Need Cash and Wish to Rob an In-Store ATM Kiosk? Wish Again...

During a recent visit to Costco, I noticed a technician opening the admin panel in order to begin repair of a CardTronics logo “Need Cash?” in-store automated teller machine (ATM). Since I am curious about ATM technology, I approached the ATM with my camera ready. As I arrived, the technician opened a drawer, which supports the front panel and customer interface.

Unlike a bank ATM, the CardTronics in-store ATM accepts no deposits. Its functions include cash dispensing, charging user fees and indirectly, facilitating cash purchases at Costco. No one outside of those two companies knows commission CardTronics pays Costco for that lucrative site. I know that CardTronics pays merchant commissions because I Googled “CardTronics+ATM+commission”. On page one of the search results I found a LinkedIn profile for a CardTronics employee. He listed his job title as “Merchant Commission Analyst”. We expect CardTronics to retire that job title soon. Sorry Charlie, but you should know that LinkedIn is public on the internet.

CardTronics is ubiquitous in the arena of freestanding, kiosk-focused financial services. With over 50,000 locations, CardTronics is the largest provider of retail ATM services in the world. Within ten miles of my own location, CardTronics has ten ATM’s ready to dispense cash for a fee. With all of their money, I wondered what integrated ATM solution CardTronics might install at Costco. I can tell you here, the answer surprised me.

Rather than a futuristic electronic ATM-marvel, the unobtrusive gray and black cabinet featured thirty-year-old technology. Up front, are a keypad, cash dispenser, receipt printer and a low-resolution display. That customer-interface module slides in and out of the cabinet on drawer glides. Bolted to a shelf high inside the cabinet is a bare-bones personal computer (PC) chassis. Showing its age, the PC features both a CD-drive and a 5.25” floppy-disk drive. If the boot sequence for the ATM fits on a floppy disk, the kernel of the operating system must be quite small.

By then I realized that the ATM was an old workhorse. Manufactured by NCR Corp. under their now retired EasyPoint trademark, the ATM features an Intel x86 processor, introduced in 1981 and the IBM OS/2 operating system introduced in 1987. During the early 1980s, IBM and Microsoft (MS) jointly developed OS/2. The unusual corporate collaboration was a joint offensive and countermeasure to growing cyber security threats. “Antivirus” updates became a nuisance for users of the fledgling Windows operating system. Despite IBM OS/2’s ability to deflect foreign executable instructions, MS Windows went on to dominance in the PC marketplace. This Costco ATM, running OS/2 in “protected mode” is virtually a closed system.

Having lost faith in their old operating system, IBM abandoned support for OS/2 in 2006. Even so, electronic ATM thieves should not waste time writing OS/2 scripts with instructions for “cash on demand”. A pair of copper wires connects the PC modem-port to the telephone network. My friend Tom Shudic helped determine how such ATMs prevent unauthorized outside access. According to Tom Shudic, “Those two wires must be a bidirectional interface, although surely with some sort of very high security protocol - perhaps even a dedicated line”. That, combined with the OS/2 operating system’s ability to block unauthorized access may explain the lack of remote control ATM robberies. Even the Russians could not hack that connection.

The only ways into an NCR EasyPoint/OS/2 ATM is with a key, a high technology cutting torch or using a battering ram. One could use an explosive, but that might destroy the cash, as well. Bank robbers seeking electronic entry to an old CardTronics in-store ATM now see that it is a waste of time and effort. Regardless of their chosen operating system, I hope that the current NCR SelfServ in-store ATM’s are as robust.

Physically, the cash cassettes are stored behind steel doors, in the base of the kiosk. Short of ramming it with a Mack Truck, you will not achieve a break in of a CardTronics kiosk ATM. Even if upended, steel plate protects the integrity of the ATM vault compartment. If any of our readers clicked here to learn techniques for in-store or electronic ATM robbery, you may now depart wiser and less likely to try such larceny.