TITLE
DESCRIPTION
Technical Field
Devices for combating fraud The present invention relates to devices for combating fraud and in particular to antiskimming devices that can be used to alert banks and/or other interested parties that a cash machine (sometimes called an automatic telling machine or ATM) has been tampered with.
Background Art
Cash machines usually have a front panel that contains a card reader, a display screen, a number of selection buttons, a keypad and a money dispenser unit all under the control of a central processor unit (CPU). When a person wants to withdraw money from their bank account or credit card account, they insert their bank, debit or credit card into the card reader. The card reader reads the account details that are stored on the magnetic strip on the back of the card and the person is prompted by a message on the display screen to enter their four-digit personal identification number (or PIN) using the keypad. When the PIN has been entered and verified, the person is prompted by a second message displayed on the display screen to select the required amount of money using the selection buttons.The money dispenser unit is then controlled to dispense the appropriate amount of money to the person.
Many cash machines are located outside and are available for use 24 hours a day. These cash machines normally have some form of integrated lighting unit so that the front panel is well illuminated at all times. The lighting units are often conventional bulbs or fluorescent tubes, but light emitting diodes (LEDs) can also be used and have advantages because of their low power consumption and longevity.
Tampering with cash machines (so called "skimming") is becoming an increasingly popular crime in the United Kingdom and elsewhere around the world. There are many different types of skimming. In a typical case, a false or dummy panel is placed over all or part the front panel of the cash machine so that the card reader is covered. The false panel includes its own card reader with the intention that a person will unwittingly insert their card into this card reader instead of the one that has been covered. The account details of the person are then read by the card reader in the false panel and stored until the false panel is retrieved and the information is downloaded. In other cases, the account details can be transmitted directly from the card reader to a nearby laptop computer, for example.Once the account details of the card are known, they can be used to purchase goods over the telephone and the Internet. The card itself can also be replicated or "cloned" one or more times and then distributed so that goods can be purchased directly from shops and retail outlets.
In the above case, no cash is dispensed and the person may therefore not be alerted to the fact that tampering has taken place. However, some people may just think that an error has occurred and walk away as soon as the card reader in the false panel returns their card. The first time that they will realise that something is wrong is when they see that their bank account or credit card account has been debited without their authorisation.
In another case, the card reader in the false panel is positioned directly in front of the opening of the proper card reader in the front panel of the cash machine. When a person inserts their card into the card reader in the false panel, the card reader reads the account details that are stored in the magnetic strip on the back of the card and then immediately inserts the card into the proper card reader. The person is therefore prompted by a message on the display screen to enter their PIN in the usual way. A camera or other optical device is used to record the PIN as it is entered into the keypad. The money dispenser unit will dispense the appropriate amount of money and the card is returned. The person is not normally aware that any illegal activity has taken place. Eventually, the false panel and the camera will be retrieved and the account details and images are downloaded.The images can be processed to reveal the PINs entered during the time in which the false panel was in position and these are then matched against the account details downloaded from the card reader.
The need to acquire the PIN associated with a particular card, bank account or credit card account is becoming increasingly important because of the recent move away from verifying transactions using a signature that is compared to the specimen signature on the back of the card to the more secure "chip and PIN" system. Here, a person inserts their card into a card reader unit that includes a display screen and a keypad. When prompted by a message on the display screen, the person enters their PIN using the keypad and once this has been verified against their account details then the transaction is complete and the card can be removed. Therefore, without the PIN the account details cannot be used to make direct purchases in shops and retail outlets.
The illegal acquisition of account details by skimming is costing banks and credit card companies many millions of pounds every year. It can also cause considerable distress and inconvenience to those persons whose bank accounts and credit cards accounts are affected. There is therefore a need for an effective and reliable solution to the problem of skimming.
Summary of the Invention
The present invention provides an anti-skimming device that can be included in new cash machines or retrofit to existing cash machines. It relies on the fact that all or part of the front panel of the cash machine (and in particular the part of the front panel adjacent to or surrounding the card reader) will be covered by a false or dummy panel.
