OCC Bulletin: Cyber Attacks On Financial Institutions' ATM And Card Authorization Systems: Joint Statement

Summary

The members of the Federal Financial Institutions Examination Council (FFIEC)¹ today issued a joint statement to notify financial institutions of a large-dollar-value automated teller machine (ATM) cash-out fraud characterized as Unlimited Operations by the U.S. Secret Service. The members are aware of a recent increase in cyber-attacks on financial institutions launched in connection with this fraud to gain access to, and alter the settings on, ATM Web-based control panels used by small-to-medium-sized financial institutions.

Highlights

The members of the FFIEC expect financial institutions to take steps to mitigate this threat by ensuring that

each institution’s and service provider’s management of enterprise risk addresses this type of threat in its risk assessment process, and
controls associated with institution’s information technology networks, card issuer authorization systems, systems that manage ATM parameters, and fraud detection and response processes are reviewed for adequacy against this threat.

Note for Community Banks

Community banks with ATMs should work closely with their service providers and ensure that the providers are taking appropriate action to mitigate this risk.

Further Information

Questions regarding the FFIEC statement should be directed to the OCC’s Bank Information Technology Division at (202) 649-6340.