ATM and Mobile 101

DEVELOPED AND PUBLISHED BY:

SPONSORED BY:

GUIDE

By Robin Arnfield, ATMmarketplace.com

FIS MOBILE The app that gets you cash.

100%9:41 AM

CARDLESS CASH®

CONVENIENCE ∙ SPEED ∙ SECURITY

3© 2015 Networld Media Group | Sponsored by FIS

The mobile phone has evolved from a tool used primar-ily for voice communications into a rich channel for data exchange and consumer interaction. The convergence of mobile communications with self-service means that mobile devices are becoming ATM access devices, able to offer many of the display and keyboard functions currently available on ATMs.

This report provides guidance for ATM deployers consider-ing the integration of their ATM and mobile channels.

Mobile-ATM integration means that a financial institution’s customers can use a smartphone to withdraw cash from ATMs without a debit card, and also use mobile devices to personalize their experience at the ATM.

This report examines the various methods used for mobile cash access: QR codes generated by a mobile banking wallet; NFC-based contactless transactions that use card data stored in a smartphone-linked mobile wallet; and one-time PINs generated by a mobile app. It also looks at the security issues associated with cardless cash access.

BenefitsAllowing customers to prestage ATM withdrawals on a smartphone offers a number of benefits, including:

• the elimination of card skimming;• the provision of an extra layer of authentication;• time-savings — prestaged transactions can cut ATM

session times by one-half or more;• increased loyalty among customers who appreciate

having the ability to use a mobile device to personalize their ATM transaction menu;

• ATM locator apps that allow customers to use the GPS technology in a smartphone to find (and get directions to) nearby ATMs — including surcharge-free machines;

• a new revenue opportunity — an FI can sell space on the back of the customer receipt, allowing nearby merchants to extend location-based offers to a nearby ATM user;

• service for un- and underbanked consumers who can use their smartphone to withdraw cash from a mobile wallet or other prepaid account;

• an attractive feature for younger consumers who want to use their smartphone in all areas of their life.

“Most FIs who are considering deployment of mobile cash access technology are looking at it because they want to be able to differentiate their service offerings from rival banks,” said Doug Hartung, Diebold Inc. director of global software research and strategy. “For example, if a bank only allows its own customers to use their smartphones to withdraw cash from its ATMs, as opposed to allowing non-on-us/off-us mobile ATM access, this could provide an interesting marketing opportunity. The bank could say in its promotional literature: ‘if you bank with us, you will be able to access our ATMs from your smartphone.’”

Providing mobile cash access allows smaller financial institutions to compete with larger banks that have yet to deploy the technology. “In the U.S., smaller banks are in-terested in deploying ATM-mobile cash access technology, as they see this as a way to make things more convenient

Robin ArnfieldMobilePaymentsToday.com

Robin Arnfield has been a technology journalist since 1983. His work has been published in ATM Marketplace, Mobile Payments Today, ATM & Debit News, ISO & Agent, CardLine, Bank Technology News, Cards International and Electronic Payments International. He has covered the United Kingdom, European, North American and Latin American payments markets.

ATM and Mobile 101

4© 2015 Networld Media Group | Sponsored by FIS

for their customers,” says Lian Zerafa, a partner in the KPMG Canada Financial Services practice.

Mobile-first consumersBy offering mobile cash access at their ATMs, FIs can ap-peal to today’s smartphone-savvy consumers who want to use mobile devices in all aspects of their life — including financial transactions.

“Smartphones are quickly becoming the singular device that people use to help manage their life,” Connie Ste-fankiewicz, BMO Financial Group head of North American Channel Strategy and Solutions, said in a statement.

“An increasing range of service industries are moving to mobile,” Shelli Bernard, an analyst at ABI Research, says. “This overall shift means that those companies which aren’t able to support mobile will likely be left behind, and the banking industry is no different.”

According to “The Rise of the Mobile First Consumer — and What that Means for Banking,” a report by Javelin Strategy & Research, “mobile-first” U.S. consumers — i.e., those who primarily use a mobile device for access to a checking account at their primary bank — now number almost 1 in 4 (23 percent).

