Crores swindled from banks as fraudsters exploit design flaw in ATMs

A fraud unravelling in Punjab and Kerala has exposed a secret fear the country's banking system has been living under for more than a year. Fraudsters appear to have stolen crores of rupees from several Indian banks, cleverly exploiting a design flaw in their automated teller machines (ATMs) and their networked nature.

While several banks have executed design changes in their cash machines to combat it, many of India's one-lakh plus cash machines still remain vulnerable to this so-called 'transaction reversal' fraud.

The technique employed in the fraud is simple and involves withdrawing money from an ATM machine, taking out a part of the currency notes it throws up and letting the machine swallow the rest. Since the machine cannot count the retracted notes, some banks credit back the entire amount to the account.

So if a customer withdraws Rs 10,000, pockets Rs 9,000 and lets the machine retract Rs 1,000, some banks record the transaction as null and the entire Rs 10,000 remains in the account. Most ATMs are designed to retract the cash if the customer does not pull it out within 42 seconds.

Kerala-based Federal Bank has lost Rs 75 lakh to a Punjab gang that attacked its ATMs across the country using this method. Police in Kerala and Punjab made the first arrests in such cases in the country this week. "The surge of such fraud occurred in late March and April.

That is when it came to our attention. We have subsequently scrutinised all transactions and filed more than 30 police cases across the country," said TS Jagadeesan, chief general manager of Federal Bank. Apart from various police stations in Kerala and Punjab, the bank has filed criminal complaints in Coimbatore, Bangalore, Mumbai, Chandigarh, Gurgaon and Panipat.

Police in Kerala and Punjab have arrested six men from the north Indian state. Officials said the accused had confessed to extracting Rs 2 crore using this method. This means another bank or other banks together have lost as much as Federal Bank just to this one gang.

The gang, headed by one Sumit Gupta of Punjab, predominantly used ATM cards procured from a leading private sector bank using forged documents, one Kerala police official said. Cards of banks such as ICICI Bank, HDFC Bank and State Bank of India have been used by the gang, the official said.

The rise of transaction reversal fraud had caused so much concern that in January, National Payments Corporation of India (NPCI), the intermediary for inter-bank transactions, asked all member banks of the National Financial Switch to disable the cash retraction facility from their ATMs.

The move was discussed and approved by the Reserve Bank of India. The circular asked banks to comply by March 31. NCPI operates the National Financial Switch that connects India's nearly Rs 1 lakh ATMs (Rs 99,200 as of May; Rs 1,500 added each month).

NCPI Chief Executive AK Hota said the first such fraud was reported at an ICICI Bank ATM in 2010. But the matter became more serious in 2011, when Andhra Bank lost Rs 17-18 lakh to this method of fraud. Much of this was later recovered.

Subsequent to the Andhra Bank episode, a steering committee of the National Financial Switch recommended in April last year that the cash retraction feature in ATMs be deactivated.

During periodic cash reconciliations in ATMs, banks were unable to ascertain whether the shortage was due to ATM error, transaction reversal fraud, or fraud by employees loading the cash. So a pilot study was undertaken and disabling of cash retraction was found to be an effective way of countering the fraud.

Even though NPCI asked all banks to comply by March, Hota said some banks are yet to complete the exercise. The change involves upgrading backend servers as well as changes in individual machines.

Depending on the vendor and number of ATM machines owned by a bank, the cost of this process worked out to Rs 800 to Rs Rs 2,500 per ATM. The ATM market in India is dominated by American firms NCR and DieBold, as well as Germany's Wincor Nixdorf.