ATMs across the country will soon be required to contain sensors that detect tampering, following a soon-to-be released directive from Qatar Central Bank. The move is part of the authority’s increasing efforts to combat debit card fraud, a senior QCB official has told Doha News.
Earlier this month, the financial regulator ordered banks to beef up anti-fraud education of customers in addition to reinforcing an existing prohibition on using debit cards to make online purchases without entering a personal identification number (PIN).
ATMs are commonly used in Qatar because so many transactions here require cash, and there is no fee to transact at a machine that isn’t from one’s own bank.
The soon-to-be mandated ATM anti-theft technology aims to tackle “skimming,” in which thieves place an inconspicuous device on an ATM card reader to capture data contained on a card’s magnetic strip as it is slid into the machine. Meanwhile, a hidden camera records the personal identification number entered by the cardholder.
Armed with that information, thieves make replicas of the cards and rapidly drain an individual’s account.
While these attacks occur around the world, experts say thieves go wherever they find vulnerabilities. This means authorities are under constant pressure to add new layers of security.
“We can’t stay still,” said Abdul Hadi Ahen, the acting director of banking, payments and settlements systems department at the Qatar Central Bank. “It is part of the game.”
It is not clear if instances of fraud are increasing in Qatar. Ahen declined to provide details on the frequency of debit card fraud here, and several experts told Doha News that financial institutions typically keep such information under tight wraps.
New measures
QCB is in the process of testing the tampering sensors, which would alert guards to begin visually monitoring the activity via security cameras at the ATM. If it turns out to be a bank customer fumbling with their card, no action is taken. If the activity is suspicious, the ATM can be shut down remotely, and the authorities notified.
Additionally, banks in Qatar will soon be required to install plastic shields over keypads to prevent an overhead camera from recording PIN numbers.
Ahen said there is no firm timeline for the new rules to take effect.
Meanwhile, QCB has also closed a loophole in using debit cards for online shopping. Qatar has already restricted the use of debit cards to transactions where the customer must enter a PIN to authorize the purchase.
But Ahen said it came to the central bank’s attention that some local financial institutions were routing transactions through payment processing systems outside Qatar that didn’t require PIN authorization – presumably through Visa and Mastercard.
To close this gap, the authority sent a directive to the country’s banks earlier this month, reminding them that debit cards cannot be used for online shopping.
“There was a hole. I closed it,” he said.
Ahed added that merchants who want to accept online debit card payments can enroll in QCB’s payment gateway, QPAY, which has a feature that allows customers to enter their PIN through an encrypted platform.
The recent QCB directive also instructed banks to do more to educate their customers about preventing banking fraud. This includes, for example, not opening “phishing” emails that appear to be from a bank that ask customers to submit their bank card number.
It appears some local banks went even further. In a text message sent to clients earlier this month, Qatar International Islamic Bank advised customers to change their PIN at the closest ATM.
“Awareness and education are the most important ways of combating fraud,” Ahen said.
Why thieves come to the Middle East
Part of the challenge in understanding the scope of the problem is that financial institutions don’t like to talk about specific cases.
Indeed, a survey of Qatar bankers conducted several years ago found that 56 percent of respondents would not publicly report cases of fraud, likely out of fear of damaging the public perception of their company, according to Qatar University professor Nitham Mohammed Hindi. He co-authored a paper on the local industry’s perceptions towards fraud in 2008.
The study was based on 198 confidential surveys submitted by bankers from 10 local financial institutions. Eighteen percent of respondents said they’ve seen evidence of illicit use of ATM cards in Qatar, making it the fourth-most common type of bank scam visible to bank officials, behind credit card theft (31 percent), misappropriation of company resources (22 percent), and bribery (19 percent) and tied with theft, Hindi told Doha News.
He speculated that QCB has statistics showing that debit card theft has become more of an issue in recent years, given its recent efforts to fight that particular form of fraud.
Both Hindi and Ahen noted that a thief who gains access to an individual’s ATM card can cause more damage than with a credit card, because they can wipe out bank accounts quickly, and there are less limits and controls to halt transactions.
Another expert said ATM card skimming comprises the bulk of theft-related problems for financial institutions.
“That’s the biggest concern that the banks have,” said Robert Penn, Middle East general manager of ACI Worldwide, a company that helps banks minimizes fraud-related losses.
He said that there is nothing that makes the Middle East more or less attractive to thieves, although he noted that Qatar’s wealth and growing population make the nation’s bank accounts a lucrative target.
He added that the weaknesses lie in the United States and several Eastern European countries that don’t require debit cards to contain chips for payment processing.
This means that thieves come to countries such as Qatar, steal the information contained on cards’ magnetic strips, dump it onto a blank or “white” ATM card, and then travel to those other nations where the new cards can be used to withdraw large sums of money.
“Fraud just moves around and goes to wherever the weakest link is.”