By comparison, U.S. mobile users who named the ATM as their primary point of access represented 1 in 10 of all respondents, the Javelin study says.

Mobile-first consumers are by no means mobile-only consumers. Javelin found that they also demonstrate high rates of online, mobile and ATM use, and average rates of branch use.

Mobile-first consumers prefer giant banks, are fee sensi-tive and are more likely to switch banks within the next 12 months. Capturing these consumers will involve re-thinking customers’ mobile experiences from start to finish, Javelin says.

Customer adoptionMobile cash access should be seen as part of a move by FIs to enable their customers to replace their plastic credit

Almost 1 in 4 consumers is Mobile First

and debit cards with mobile wallets that can be used for face-to-face and remote payments. However, the move to cardless ATM transactions will be gradual.

“There is going to be a transition period with mobile pay-ments,” said Diebold’s Hartung. “We’re a long way from consumers leaving their wallet behind when they go out and doing everything on their mobile. For example, gov-ernment ID isn’t legally accepted yet on smartphones.”

Hartung said that for a mobile cash access deployment to be successful it needs to be easily understood by consum-ers, easily deployed at ATMs, and frictionless in operation. “As with other new technologies, FIs deploying mobile cash access need to create value for the consumer,” he said.

Potential applicationsMobile cash access has the potential to provide financial services to unbanked and underbanked consumers.

“Eliminating the need for a card to withdraw funds has the potential to enable access to the growing section of con-sumers who choose not to maintain a bank account,” said ABI Research’s Bernard.

In April 2014, the ATM Industry Association formed a U.S. Underbanked Forum to promote the development and de-ployment of ATM solutions that address the needs of U.S. un- and underbanked individuals.

ATM and Mobile 101

5© 2015 Networld Media Group | Sponsored by FIS

ATMIA USA executive director David Tente cited a 2011 FDIC survey indicating that 28.3 percent of U.S. house-holds conduct the majority of their financial transactions outside the traditional banking system. Cardless trans-actions at the ATM provide an option to accelerate the development of payment systems for the underbanked, according to the ATMIA.

Another potential use of mobile cash access is to facili-tate mobile person-to-person transfers. “If you want to send money to a family member who is traveling, or pay a friend for dinner, you could send them a one-time PIN or a QR code which they could use at an ATM to withdraw the cash,” said Ed O’Brien, director of banking channels at Mercator Advisory Group.

Authentication methodsA QR code-based ATM transaction involves the withdrawal of cash from a mobile wallet that is linked to a bank ac-count. Customers begin by authenticating themselves for their mobile banking app, and then using the app to prestage a QR code-based cash withdrawal. After the transaction is initiated, a QR code is texted to the custom-er’s smartphone. This code is then scanned at the ATM in order to authenticate the withdrawal.

Conversely, an ATM might display a QR code that the customer scans on their smartphone. The advantage of this approach is that it doesn’t require the ATM to contain a barcode scanner. QR code-based ATM transactions require a software upgrade at the ATM.

In an NFC-based ATM transaction, the customer’s card is stored virtually in the mobile wallet — either in the secure element of the smartphone’s SIM card or in the cloud using host card emulation. The customer simply taps the smartphone against an NFC-enabled contactless card reader installed in the ATM to carry out the transaction.

Another method for authenticating a cardless transaction is to send the customer an SMS message containing a one-time-use numeric code or voucher number that must be entered on the ATM keypad for transaction authorization.

“I think that QR codes, NFC and one-time PINs will coexist for quite some time as methods of mobile cash access,” Hartung said.

David Smith, business development director at Italian retail banking software vendor Auriga, said that most modern ATMs can support software offering mobile cash access via QR codes. However, NFC-based cash withdrawals require the installation of a contactless card reader.

“NFC at the ATM is coming into the market,” Auriga’s Smith said. “I think we will see more and more NFC-based ATM withdrawals during 2015 in certain countries. For example, in Austria, where NFC payments are already very big, Austrian banks are experimenting with NFC at the ATM. There is also interest among U.K. banks in NFC-based ATM withdrawals.”

