Bank of Russia Warns About New Type of ATM Fraud

The Bank of Russia has issued a warning about a new type of fraud involving ATMs. According to a review of cyberattacks in the financial sector for 2018, this scheme exploits flaws in the way some ATMs process peer-to-peer (P2P) money transfers between individuals.

How the Scam Works

This type of attack is classified as transaction reversal fraud (TRF). Here’s how it operates:

1. The fraudster selects the option to transfer money from one client to another at an ATM and enters the recipient’s card number.
2. The ATM sends two authorization requests—one to the sender’s bank and one to the recipient’s bank.
3. Both banks approve the transaction almost simultaneously. The recipient’s card balance increases, while the sender’s card has the transfer amount temporarily frozen.
4. Next, the ATM asks the sender to confirm the commission fee for the transfer. The sender (the fraudster) declines, and a cancellation message is sent to both banks.
5. The frozen funds on the sender’s card are released, but by this time, the recipient has already withdrawn the transferred amount.

Regulator Recommendations

To prevent this type of fraud, the regulator recommends that banks review and improve their ATM transaction processing scenarios. Suggested measures include:

• Sending approval for transaction cancellation to the sender only after receiving confirmation from the recipient’s bank that the transferred funds have been successfully returned.
• Obtaining the sender’s consent for the commission fee before sending any authorization requests for the transaction.

By implementing these measures, banks can minimize the risks associated with this type of ATM fraud.