chips is sure to increase even more. 

While the topic has been explored from many angles, I recently realized that those of us in the credit union community haven’t given a lot of attention to how these new security measures will affect our members.  Doing whatever possible to mitigate fraud is, for a variety of reasons, critical for credit unions.  But what about credit union members?  How will the EMV conversion benefit the hard working people we are committed to serving?

At CU24 we did some investigating with these questions in mind.  The following article is the result of that investigation. 

-MG

When Sheila Fine* a 48 year old graphic artist and native of Silver Spring, Maryland visits an ATM on any given day (practically a daily occurrence for the past thirty years since she’s had her checking account), thoughts such as, “will I have enough in my account for tonight?” or, “did my paycheck clear?” are typical.

But these days, there’s a new dialogue going on in Sheila’s head as she’s punching in her six-digit PIN – “will someone skim my ATM card info and use it to buy something expensive, or steal all my money?”

As Fine sees it, she’s not overly paranoid – rather, she’s justifiably concerned. That’s because in the last year she’s had her ATM card skimmed not once, but twice.

ATM skimming is a form of identity theft where thieves steal the personal information stored on your card via sophisticated electronics.

“The first time it happened I was alerted that my card was skimmed after using an ATM at a convenience store, and I figured, ‘well, heck, it’s a one-time thing,’” said Fine.

But a few months later, when she found herself driving through rural, northern Baltimore,, Maryland she opted to use an ATM at a community center.  Once again, her card information was skimmed! “Someone attempted to buy $200 sneakers somewhere in Texas,” said Fine, noting that the “creepy” experience left her with a knot in her stomach that’s never really left. “I felt so violated — I worried that someone was going to run up a bunch of charges. I felt paranoid too, because it made me wonder if one of my coworkers had lifted my number.”

Unfortunately, the number of consumers with experiences like Fine’s is growing.  According to a recent report from analytic software firm FICO, the number of ATMs in the US that have been compromised by criminals rose 546% from 2014 – 2015!  In conjunction with this shocking statistic, what’s also rising is the number of major media outlets flooding the Internet with advice on how to reduce the likelihood of ATM skimming.

While the spike in ATM-related fraud is well documented, the emotional impact of ATM skimming is often underestimated. As Fine and others can attest to, even when a financial institution replenishes funds, the impact a single skimming incident can have on a consumer’s state of mind or trust in his credit union or bank, extends beyond financial concerns.

While few, if any, studies on the emotional impact of ATM skimming have been published, a number of studies on identity theft underscore the non-financial consequences of these kinds of incidents. According to one recent survey by the Identity Theft Resource Center, 69% of victims felt fearful for their personal financial security; 50% of respondents said they had feelings of powerlessness or helplessness; and 29% said they felt shame or embarrassment. The generalized report on financial fraud, FINRA Investor Education Foundation Non-Traditional Costs of Financial Fraud — suggests victims of any kind of money scam are vulnerable to feelings of anxiety. The survey’s most commonly cited non-financial costs of fraud are severe stress, anxiety, difficulty sleeping, and depression.

But what makes ATM skimming worse than some other forms of fraud is that the crime can easily be repeated on the same unsuspecting victim, as Sheila discovered. Unless you’re using EMV-enabled machines with chip-enabled cards, the only way to “skim proof” your card is to avoid mag-stripe ATMs altogether — which sounds about as logical as not driving, not paying taxes, or shunning any other modern-day necessity.

“Anxiety and fear can affect consumer confidence, because if something like ATM skimming happens to you it’s going to be a powerful motivator for you to do what you can to make sure that same something doesn’t happen again,” said behavioral finance expert Les Szarka, a certified financial planner and author of “Money Brain: How Your Subconscious Mind can Hijack Your Investment Decisions.” According to Szarka, “hearing a lot of stories about fraud can feed into that anxiety.”

As ATM skimming continues to rise, credit unions and banks that aren’t taking steps to reduce or eliminate skimming could see a bigger impact on their bottom line. Just ask Brian Krebs, author of the blog “Krebs on Security,” who reported in March that credit unions were experiencing “an unusually high level of debit card fraud” from the breach at nationwide fast food chain Wendy’s, for which losses eclipsed those that came in the wake of huge card breaches at Target and Home Depot.

“It’s tremendously important for financial institutions to ensure consumer security, as clients can very easily move money from one bank to another,” Szarka added.

Dr. Art Harper, PSCU’s Director of Solutions, consulting for card payment solutions, and a member of the EMV Migration Forum, echoed the sentiment.

“I believe it will be important to cardholders as more publicity around ATM hacking occurs, and they will be asking their institution if their ATM is secure,” said Harper.

While EMV-related upgrade costs can add up, especially for credit unions that haven’t upgraded their ATMs in the past three to five years, the ability to withdraw money without fear is priceless for consumers like Sheila Fine.

Shortly after Fine’s second ATM skimming incident, she received her very first card with an EMV chip, which she now uses freely at ATMs or at her favorite stores. Still, she hasn’t stopped compulsively looking under the different panels and nooks of every machine site she encounters to make sure there isn’t a hidden camera tracking her.

“While the new card is definitely more cumbersome than the swipe-ready version because transactions take longer, I am definitely glad there’s more security,” said Fine. “I’m still really hyper aware of what to look for when searching for places to withdraw money. So if a place looks sketchy, I trust my gut feeling and avoid it.”

* Last names have been changed