Banks on high alert as ATM fraud returns

By Jackson Okoth

The banking fraternity has once again back to the drawing board as it seeks a way of managing the recent spate of fraud in the industry.

The move comes after an unknown number of customers belonging to a city bank-branch woke up to find their accounts virtually emptied.

The incident, which occurred between Christmas and the New Year, caught most customers by surprise, especially those who had travelled upcountry.

“I first noticed there was a problem when I travelled to Kisumu and went to the local branch to withdraw money. To my surprise, I only had a balance of Sh1, 000 in the account, although I had not made any withdrawals out of the Sh50,000 balance,” said Jacob Owiti, a sales executive in a leading pharmaceutical company in Nairobi.

There is also another group of customers who received SMS alerts on their mobile phones to change their personal identification numbers (PIN) when the bank noticed that its systems had been tempered with.

Change PIN

“I decided to withdraw all the cash from my account rather than change my ATM PIN,” said Julius Langat, yet another customer who spoke to Business Weekly.

In the case of Owiti, he did not change the card PIN when an alert was sent to his mobile phone handset by the bank.

“After I noticed abnormal transactions through a printed mini-statement, I reported this matter to the bank in Kisumu. But when it took four days to rectify the problem, I travelled to Nairobi and reported again at the head offices of the bank,” said Owiti.

In less than 48 hours, Owiti got an SMS alert, informing him that all his account had been normalised. He has since changed the ATM and is yet to be issued with a new one.

ATM reversals

In recent months, a number of commercial banks have experienced unauthorised withdrawals from customer accounts and have been silently doing ATM reversals to their clients. These incidences happen mostly during weekends and public holidays, when activity at the cash teller machines is minimal.

“In most of the ATM fraud incidences, the Trojan horse is usually a disgruntled or heavily indebted employee within the bank, who understands the system and therefore facilitates outside crime syndicates to access customer accounts,” said Aly Khan Satchu, an independent analyst in Nairobi.

In the past few months, there have been elaborate plans by leading commercial banks to move away from magnetic strip plastic cards to those that have chip technology. Although chip cards are not 100 per cent foolproof, they are three times more secure than the magnetic strip ATMs, prevalently used in the Kenyan market.

High costs

“Perhaps one of the reasons commercial banks have been slow to switch to chip technology is because of the high costs involved in deploying it. However, given the rising cases of ATM thefts, banks have no choice but to move into chip technology,” said Satchu.

While commercial banks keep all ATM break-ins within themselves, the crime syndicate appear to be taking advantage of this and thus getting bolder and more daring.

“Many institutions prefer internal resolution of fraud cases than referral to the law enforcement agencies, mainly due to reputation risk,” said Robert Nyamu, a forensic director at Deloitte. This was at a recent forum discussing a report by the audit firm.

Facts and figures on the extent on fraud within the banking industry are perhaps some of the well-kept secrets, with executives preferring to share information within the bank.

Insider dealings

Latest figures from Deloitte indicate that banks in East Africa lost Sh4.05 billion ($48.3 million) to fraud in the 18 months ended June last year, mainly through insider dealings.

The amount is equivalent to a full year profit for small or medium-sized banks in Kenya. But analysts point out that his figure is significantly understated because actual fraud statistics are difficult to determine owing to numerous unreported cases.

In the case of ATM fraud, available intelligence indicates that fraudsters use the skimming method, where a clueless customer at an ATM leaves a trail of information when transacting with the card.

A “skimmer” is mounted to the front of the normal ATM card slot that reads the ATM card number and transmits it to the criminals sitting in a nearby car.

Clever disguise

At the same time, a wireless camera is disguised to look like a leaflet holder and is mounted in a position to view ATM PIN entries.

The team sits nearby receiving the information-transmitted wireless over weekends and evenings from equipment they install on the front of the ATM. The equipment used to capture your ATM card number and PIN is cleverly disguised to look like normal ATM equipment.

The thieves copy the cards and use the PIN numbers to withdraw thousands of shillings from the many accounts in a short time, directly from the bank ATM.

A damaging report by Deloitte has disclosed that in 2011, commercial banks in East Africa lost huge sums, with most fraudulent schemes executed with tacit support from insiders. 

According to report, while electronic platforms were introduced by the banking industry to speed up clearance of paper cheques, these modes have become popular targets for techno-savvy fraud rings.

Also targeted

The insurance industry, a key pillar of the financial system, has also been a target for fraudsters due to the huge funds it is sitting on.

While banks acknowledge that fraud is a challenge, most players will not disclose the extent to which they are affected.