The anti-skimming device includes a light sensor, a dialler unit and/or a control unit, wherein the light sensor is adapted so that if the amount of light detected by the light sensor falls below a predetermined level it outputs a command signal to the dialler unit which in turn sends a signal to a remote unit, and/or to the control unit which in turn performs a control operation.
The light sensor is preferably mounted at or near the front panel of a cash machine so that if a false or dummy panel is placed over the front panel, the amount of light detected by the light sensor will fall below the predetermined level and the light sensor will output a command signal to the dialler unit and/or the control unit. The predetermined level at which the light sensor is triggered can be adjusted depending on the location of the cash machine. For example, the cash machine might be located outside and include an integrated lighting unit to illuminate the front panel during the night. In this case the predetermined level can be set in proportion to the amount of illumination provided by the lighting unit so that the light sensor is not triggered by the loss of daylight.On the other hand, the cash machine might be located in a retail outlet such as a supermarket that is open 24 hours a day. In this case, the predetermined level can be set in proportion to the constant amount of ambient light provided by the retail outlet's lighting units.
The way in which the amount of light detected by the light sensor changes over time can also be monitored and used to determine whether or not a trigger is likely to be the result of skimming. For example, the anti-skimming device can be configured to ignore situations where the light sensor is only covered for a short period of time or where the amount of light falls gradually over a long period of time. The former could be indicative of a situation where a person accidentally places their hand over the light sensor while using the cash machine. The latter could be used to account for regular changes in the amount of light detected by the light sensor during the day and night. This would be particularly important for any cash machines that do not have their own integrated lighting unit.However, it will be readily appreciated that such cash machines may not be able to detect skimming if it takes place during the night because there will not be any significant change in the amount of light detected by the light sensor when it is covered by the false panel. For this reason it is expected that all cash machines that are located outside or in dark environments will include an integrated lighting unit.
One way in which the anti-skimming device may be circumvented is to place a light source on the reverse of the false panel. To counter this, the light sensor may be adapted to recognise the optical characteristics of the light that is emitted by the cash machine's lighting unit or by a stand-alone lighting unit that is included for this purpose. For example, if the lighting unit uses a particular type of fluorescent tube that emits light over certain predefined wavelengths then the light sensor can be adapted to recognise these wavelengths and to trigger if the amount of light having these wavelengths falls below the predetermined level.
It will be readily appreciated that the light sensor may be triggered in circumstances when a false or dummy panel has not been placed over the front panel. For example, the retail outlet's lighting units may be deliberately or accidentally switched off for a period of time or some other item might be temporarily placed over the front panel for some other legitimate purpose. The anti-skimming device can therefore be provided with reset means (either manually or remotely activated) so that it can be reset in the event of a false trigger. The anti-skimming device can also be deactivated if it is known in advance that the light detected by the light sensor will fall below the predetermined level for whatever reason.Alternatively, a second light sensor can be mounted on some other part of the cash machine remote from the front panel (or on a nearby wall or surface) so that the dialler unit and/or control unit can be reset or temporarily deactivated if the amount of light detected by the second light sensor also falls below a predetermined level. Such a condition would be indicative of a general reduction in the amount of ambient light in the area surrounding the cash machine rather than the localised reduction in the amount of light at the front panel that suggests that skimming is taking place.
