26, 1999, Senate Resolution No. 134, offered by Senator Doris C.
Karpiel, was adopted by the Senate. The resolution requests the
Office of Banks and Real Estate to study safety and security issues
surrounding the use of automated teller machines ("ATMs") by
consumers. In particular, Resolution No. 134 requests the Office of
Banks and Real Estate to report on the relative merits of a
particular ATM security devise, the reverse PIN safety system.
Accordingly, this report does not address other related technology
such as shared networks, point-of-sale terminals, or "smart"
continues to grow at a staggering rate. These machines extend
traditional banking hours by dispensing cash and making other
transactions available 24 hours a day. Approximately 12 billion ATM
transactions take place per year at thousands of ATMs.
there is no precise data on ATM crime, violent crime against ATM
users is relatively rare. Over the decade of the 1990s, ATM crime
has actually decreased from approximately one crime per one million
ATM transactions to one crime per 3.5 million transactions. At the
same time, the use of ATMs has significantly increased.
Nevertheless, public perception of significant crime at ATMs exists.
To deal with the crime that does occur, the General Assembly adopted
the Automated Teller Machine Security Act in 1996 which deals with
the main concerns of ATM safety and security - location, lighting,
and landscaping. This legislation provides a safe harbor from legal
liability to ATM operators with regard to security
Technological advances have
brought about proposals for additional ATM security measures. These
include enclosed ATM structures, closed circuit television cameras,
biometrics, alarm or "panic" buttons, and telephones at ATMs. The
reverse PIN warning system is one of these security
analysis of the reverse PIN warning system is specifically requested
by Resolution No. 134. The reverse PIN system attempts to utilize
current technology to provide law enforcement with the immediate
location and background information concerning a potential victim.
However, a consumer may be under too much emotional stress to
properly utilize the system, the system would be tremendously costly
to implement both as to hardware and software requirements, quick
response by police is not guaranteed, and no evidence exists that
the reverse PIN system would actually reduce crime.
Office of Banks and Real Estate recommends:
- That the relevant
law enforcement agencies gather statistical and other data
concerning ATM crime. At present, it is difficult, if not
impossible, to recommend additional safety measures for ATMs
because of a lack of reliable data. Reports of ATM crime are
usually included as part of larger categories such as theft or
- That the financial
services industry, the law enforcement community, consumer
protection groups, and other interested parties study whether the
reverse PIN system is suitable and desirable for use in this
- That statutory
proposals affecting ATM security be introduced as amendments to
the ATM Security Act to maintain the comprehensive nature of the
Act as to ATM security matters.
Automated Teller Machine
A Brief History of Bank Security
Historically, banks have been
targets for economic crimes. As the U.S. economy developed from a
barter to a currency based system, financial institutions assumed a
risk of loss proportionate to the increase in use of paper money.
Exchange and storage of currency created a new area of concern for
banks: security for these assets. Banks initiated security systems
and continually adapted them to meet changing needs.
security has largely been a matter of privately funded protective
services [as opposed to public law enforcement] to safeguard life,
property, and business interests against crime. Private security
includes protective services and devices, and private resources
necessary to investigate crime. The nation's first banks relied on
an unsophisticated watchman service for nighttime protection or
required the cashier to live on the bank premises for safety of the
bank's assets. Today, the banking industry has available for its use
a well-rounded contractual security system offering alarm, armored
car, guard, and investigative protective services.
Expanded Use of Debit Cards
introduction of the first automated teller machine ("ATM") debit
cards in the early 1970s, significant electronic technological
progress has occurred in the banking and financial industry.
Consumer acceptance of electronic banking continues to drive many
developments in the financial industry. The financial community
continues to offer new electronic banking and money services to a
population of households who are becoming more literate in
electronic banking concepts. Government regulation also contributes
to an increasing number of debit card users. For example, beginning
in 1996 all federal government payments to people newly receiving
salary or benefits and all payments to companies for new contracts
with the federal government must be made electronically. Typically,
many people not having a debit card who start receiving funds from
the government electronically will become new debit card users. In
addition to protecting currency and guarding against electronic
fraud, there must be a continuous risk assessment of personal safety
factors to ATM service employees and consumers who use ATMs by banks
and ATM operators.