One-time PINs and numeric codes offer a number of bene-fits — primarily their ubiquity, said ABI Research’s Bernard.

“NFC-based payments have gained a significant amount of attention, but while mobile device manufacturers are increasingly supporting the inclusion of NFC technology, there are still only a limited number of devices capable of NFC-based payments in consumers’ hands. Although there are methods for enabling devices without built-in NFC support to make use of NFC technology through the addition of an NFC-capable SIM or SD card, one-time numeric PINs can be used by any mobile device, negat-ing even the need for a smartphone (which is required for the use of QR codes and barcodes). One-time PINs also allow for additional security benefits, because they have a limited window of use (usually a timeframe of hours) after which time their validity will expire.”

According to “US EMV transition could open door to more NFC mobile payments,” an article by Mobile Payments Today editor Will Hernandez, the U.S. payment industry’s migration to EMV chip technology in bankcards and POS terminals will help make NFC mobile payments more mainstream.

As U.S. consumers become accustomed to using NFC-based mobile payment services such as Apple Pay, it is

ATM and Mobile 101

6© 2015 Networld Media Group | Sponsored by FIS

conceivable that they will want to be able to make NFC-based withdrawals from ATMs, also.

ATMIA guidelinesIn December 2013, ATMIA published “Best Practices for Cardless Transactions at the ATM.” The manual defines and analyzes cardless transactions and offers international case studies of successful cardless ATM programs.

In August 2014, ATMIA published international industry guidelines for maximizing the ATM user interface. The document provides recommendations for general naviga-tion through ATM menus, transaction flow, and customer communications, and explains how the ATM user interface interacts with potential non-card devices.

Survey resultsAccording to 2015 ATM and Self-Service Software Trends, published by ATM Marketplace and sponsored by KAL ATM Software, 38 percent of bank respondents to a global survey identified mobile phone integration to enable pre-staged ATM transactions on mobile devices as the most important new functionality for their self-service systems. One-third (33 percent) of respondents identified cardless transaction support as the most important new functional-ity, the survey found.

The report also included results from a global survey of non-bank ATM deployers, manufacturers, maintenance and service companies, hardware and software vendors, and processors. Asked to choose from a list of mobile-ATM integration services they thought banks would adopt, 55 percent said mobile ATM withdrawals via NFC; 53 percent said mobile ATM withdrawals via one-time PIN; 39 percent said mobile ATM withdrawals via QR code; and 51 percent said managing the ATM interface via mobile devices.

IssuesFIs looking to deploy mobile cash access need to verify that their ATM processor and ATM driver provider can sup-port the technology, Diebold’s Hartung said.

“For mobile cash access to work correctly, the software running on an ATM has to be upgraded, and this is more complicated if the software is from a third party, not from the ATM hardware vendor, or is customized differently,” said Zerafa.

“One of the key issues in implementing mobile ATM with-drawals, as with a number of implementations within the mobile banking and payment spaces, is ensuring interop-erability,” says ABI Research’s Bernard. “The growing se-lection of devices, mobile operating systems and enabling technologies can present challenges to those wishing to deploy solutions that will reach as large a selection of potential consumers as possible. Business models and revenue-sharing, finding a framework between traditional banks and modern technology vendors, also represent a significant barrier.”

Speaking at the 2013 ATM & Mobile Executive Summit in Washington, D.C., Peter Shortall, senior managing consul-tant at MasterCard Advisors, warned that a lack of shared industry standards will hinder adoption of mobile-ATM applications for off-us ATM transactions. Without common standards, mobile-ATM services such as cardless access might be restricted to on-us transactions, he said.

“Due to ATM software reasons, mobile cash withdraw-als from ATMs are still primarily on-us transactions,” says Auriga’s Smith.

