What security standards and regulations are in place for bank ATM?

Question

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to periodic audits that include ATM security controls? Who/what guarantees that the communications between the bank and ATM cannot be faked or tapped for malicious exploitation?

Answer 1

MasterCard and VISA enforce very strict regulations on any system which operates in any way in the vicinity of their precious credit cards. If a bank or an ATM operator lets the communication be tapped, then the VISA thugs will skin them alive, trample their organs, then expose their dismembered bodies on the Wall Street Bull, as a warning for other banks. Their fierceness is much higher than what any public administration could ever hope to achieve; because this is about important stuff (money). This is private business, with contracts; the legislator did not meddle with this beyond asserting that customers are not ultimately responsible unless proven otherwise (thus forcing banks to take their responsibilities).

Answer 2

The answer to your question would be: no. The reason behind it being that the only one losing a bit of money if all of your previous mentioned exploits were possible, would be the bank.

A bit of money you say? Yes a bit of money, the money you can loose with an ATM are rather low compared to, for instance, SWIFT transactions.

Now does that mean there aren't any protections in place? Sure there are, they are often on a separate LAN/VPN segment and their construction is made to withstand quite some physical abuse. BUT this is not enforced by any governing instance.