Automated Teller Machines
extend traditional banking hours by dispensing cash and making other
transactions available 24 hours a day. At the beginning of 1974,
there were only 1,656 operating ATMs nationwide. Today, online debit
cardholders initiate approximately 12 billion ATM transactions per
year at thousands of ATMs.
electronic debit card transaction volumes continue to increase with
the installation of more ATMs, banks must adopt special security
considerations for the ATM environment. On-premises ATMs (those
typically located in bank lobbies) provide the most suitable working
environment for the consumer. The trend towards installation of free
standing machines in shopping malls, in free standing kiosks in
parking lots, supermarkets, and office buildings obviously presents
a whole new array of security problems for ATM operators.
Security Considerations for Debit Card
Currently, major law enforcement
agencies do not regularly keep track of ATM crime. Most assaults
related to ATM usage are included in larger general categories for
assault, battery and the like. Special studies conducted from time
to time have shown a relatively low rate of ATM crime. Although
there is no precise data as to the extent of violent crime
perpetrated against the users of ATMs and night depositories,
assaults on bank customers who use these facilities occurs
infrequently. It is estimated that currently about one in every 3.5
million ATM transactions result in a robbery of the customer. This
is less than the estimated one in every million transactions
occurring in 1989. While crime at or near ATMs may not be on the
rise, public fear of ATM-related theft is increasing.
is a street crime conducted at an ATM. Most ATM robberies occur at
night between 8:00 p.m. and midnight. Most robbery victims are
women, are alone when robbed. Most claim they never saw the robber
coming. The typical ATM robber is 25 years of age, works alone, and
usually positions himself nearby waiting for a victim to approach
and withdraw cash.
research by the American Bankers Association has shown that of all
steps that can be taken to improve customer security, careful
attention to the "three Ls," location, lighting, and landscaping,
produce the best results.
location of ATMs is the single most important issue relative to
customer safety. In determining the placement of new ATMs, the
following guidelines are recommended:
- Design the site so
that customers using the machine have high visibility of their
- Design vestibules
so as not to limit visibility of customers while using the ATM,
evaluate the following: use of convex mirrors and minimal use of
solid walls and blinds.
- Place ATMs near
well-lighted parking areas.
- Place ATMs where
they will have "drive-by" visibility from all nearby parking
lots, walkways, and main thoroughfares.
- Prepare a crime
profile of the area around the ATM.
following are suggestions for lighting levels needed to achieve
effective customer safety. Lighting intensity is measured in
footcandles ("F.C."), or candlefeet.
- Within a 5-foot
radius of the ATM, maintain a 10 F.C. minimum, measured at 36
inches above ground.
- Within 50 feet of
the ATM, including the nearest available parking location,
maintain a 2 F.C. minimum, measured at 36 inches above
- Plant slow-growing
shrubbery that needs trimming less frequently.
- Trim shrubbery to
a maximum of 24 inches above ground level. Trees should be
"branch free" below the 6 foot level.
- Monitor the growth
of shrubbery on a regular schedule.
- Assess the
placement of other objects that could block vision (e.g., walls,
benches, and dumpsters).
addition to the "three Ls," education is one of the best ways to
deter ATM crime. Surveillance cameras and other devices can lead to
a false sense of security among consumers. Customers will avoid
crime if they only use ATMs at certain times and locations. Not
using ATMs in poorly lit locations at night alone will deter
PIN Warning Safety System
Most customers obtain ATM
service by inserting a card into a machine and entering a personal
identification number, commonly referred to as a "PIN." The reverse
PIN warning safety system is one product that claims to offer added
security to customers in the event of a robbery while using their
ATM. Zi Cubed, Inc. (www.zicubedatm.com) markets the SafetyPIN ATM
security system, a reverse PIN safety system. On March 24, 1998, a
patent was issued for this product.