The dialler unit can be a standard auto-dialler that is pre-programmed with one or more telephone numbers so that a signal can be sent to a remote unit using a Public Switched Telephone Network (PSTN), a digital network (such as the Internet) or a Global System for Mobile Communication (GSM) network, for example. The autodialler can be an SD1+ or SD2 auto-dialler supplied by Cooper Security Limited of Gloucestershire, United Kingdom. The SD2 auto-dialler in particular has the facility to log up to 128 separate events with time and date information. It can also store 10 different telephone numbers and can be controlled to send one common message or up to 8 user-defined voice or SMS text messages. The remote unit can be an electronic communication unit adapted to receive and display the signal from the dialler unit.The remote unit can be located at a call centre that is set up to monitor and act on calls from anti-skimming devices, a police station, a private security firm or the local branch or headquarters of the bank or credit card company, for example. The signal transmitted by the dialler unit can take the form of a text or voice message and can include location information such as the site address of the cash machine or a unique reference code, and timing information such as the exact date and time when the light sensor was triggered. It will be readily appreciated that the dialler unit can send more than one signal to a single remote unit or one or more signals to a plurality of remote units.
It is normal for the individual or individuals who are carrying out the skimming to remain in the general vicinity of the cash machine during the time when the false or dummy panel is in place. The police may therefore choose to dispatch officers to make an arrest or use any local CCTV cameras or video surveillance facilities that might be available to try and identify the individual or individuals.
The control unit can perform a variety of different control operations. For example, the control unit can shut down the cash machine to prevent the skimming from taking place. It can also activate an internal alarm in the bank or premises where the cash machine is located, or an external alarm to alert users. The control unit can also initiate some form of monitoring procedure by activating local CCTV cameras or video surveillance. Other control operations are possible and may be selected in accordance with the particular location of the cash machine and other operating parameters. It will be readily appreciated that more than one control operation can be performed either simultaneously or sequentially.
The dialler unit and the control unit can be integrated together to form a single electronic unit. The dialler unit and/or the control unit can also be connected to the central processor unit (CPU) of the cash machine. The CPU of the cash machine can also be modified to carry out the above-mentioned control operations so that it essentially functions as the control unit of the anti-skimming device.
The light sensor can be further adapted so that if the amount of light detected by the light sensor rises above a predetermined level (i.e. when the false or dummy panel is eventually removed) it outputs a command signal to the dialler unit which in turn terminates the signal to the remote unit or sends a further signal to the remote unit, and/or to the control unit which in turn performs a further control operation.
The anti-skimming device can further comprise a second light sensor adapted so that if the amount of light detected by the second light sensor rises above a predetermined level it outputs a command signal to the dialler unit which in turn terminates the signal to the remote unit or sends a further signal to the remote unit, and/or to the control unit which in turn performs a further control operation. Here, two light sensors are provided, one that is triggered when the false or dummy panel is placed over the front panel of the cash machine and one that it is triggered when it is removed.
The further control operation performed by the control unit can be the termination of the previous control operation triggered when the amount of light detected by the light sensor fell below the predetermined level. It can also be a different control operation. For example, the control unit can end the CCTV camera or video surveillance operations triggered when the skimming was initially detected by the light sensor and then shut down the cash machine until official investigations into the skimming are complete.
The light sensors are preferably photodiodes. However, it will be readily appreciated that any suitable light sensors such as phototransistors, photoresistors and photocells can be used.
The further signal sent to the remote unit may include timing information.
The dialler unit and/or the control unit can record the time when the signal is sent to the remote unit and/or the control operation is performed. The dialler unit and/or the control unit can also record the time when the signal to the remote unit is terminated, the time when the further signal is sent to the remote unit and/or the time when the further control operation is performed. Alternatively, these times can be derived from the timing information included in the signal or signals sent by the dialler unit to the remote unit. Any other times determined during the operation of the anti-skimming device can also be recorded.
Once the period over which the skimming took place has been properly established, any cards that were used to withdraw money from the cash machine during this period can be automatically cancelled and the owners of the bank accounts or credit card accounts can be notified.
The light sensor is preferably located adjacent the card reader of the cash machine because this is usually one of the parts of the front panel that is covered by the false or dummy panel. However, it will be readily appreciated that the light sensor can be mounted at any appropriate place. If light can pass through part of the front panel (i.e. it includes an optical window) then the light sensor can be mounted behind the front panel of the cash machine so that its location cannot be easily determined.
