Last month I wrote about the shift in threats to ATMs. Explosives and cash trapping are on a sharp rise. The ATM Security 2011 conference in London confirmed this but also speculated that insider threats using malware attacks also will rise.

The conference highlighted that 80% of unauthorized withdrawals against European chip cards now come from American ATMs. It also had a couple presentations with control suggestions for solid and gas explosive attacks.

The increase in the number of ATMs in unsecured locations has presented criminals with new opportunities for brute force attacks such as burglaries, explosive attacks and ram raids. This case study will show how the use of an indelible security ink can successfully mark cash as stolen in the event of an attack.

But the most interesting ATM security news of late is an announcement from the Banque Populaire du Rwanda. allAfrica reported yesterday that people with a mobile phone and without bank accounts can now withdraw money from the ATMs using only a denomination and a PIN-code:

[The Bank’s Head of Marketing and Product Development, Richard Ndahiro] explained that a BPR account holder can send money from his/her bank account using a phone to the receiver who gets a pin number and the amount.

“The receiver pushes a pin code and amount received on the mobile phone on any BPR ATM to access the money,” he said, explaining that the bank has introduced alternative banking channels and streamlined its operations for better services.

Currently, BPR has over 1.4 million clients, with 190 branches….

It is free for both sender and receiver. Of course mobile phones may be shared, so it could be people without mobile phones and without bank accounts can withdraw cash from ATMs. In other words cash can be withdrawn without any trace of identity information for the cash recipient. This seems to be a new direction from the South African FNB system, which used mobile phones as authentication to replace ATM cards, and quite unlike the fingerprint requirement of NCR.

While the card brands say America is past the tipping point for chips to be added to cards to reduce cash withdrawal fraud, Africa appears to be quickly headed towards obsoleting cards altogether.