How the Reverse PIN System
issuers typically issue one PIN to a customer. Under the Zi Cubed
system, customers are assigned an emergency second PIN which is
usually the reverse of their original number. For example, if 1234
were an individual's PIN, then the emergency PIN would be 4321. If
the PIN were 2442, then the emergency could be 4224. If the
emergency PIN is entered, presumably during a robbery, the ATM
processing main computer sends a distress message to the local
police department. In addition to the location of the ATM, police
could find out who the customer was with information taken from the
customer's bank account records. Police could also access a
description of the customer from the Secretary of State's Drivers'
Services Division. By the time police reach the ATM they would know
who the customer is, what s/he looks like, and where s/he
reverse PIN system has not been sold to any financial institution
yet. Marketing efforts have centered around customers' fear of ATM
crime and on ATM operators' fear of litigation for failure to take
sufficient safety precautions.
special study by the Chicago Police Department shows that 47 ATM
crimes were committed that year in Chicago, the jurisdiction with
the largest number and concentration of ATMs in the Illinois. The
trend of ATM crime has declined. However, public perception appears
to be that ATM crime occurs more frequently. Adoption of the Zi Cube
system may alleviate some customers' fear of crime, whether real or
deterrent affect of having such a system in place is another touted
feature of the system. However, deterrence does not prevent crime in
progress. More importantly, the law enforcement community does not
generally encourage resistance or confrontation to thwart theft or
robbery. The risk of physical harm to the customer is greatly
increased should they resist. When coupled with the fact that ATMs
generally limit withdrawals to approximately $200.00, engaging a
criminal in an altercation or otherwise offering resistance over
such an amount does not appear to be prudent.
Protection from lawsuits is
another claim of the Zi Cube system. The distributor claims that
merely installing this system will help rebut lawsuits alleging that
ATM operators are negligent in providing safety to customers. While
this argument may possess some merit in other states, this argument
is not as compelling in Illinois. Traditional legal defenses and
safe harbor provisions contained in the Illinois ATM Security Act
available to ATM operators will likely reduce litigation in this
area. See, Section V - ATMs and the Law.
human behavior must be taken into account. Being surprised by the
threat of bodily harm is extremely stressful. Severe stress such as
this impairs the thought process. Under these conditions, it is
difficult enough for many people to remember their correct PIN
number. It may be asking too much of a consumer to try to remember a
second emergency PIN. Criminals will undoubtedly be among the first
to know of a reverse PIN system and how it works. Any delays or
glitches incurred by a victim during an ATM crime could cause the
criminal to physically harm the victim.
Computer Interface Barriers
interface problems are estimated to be significant and costly in
implementing the reverse PIN system at this time. First, are the
limitations inherent in the use of PIN numbers. The system would
double the amount of PINs used per person.
conversion to this system requires a significant commitment in
resources to writing new computer software programs that recognize
the reverse PIN and then make multiple complex decisions. Currently,
ATMs communicate with banks and make what are termed "binary" (i.e.,
simple "yes/no") decisions concerning the account and transaction
information. Under the reverse PIN system, the main computer must:
(a) determine and communicate with the police station closest to the
ATM; (b) the computer must communicate with the bank account of the
cardholder and obtain account information that is usually
confidential and protected (this process is more complicated if the
ATM is not from the accountholder's bank); and, (c) the main
computer must then also communicate with the Secretary of State's
office for driver license information.
most law enforcement agencies do not have the computer capacity to
provide the necessary real time communication with an ATM. Many
police 911 units respond only to voice communication, although some
are now taking calls via the internet. In addition, there is no
assurance of immediate response by police agencies. This may result
from the huge number of calls handled in urban areas to the
geographic separation that occurs in rural locations.
the cost to reconfigure the ATM system, including shared ATM
networks, can be quite high. There are over 5,000 ATMs under
regulation by the Office of Banks and Real Estate. The physical
reconfigurations needed to make changes to machines have been
estimated at $1,500.00 to the thousands of dollars each. The minimum
impact is estimated to be at least $7,500,000.00. This does not
include the software programming costs. This estimate does not
include the additional costs associated with thousands of ATMs in
Illinois that are not regulated by the Office of Banks and Real
Estate. Too be fully functional, the Zi Cube system would have to
have communication capabilities with financial institutions
worldwide in order obtain customer account information. The system
would likewise have to communicate with driver license agencies or
similar authorities worldwide to obtain descriptive information
about the victim.