The anti-skimming device preferably includes two or more light sensors, wherein each light sensor is adapted so that if the amount of light detected by the light sensor falls below a predetermined level it outputs a command signal to the dialler unit which in turn sends a signal to the remote unit, and/or to the control unit which in turn performs a control operation.
The light sensors can be mounted at different parts of the front panel so that there is a good chance of at least one of them being covered by a false or dummy panel.
Drawings Figure 1 is a view showing the front panel of a cash machine; and Figure 2 is a schematic diagram showing the component parts of an anti-skimming device according to the present invention.
With reference to Figure 1, the front panel of a cash machine includes a card reader 2, a display screen 4, a number of selection buttons 6, a keypad 8 and a money dispenser unit 10 all under the control of a central processor unit (CPU) (not shown). Two pairs of photodiodes 12a and 12b are mounted at discrete locations on the front panel. One of the pair of photodiodes 12a is mounted adjacent the card reader 2. The other pair of photodiodes 12b is mounted in an upper corner of the front panel in an area that might be covered if the false panel (see below) includes a camera or optical device for reading the PINs as they are entered using the keypad 8. Each pair of photodiodes 12a and 12b contains a first photodiode (labelled "Photodiodel" in Figure 2) and a second photodiode (labelled "Photodiode2" in Figure 2).
When skimming takes place, a false or dummy panel (not shown) is placed over the front panel. The false panel will have its own card reader and it will almost always cover the card reader 2 so that a person will unwittingly insert their card into this card reader instead of the one that has been covered.
With reference to Figure 2, the photodiodes 12a and 12b are connected to a standard auto-dialler 14 (such as the SD2 auto-dialler mentioned above) and to an electronic control unit or processor 16. The auto-dialler 14 is pre-programmed with a telephone number so it can send a text message to a remote unit (not shown) located in a call centre or a police station, for example. The text message will be sent along the Public Switched Telephone Network (PSTN) lines 18.
The control unit 16 can be used to perform control functions. For example, the control unit 16 can be connected to the CPU (not shown) of the cash machine so that is can command the CPU to shut down the cash machine. The control unit 16 can also be connected to an external or internal alarm system, or to the controller of any local CCTV camera or video surveillance system.
The operation of the anti-skimming device will now be described. When the false panel (not shown) is placed over the front panel of the cash machine, the first pair of photodiodes 12a adjacent the card reader 2 are covered. The amount of light detected by the first photodiode (i.e. "Photodiodel") will therefore fall below a predetermined level that is set in accordance with the location and operating parameters of the cash machine. The first photodiode is therefore triggered and outputs a command signal to the auto-dialler 14 and the control unit 16. The auto-dialler 14 obtains a dial tone and dials the pre-programmed telephone number to send the text message to the remote unit. The text message contains location information in the form of the address of the cash machine and timing information in the form of the exact date and time when the first photodiode was triggered.The remote unit will display the signal to an operator at the call centre or to a police officer at the police station, for example. The control unit 16 can perform a control operation such as starting CCTV camera and video surveillance of the cash machine and the surrounding area.
When the false panel is eventually removed (normally 20 or 30 minutes later), the amount of light detected by the second photodiode (i.e. "Photodiode2") will therefore rise above a predetermined level that is set in accordance with the location and operating parameters of the cash machine. The second photodiode is therefore triggered and outputs a command signal to the auto-dialler 14 and the control unit 16. The auto-dialler 14 obtains a dial tone and dials the pre-programmed telephone number to send a further text message to the remote unit. The further text message contains timing information in the form of the exact date and time when the second photodiode was triggered. The control unit 16 can perform a control operation such as ending the CCTV camera and video surveillance of the cash machine and the surrounding area and shutting down the cash machine.
The timing information in the text messages sent by the auto-dialler 14 allows the period of time during which the skimming took place to be determined. Any cards that were used to withdraw money from the cash machine during this period can be automatically cancelled and the owners of the bank accounts or credit card accounts can be notified.