ATM and Mobile 101

7© 2015 Networld Media Group | Sponsored by FIS

In an August 2013 ATM Marketplace blog, ATMIA USA Executive Director David Tente wrote that in the U.S. — and increasingly in other regions — interoperability is a huge is-sue. “In the contact card world (both mag-stripe and EMV), consumers have high expectations that any branded card will work at almost all ATMs,” Tente wrote. “Until consumers are confident that they can have the same expectations for mobile and contactless ATM transactions, demand for that option is not going to materialize. And that applies equally to all variations of contactless — cards, mobile, EMV, and even QR codes. The underlying technologies are the same and subject to a specific ISO/IEC standard. But there are no standards for implementations. As a result, the ‘standard’ spec is implemented differently from operator to operator, closing the door on interoperability.”

Another issue that works to deflate interest in NFC at the ATM is the requirement for PIN entry, Tente wrote. “Low-value retail transactions can be quick and easy with NFC, because no PIN or signature is required,” he noted. “Typi-cally, any cash withdrawal at an ATM will necessitate the use of a PIN — whether it be the customer’s assigned PIN or the one-time variety. In either case, the convenience gap between NFC and other contactless and contact transactions is reduced. The salient point in all this is that open, non-proprietary implementation standards and assurances of interoperability are necessary before real growth in contactless deployment and consumer accep-tance can be achieved.”

Mary Monahan, executive vice president and research director at Javelin Strategy & Research, told CNN that one of the issues with mobile cash access is connectivity. “If there’s no cellphone service, a user may not be able to withdraw the money they have pre-ordered from an ATM,” she said. “And if this happens regularly, it could deter cus-tomers from using cardless cash access services.”

CNN reported that, to address the issue, mobile cash ac-cess solution vendor FIS is working on an “offline mode” that would allow people to use their phone to make cash withdrawals no matter how weak the service might be.

Security“Right now, phone-initiated ATM transactions do not appear to present a real source of new fraud,” Sarah Grotta, director of Mercator Advisory Group Debit Advisory Service, wrote in a Payments Journal blog. “With time, as usage creeps up, the access to cash may become too enticing for fraudsters to pass up.”

“As banking activity of all sorts has gone mobile, hackers have followed and currently have the upper hand,” Vince Arneja, vice president of product management at mobile app security vendor Arxan, was quoted as saying in a depositaccounts.com blog. “Most financial services apps have been hacked, and there is a growing trend in finan-cial app hacking.”

Stéphane Roule, senior technical manager of strategic partners at U.K.-based IT security firm Omlis, said that to keep fraudsters from gaining access to financial informa-tion stored on a customer’s smartphone, FIs must encrypt

ATM and Mobile 101

8© 2015 Networld Media Group | Sponsored by FIS

any sensitive data resting on the device. “They also need to create a security system which is sufficiently dynamic to prevent any reuse of stolen mobile data by fraudsters on other devices,” he said. “This involves generating a new encryption key for each mobile transaction instead of using a static encryption key.”

“If banks decide to offer NFC-based withdrawals from their ATMs, there is the issue of security,” said KPMG’s Zerafa. “For example, it has been possible for someone to steal card data from contactless payment cards or from pay-ment cards stored in virtual form on Android devices.”

For NFC-based ATM transactions, using a technology called tokenization helps to prevent fraud. Tokenization involves a one-time number that is used to represent an actual credit or debit card number in a payment transac-tion. That token has zero value to criminals, as it can be detokenized only by the tokenization service provider. The cardholder’s primary account number is stored only on the tokenization service provider’s system.

In an NFC-based payment service, the token is stored securely on the user’s smartphone in a SIM card-based secure element or in an HCE-based cloud-based software vault. Examples of mobile payment services that use to-kenization include Apple Pay and Samsung Pay.

ABI’s Bernard said that the spending limits associated with contactless payments and transactions, while potentially inconvenient, improve security for cashless ATM with-drawals. “Some mobile banking solutions can be remotely deactivated by the provider, meaning that, when a security issue is highlighted — i.e., the smartphone is reported sto-len — it’s possible to restrict access to payment features,” she said.

VendorsATM hardware and software vendors offering mobile ATM solutions include Auriga, CSF International, Diebold, FIS, NCR, Paydiant, and WiseSec.

