Why default passwords are a problem

An ATM has a management menu for setting fees, running reports and telling the machine what notes are in each cassette. Whoever has the password has a lot of control.

The classic attack is denomination fraud. Someone gets into the management settings, often with the manufacturer’s default passcode, and tells the ATM its $20 notes are $1 notes. Each withdrawal then pays out twenty times what it should. In one US case reported in 2014, a former insider used a default operator code this way and took about US$400,000 over 18 months.

Manufacturers have tightened up. Triton once printed default passcodes in its service manuals, which were easy to find online. It has since removed published default passwords, so new owners must create their own master password at set-up. Triton ATMs now also need access to the cash vault before the denomination setting can be changed.

One person, one code

A shared code tells you nothing when something goes wrong. If five staff use the same password, the log can only say “the manager did it”.

• Give everyone their own user code, with only the access their job needs.
• Avoid easy codes such as 1234 or 1111, and avoid birthdays. Triton warns against default and same-number passwords.
• Do not reuse a code across ATMs. ATMIA’s software security guide lists reused passwords and factory defaults as weaknesses that lead to denomination fraud.
• Never write codes on or near the machine.

Change codes when staff leave

The ATM Industry Association advises changing ATM passwords once a quarter or, at the very least, every time an employee with access to the passcodes leaves. The same guidance suggests changing them after service and cash management visits.

Make it part of your exit checklist, next to collecting keys and building access cards. Do it on their last day, not next month.

Don’t forget the safe combination

The management password controls the settings. The safe combination opens the vault where the cash sits. They are separate, and both need looking after.

• Keep the combination to the smallest possible group.
• Change it when anyone who knows it leaves, or if you think it has been seen.
• Never store it with the ATM keys.

Dash can change the safe combination for you, or walk you through it.

Check the log

Triton ATMs record denomination changes in the ATM journal, including whether a change failed and the user who was logged in at the time. On Dash ATMs, cash and denomination changes are logged to the user.

A log only helps if someone reads it. Look for changes made outside trading hours, codes you do not recognise, and any denomination change you did not ask for. If something looks wrong, call us straight away. Venues can view this activity in the Dash web portal.

Put it in writing

ATMIA also advises spelling out in contracts who is responsible for password security. If a manager, a cash crew and a technician all touch the machine, everyone should know who owns which code.

FAQ

Dash ATM has built and managed ATM networks across Australia since 2012, led by founder Paul Wrigley, in the ATM industry since 2002. Keep cash local.

Sources: ATM Marketplace, Finding solutions for denomination fraud · Triton, Denomination changes · Triton Technical Bulletin 18-15, ATM security alert · ATMIA, ATM Software Security Best Practices Guide v3 · Help Net Security, Default ATM passcodes still exploited by crooks (2014)