Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to periodic audits that include ATM security controls? Who/what guarantees that the communications between the bank and ATM cannot be faked or tapped for malicious exploitation?

share|improve this question
add comment

2 Answers

MasterCard and VISA enforce very strict regulations on any system which operates in any way in the vicinity of their precious credit cards. If a bank or an ATM operator lets the communication be tapped, then the VISA thugs will skin them alive, trample their organs, then expose their dismembered bodies on the Wall Street Bull, as a warning for other banks. Their fierceness is much higher than what any public administration could ever hope to achieve; because this is about important stuff (money). This is private business, with contracts; the legislator did not meddle with this beyond asserting that customers are not ultimately responsible unless proven otherwise (thus forcing banks to take their responsibilities).

share|improve this answer
1  
Are you saying that banks have to be PCI compliant? –  Drew Lex Jan 30 '13 at 13:42
1  
The parts of banks dealing with card data are supposed to be PCI compliant, yes. They tend to get in a lot of trouble when they are found to be non-compliant. –  Rory Alsop Feb 1 '13 at 10:16
    
This is one of my very favorite answers ever, on any SE site. I have wanted to answer questions on Money SE by referencing evisceration and that big bronze bull (to emphasize the gravitas of forcing banks to take their responsibilities seriously, as you said), but they are more strict on Money SE. Thank you for this. –  Feral Oink Mar 23 '13 at 2:37
add comment

The answer to your question would be: no. The reason behind it being that the only one losing a bit of money if all of your previous mentioned exploits were possible, would be the bank.

A bit of money you say? Yes a bit of money, the money you can loose with an ATM are rather low compared to, for instance, SWIFT transactions.

Now does that mean there aren't any protections in place? Sure there are, they are often on a separate LAN/VPN segment and their construction is made to withstand quite some physical abuse. BUT this is not enforced by any governing instance.

share|improve this answer
    
I see ATMs in the most obscure places - convenience stores, bars, motel hallways, to name a few. I seriously doubt many have separate LAN segments or much in terms of secure infrastructure. Are merchants not required to establish minimum baselines for protection of communication? –  Drew Lex Jan 30 '13 at 11:57
1  
Well, PCI-DSS is not enforced by a government, but it is a set of regulations and they are enforced by the Payment Card Industry... –  Rory Alsop Feb 1 '13 at 10:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.