AurigaAuriga’s WinWebServer omnichannel banking platform

allows consumers to start transactions on one channel and complete them on another. For example, Auriga’s WWS mobile banking platform allows cash withdrawals to be prestaged on a mobile phone and completed at the ATM at a later time.

Auriga’s WWS mobile ATM service app lets banks cus-tomers withdraw cash from ATMs using their smartphone; personalize their ATM user experience and ATM menu; and authorize mobile ATM withdrawals by third parties. In addition to an ATM locator, the app tells customers which service features — banknote deposits, for instance — are offered by which ATMs and whether these features are operational. “As ATMs become more diverse, it’s very use-ful to be able to know which ATMs have which functioning capabilities,” said Auriga’s Smith.

DieboldDiebold offers a QR-code based mobile cash access solu-tion for its Agilis 3 software platform, which was developed in partnership with Paydiant.

In addition, Diebold has developed a contactless card reader for NFC-based ATM withdrawals. The solution, which was launched in October 2013, enables the user interface to read NFC-enabled smartphones, contact-less payment cards and other contactless media such as tags and stickers. When the contactless card or device is placed next to the contactless reader, it is detected through NFC technology.

Available as an upgrade on existing Opteva terminals, Diebold’s contactless card reader coexists with both dip and motorized magnetic stripe card readers to allow an alternate method for initiating transactions.

When a contactless card — which contains a chip or pro-cessor capable of exchanging information with a contact-less reader — is placed within a few inches of the Diebold NFC reader, the card is detected within seconds. With NFC technology, there’s no need for the customer to swipe or insert a contactless card at the terminal, resulting in enhanced speed, convenience and security for users of the self-service channel, Diebold said in a news release.

ATM and Mobile 101

9© 2015 Networld Media Group | Sponsored by FIS

FISIn April 2015, FIS launched biometric authentication for its mobile banking application via Apple’s TouchID. The technology allows accountholders to authenticate them-selves to the FIS Cardless Cash ATM application with just a fingerprint.

FIS developed its QR code-based Cardless Cash applica-tion in partnership with Paydiant.

“One-touch Cardless Cash is unlike anything else in the market,” Douglas Brown, senior vice president and general manager of mobile financial services at FIS, said in a news release. “The ability to access your account and withdraw money with just your fingerprint will make ATM access faster, safer and easier for users.”

WiseSecTel Aviv, Israel-based WiseSec has developed a security technology to protect Bluetooth-based mobile payments on any type of smartphone, including Android- and iOS-based smartphones.

The WiseSec solution uses low-cost Bluetooth-based sen-sors to locate and authenticate customers in a store or at an ATM, enabling them to carry out transactions by tapping their smartphone against a touchpad.

“Our protocol works on Bluetooth low energy and on other types of Bluetooth links, and offers an alternative to NFC,” says WiseSec CEO Vadim Maor. “It creates a tokenized communications channel between the server and the touchpad to simulate full NFC, and can be used for POS payments or cardless transactions at ATMs.”

WiseSec creates two types of tokens. “First, we tokenize the customer’s payment card and secondly we secure the transaction between the touchpad, which can be a POS device or an ATM, and the server using tokens,” says Maor. “All data is encrypted during transit from the touch-pad to the server.”

The technology verifies a customer’s identity, device and location and passes this information to the card issuer to authenticate. “To make a cardless cash withdrawal, a

consumer needs to tap their smartphone against an ATM which is enabled with our technology,” says Maor. “Be-cause of our military-grade security protocol, we are the only technology approved by the Bank of Israel for card-less ATM withdrawals in Israel.”

The Bank of Israel, the country’s Central Bank, acts as a reg-ulatory and approval body for the Israeli Ministry of Finance.

In March 2015, WiseSec said it had signed an agreement with the largest banks in Israel to deploy its cardless ATM technology.

How WiseSec cardless ATM transactions work

A WiseSec BLE sensor installed in an ATM recognizes customers who have downloaded their bank’s cardless ATM withdrawal app. Once in front of the ATM, the cus-tomer taps the smartphone on the designated area on the ATM and enters a PIN for extra security.