conclusion, significant barriers exist in the application of the
reverse PIN system at this time. In addition, there appears to be no
conclusive data or other information that shows that the reverse PIN
system would serve to decrease ATM crime any more effectively than
other security measures, if at all. Nevertheless, should individual
ATM operators and networks conclude that the reverse PIN system
provides benefits that justify the significant costs associated with
it, they may adopt such a system. Such reasons may include market
competition, consumer demand, experiences with lawsuits, or improved
continues to grow at a staggering rate. At the same time, crime
rates have dropped from an estimated one in one million transactions
in the early 1990s to one in 3.5 million transactions in 1999. The
late 1980s and early 1990s saw a growth in the amount and perception
of ATM crime. As a result, in 1990 and 1993, the City Council of
Chicago conducted extensive studies as ordinances dealing with ATM
security were considered. The ordinance adopted was superseded by
the Illinois ATM Security Act. See, Section V - ATMs and the Law.
Many of the findings and recommendations of these studies, however,
are still considered relevant today by persons involved in the field
of ATM security. Accordingly, a summary of these studies is included
City of Chicago ATM Security Advisory Committee
Security Advisory Committee highlighted six conclusions:
widespread incidence of robbery or assault at ATMs exist.
institutions have responsibly provided for consumer safety in
terms of guards, restricted access and/or combinations of
- Current ATM users
are generally satisfied with current safety provisions at
- There is room for
improvement in communications between the Chicago Police
Department and financial institutions with respect to identifying
ATM crime trends and preventing ATM crime.
- No additional
technological enhancements are available and practical to enhance
ATM security (911 applications were explored, but were deemed
inappropriate because they were only available for voice
communications and no proof existed that they could prevent
- It would be
inappropriate to mandate uniform ATM standards since all sites are
The Committee made four
Chicago Police Department and financial institutions should
establish formal procedures to:
- track ATM
determine incremental crime prevention strategies,
- The Chicago Police
Department should appoint a liaison for ATM issues (initially
the Deputy Chief of the Administrative Section of the Detective
- The Chicago Police
Department should collect, analyze, summarize, and make
available all data on incidents of ATM crime to determine trends
and assist in future prevention of ATM crime and apprehension of
perpetrators of ATM crimes.
- The Chicago Police
Department should receive and review through the wall 24 hour
access ATM building permits obtained from the Dept. of Buildings
and, when appropriate, advise the deploying financial
institution of security concerns.
- The Chicago Police
Department should develop training programs on ATM security for
police personnel and community groups.
- All Chicago
financial institutions should be given an ATM security checklist
that encompasses issues that need to be considered regarding
safety (e.g., lighting, cameras, crime frequency in area, hours of
- The Chicago Police
Department and financial institutions should meet semi-annually to
review ATM security, stay abreast of emerging security technology
and evaluate their practical applications for ATMs.
- Consumer education
brochures should be circulated to all Chicago area financial
City of Chicago ATM Security Advisory Committee
Security Advisory Committee highlighted seven
- ATM crime had not
increased in recent years.
- Most financial
institutions had provided responsibly for consumer safety at ATMs
through use of guards, cameras, and/or restricted access
- Consumers were
generally satisfied with current ATM safety provisions and did not
perceive that ATM safety had deteriorated over the three previous
years. They feel that they are responsible for taking steps to
ensure their own personal safety at ATMs and would object to the
mandatory closure of all ATMs at night.
between the law enforcement community and financial institutions
seems to be effective although there is not now a formal vehicle
for this communications.
- There were no
technological enhancements that, if mandated, would materially
help to prevent ATM crimes from occurring or help law enforcement
officials intervene during crimes in progress. In fact, many
technological enhancements aimed at intervention (e.g. panic
buttons) would likely just result in the movement of crime to
different locations where victims are more susceptible.
- Mandating the
deployment of ATMs in all police and fire stations would not be
appropriate for various logistical reasons.
- It would be
inappropriate to mandate uniform safety standards for all ATMs
since there is a wide diversity in types and locations of ATMs.