WiseSec says its micro-location technology is so accurate that it can only be triggered when the customer is standing a few inches from the ATM. Waiting in line, even second in line, won’t activate the request for the customer’s PIN code.

Banks deploying mobile cash accessSeveral U.S. financial institutions have deployed mobile cash access, including BMO Harris Bank, Diebold Federal Credit Union,WSFS, Alma Bank, Avidia Bank, Salem Five and Wintrust Financial. These FIs are using mobile cash

ATM and Mobile 101

10© 2015 Networld Media Group | Sponsored by FIS

access technology developed by Paydiant and deployed through a partnership with FIS.

Mercator’s O’Brien said he thinks there will a dozen more mobile cash access initiatives in the U.S. in the third quar-ter of 2015.

Although it is early days for mobile cash access in North America, a growing number of banks in other parts of the world offer the service, including Austria’s BAWAG; Banque Internationale de Luxembourg; Commonwealth Bank of Australia, which uses technology supplied by Win-cor Nixdorf; Turkey’s Garanti Bank; Australia’s Westpac; Royal Bank of Scotland and its NatWest subsidiary in the U.K.; and South Africa’s FNB and Standard Bank.

BAWAGIn October 2014, Austria’s BAWAG introduced mobile cash access at all its ATMs, using technology supplied by Wincor Nixdorf. BAWAG’s SmartCash service is available at ATMs in around 500 BAWAG branches.

When a SmartCash withdrawal is ordered, a ten-digit code is generated either by BAWAG’s e-banking service or its e-banking app and transmitted to the user via text message. This code, which is valid for four hours after being sent to the user, can be used for a single withdrawal of between €10 ($11) and €400 ($442). Once the code is entered, it becomes invalid for further withdrawals.

The technology enabling the new service is Wincor Nix-dorf’s PC/E software platform with a smart client software component that runs on the ATM, and a server component that authorizes withdrawals via one-time codes.

BMO Harris BankFollowing a pilot, Chicago-based BMO Harris Bank launched its Mobile Cash cardless cash access service in March 2015 at 750 of its ATMs. A further 150 ATMs were due to offer the service by June 2015.

The QR-based mobile cash access service improves transaction times at the ATM, and customer card informa-tion isn’t stored on the mobile device, which enhances security, BMO Harris said in a news release.

“Expectations are increasing among consumers in terms of the digital tools and services industries are offering,” said Connie Stefankiewicz, head of North American chan-nel strategy and solutions at BMO Financial Group, parent company of BMO Harris. “With personal finances, we know our customers want the ability to take care of mul-tiple financial needs from their smartphone.”

Diebold Federal Credit UnionIn March 2014, Diebold Federal Credit Union announced the pilot of a Diebold ATM that has no card reader or PIN pad and relies solely on mobile authentication.

To use the machine, a credit union member scans a one-time QR code at the touchscreen ATM with a smartphone. The ATM authenticates the user via the cloud to initiate a secure, cardless transaction.

The system integrates Diebold ATM technology with a mobile cash access solution developed by white-label mobile wallet provider Paydiant (acquired by PayPal in March 2015).

MCA allows the consumer to prestage cash withdrawals — including the amount to be dispensed — on a smartphone. The MCA offering also allows FIs to provide a secure, FI-branded mobile wallet solution without having to install additional hardware on ATMs or POS terminals.

According to DFCU president and CEO Dan Gann, DFCU members, particularly millennials, are readily adopting the technology, which not only delivers consumer conve-nience, but also encourages FI brand awareness. “[B]y offering a branded mobile wallet solution, we’re reinforcing our connection to members’ retail purchases and remind-ing them that we’re enabling this convenience,” he said.

Leveraging millennials’ familiarity with mobile devices, Diebold’s ATM interface features smartphone-style naviga-tion and touch gestures, such as flick and drag. The ATM is also paperless, delivering receipts through the mobile wallet application.

“To develop the millennial-inspired ATM, we studied the digital and social habits of today’s younger generation,” said Frank Natoli Jr., Diebold’s chief innovation officer. “The research led us to choose mobile devices for both

ATM and Mobile 101

11© 2015 Networld Media Group | Sponsored by FIS

the user interface and the authentication vehicle to ensure seamless connectivity between devices. Adding mobile wallet capabilities further capitalizes on millennials’ mobile mentality. Together, the technologies provide a glimpse of the future of self-service banking for today’s connected consumers.”

FNBAccording to South Africa’s First National Bank, as of March 2015, its customers had withdrawn 2 billion rand ($162 million) from FNB ATMs through cardless cash with-drawals using its SMS-based cellphone banking service. Customers wanting to make a cardless cash withdrawal are sent a one-time PIN via SMS.

In March 2015, FNB added cardless cash access to its mo-bile banking app (https://www.fnb.co.za/ways-to-bank/cash-withdrawal.html). According to the bank, its mobile app, which works on Apple, Android, Windows, and Blackberry platforms, has been installed on 1.2 million mobile devices.

To use the FNB banking app to make a cardless cash with-drawal, customers have to complete the following steps:

• launch the FNB banking app;• select “cardless cash withdrawals”;• enter their FNB online banking password;• follow the prompts; and• upon receipt an SMS containing a temporary PIN,

withdraw cash from any FNB ATM.

Using FNB’s cellphone banking service for cardless cash withdrawals is more cumbersome than using its mobile app. Customers need to complete the following steps:

Dial *120*321# from their cellphone, or go to www.fnb.mobi on their cellphone;

• enter their cellphone banking PIN;• select “banking”;• select “withdraw cash”;• select the account from which cash is to be withdrawn;• confirm the transaction;

• receive a one-time PIN and ATM instructions on the cellphone; and

• go to nearest ATM, select “cardless services” and “withdraw from FNB account” and follow the prompts.

The temporary PIN is valid for 30 minutes, FNB says.

Republic BankIn June 2015, Sarasota, Florida-based CSF International announced that Trinidad and Tobago-based Republic Bank is to install CSFi cardless P2P withdrawal functionality for all of its Switchware-driven ATMs. Switchware is the com-pany’s ATM transaction authorization system.

The deployment of cardless P2P transactional capability will coincide with Republic Bank’s scheduled upgrade to Switchware 3.12. With the use of the Switchware cardless P2P solution, Republic Bank cardholders will be able to transfer funds to virtually anyone, regardless of whether the recipient has a bank account, CSFi said.

“Convenient and secure, cardless P2P ATM withdrawals increase transaction volumes and revenues,” CSFi said. “As a value-add tool, [Republic Bank] promotes client loy-alty by eliminating the threat of customers seeking third-party P2P providers. Additionally, they provide an opportu-nity to offer banking services to the unbanked and cultivate increased use of ATMs in developing countries.”

Implementation of Switchware cardless P2P ATM with-drawal support is a software-only upgrade, and all transac-tion information is fully encrypted to ensure security and compliance, CSFi said.

How Switchware cardless P2P transactions work:• using a bank-provided mobile application, or a physi-

cal card, the accountholder selects the P2P payment option on the ATM and enters the recipient’s mobile number when prompted;

• the customer enters the transfer amount, and a one-time password is generated for use by the recipient to withdraw funds;

• an SMS-text message containing the password and transfer amount is automatically sent to the recipient;

ATM and Mobile 101

12© 2015 Networld Media Group | Sponsored by FIS

• the recipient goes to a P2P-supporting ATM and selects the “cardless cash withdrawal” screen without entering a card; and

• when the recipient keys in the password, cash is dispensed.

Royal Bank of ScotlandSince June 2012, Royal Bank of Scotland and NatWest have offered the Get Cash service in the U.K., enabling customers to withdraw cash using a six-digit one-time code. Valid for up to three hours, the cash code can be used at any RBS, NatWest or Tesco store ATM to withdraw cash.

Customers can use this cash code themselves or text it to someone else. They can use the service up to twice a day, but may only have one cash code at any one time. If the code expires, the funds are returned to the customer’s account within 24 hours.