Nevertheless, certain minimum standards would be appropriate for
ATMs that are either exposed to the street or located in an
unmanned structure, the sole purpose of which is to enclose the
Committee recommended that the City Council consider adoption of an
ordinance that would mandate certain minimum safety provisions for
- Adopt procedures for
evaluating safety at ATMs which are exposed to the street or
located in a building, the sole purpose of which is to enclose the
ATM. The procedures should consider:
obstructions in the areas around the ATMs
- incidence of crime
in the vicinity of the ATM as reflected in the records of local
law enforcement agencies and the institution's own internal
- Comply with minimum
lighting standards at all outdoor ATMs and all ATMs located in
structures, the sole purpose of which is to house the ATM.
- Distribute ATM
safety precaution information to each of their cardholders.
- Furnish, upon
request by the City Council, information regarding an
institution's compliance with the provisions of the ATM security
ordinance and information on ATM crime incidents at specific ATM
deployed by the financial institution.
and the Law
Liability for ATM-related Assaults
banks' and other ATM operators' unpredictable costs are those
associated with litigating civil suits alleging injuries resulting
from ATM operations. Those costs largely result from unanticipated
problems that have arisen in the legal context of ATM operations.
Generally speaking, money spent on compliance and safety could be
money well spent. In litigation, the fact that an ATM operator took
the steps needed to install an ATM properly and to light and
maintain it cannot be ignored.
Historic Sources of Liability
common law provides the historic basis for ATM case law. The common
law suggests that where a duty of care exists, and there is a
failure to observe the duty of care, and this proximately causes
injury, the conclusion is that the entity that failed in its duty
was negligent. A finding of negligence suffices for the imposition
of damages to compensate the injured party. When a business invites
people onto its premises, it can avoid liability to its invitees
(its customers) if it prevents reasonably foreseeable harms. In
Illinois, the inviter's liability for injuries sustained by a
customer rests on the inviter having superior or particular
knowledge of the danger. Therefore, generalized knowledge of crime
in an area does not usually create any special duty on the owner of
the premises. This rule constitutes a powerful defense for ATM
operators in lawsuits filed which simply allege that an operator
placed an ATM in a high crime area.
reviewing the law involving ATMs and civil liability, one fact comes
immediately to mind --- state law dominates this area of banking
law. ATM liability law is unusually unaffected by the Congress, the
federal agencies, and the federal judiciary. Illinois courts have
been reluctant to depart from the application of traditional common
law principles to ATM liability cases. Instead, the courts have held
that ATM security is a public policy matter best dealt with by the
legislature. In 1996, the General Assembly created a statutory
framework to address ATM security by enacting the Automated Teller
Machine Security Act. Among other things, this legislation affects
the standard of care required of ATM operators by providing a safe
Overview of the ATM Security Act
Automated Teller Machine Security Act, 205 ILCS 695/1, et
seq., in effect since July 19, 1996, provides that the
regulation of customer safety at ATMs located in the State of
Illinois is the exclusive function of the State. Likewise, the
regulation and licensing of ATM operators, issuers of access
devices, or persons who control an access area or defined parking
area are exclusive powers and functions of the State. The stated
intent of the General Assembly is to enhance the safety of ATM
consumers without discouraging the placement of ATMs at locations
convenient to consumers' homes and work places.
provides for minimum ATM safety requirements as follows:
- Section 10 of the
Act requires adequate lighting for ATMs, any defined parking
area, access area, and the exterior of enclosed ATMs.
- Section 15 of the
Act requires notices to customers of basic safety
- Section 20 of the
Act provides procedures for evaluating the safety of ATMs
regarding: (a) compliance with Section 10 lighting requirements;
(b) the presence of landscaping, vegetation, or other
obstructions in the area of the ATM, the access area, and the
defined parking area; and, (c) the incidence of crimes of
violence in the immediate neighborhood of the ATM.
- Section 35 of the
Act, a "safe harbor" provision, provides for a standard of care
in that substantial compliance with the Act constitutes prima
facie evidence that adequate and reasonable measures for the
safety of customers have been provided.
- Section 40 of the
Act provides for a statewide safety standard by including
customer safety as an exclusive power and function of the State
and thereby denying and limiting home rule powers, under Section
6(h) of Article VII of the Illinois Constitution, in the area of
ATM customer safety