Key features of Get Cash:• withdrawals must be within the daily limit for the cus-

tomer’s debit card up to a maximum of 250 pounds ($389) per business day;

• withdrawals are limited to a maximum of two per day;• Customers must have at least 10 pounds ($15) in

available funds to withdraw from their account (includ-ing any overdraft facility);

• RBS/NatWest must have the customer’s correct mo-bile number; and

• Customers must have an active debit card for their bank account.

Get Cash is available for Android, iPhone, BlackBerry10 and Windows operating systems.

An additional mobile-ATM service offered by RBS involves sending its customers a text message if they forget to take the cash they have removed from one of the bank’s ATMs. “They receive a text within 24 hours, letting them know that their cash is safe,” Computer Weekly reported. “The bank plans to introduce more advanced analytics technology that will deliver messages (about forgotten cash) instantly in the future.” RBS says around half a million cus-tomers a year forget to remove their cash from an ATM.

St George BankAustralia’s St George Bank, which is owned by Westpac, launched mobile cash access in June 2015, enabling customers to withdraw cash by generating a one-time PIN from within the St George Bank mobile banking app. Cus-tomers can share this code, which is valid for three hours, with friends and relatives from the mobile banking app.

Wintrust FinancialWintrust Financial, a $20 billion bank based in Rosemount, Illinois, is the first U.S. financial institution to deploy mobile cash access technology. It began testing cardless cash access via QR code at its ATMs in 2013 using technology from Paydiant, Diebold and FIS.

In January 2015, PaymentsSource reported that Wintrust was rolling out mobile ATM access across its entire ATM fleet. As of June 2015, mobile ATM access was available at 175 Wintrust ATMs serving more than 105,000 custom-ers in Chicago and southern Wisconsin, according to a report by American Banker.

In the Wintrust implementation, customers can use their mobile banking app to preset the amount they want to withdraw from Wintrust ATMs on future visits. At the ATM, customers log into the mobile banking app and select the cardless cash option. They then tap “cardless cash” on the ATM screen to display a QR code that isscanned with the mobile phone to trigger the cash dispenser. An elec-tronic receipt is emailed to the customer’s smartphone.

Tom Ormseth, Wintrust senior vice president of non-credit services, told PaymentsSource that prestaged ATM trans-

ATM and Mobile 101

13© 2015 Networld Media Group | Sponsored by FIS

actions can take as little as seven seconds, compared with 45 seconds for traditional ATM withdrawals.

“In certain markets, that’s a material decrease in time,” Diebold’s Hartung told ATM Marketplace.

Early data indicates that Wintrust customers who set up a cardless cash withdrawal using their smartphone tend to do so again, PaymentsSource reported. Currently, custom-ers can withdraw cash via smartphone only from checking accounts linked to their Wintrust debit card.

Ormseth told NFC World that the Wintrust cardless ATM withdrawal app is very secure because customers never present their card credentials to the ATM and credentials are never stored on the smartphone. Instead, card cre-dentials are stored in encrypted form in the cloud, and the cardless cash withdrawal transaction takes place through the cloud.

“We authenticate and use other information so that you’re not susceptible to things like card skimming or shoulder surfing,” Ormseth told NFC World.

According to an FIS “Cardless Cash Access Case Study,” written by Javelin Strategy & Research, Wintrust intro-duced mobile cash access as a way to appeal to a young-er demographic. Longer term, the bank is interested in developing a strong base of mobile‐empowered consum-ers that can be used to encourage merchant acceptance of a Wintrust mobile wallet, according to the case study.

Speaking at the 2013 ATM, Debit & Prepaid Forum in Las Vegas, Ormseth said that Wintrust had a larger objective in piloting a cardless ATM feature; the FI wanted to de-termine whether consumer uptake of a mobile wallet app with cardless cash access would ultimately translate into merchant uptake of QR-based mobile payments.

“We could go out to our small merchants and we say, ‘Look, our customers are using this and maybe you should think about doing a wallet,’” Ormseth said. “That’s sort of the end game, to help both our merchants as well as our consumers inside this.”

Wintrust identified the value of cardless cash access to con-sumers in three areas, according to the FIS case study:

FIS (NYSE: FIS) is the world’s largest global provider dedi-cated to banking and payments technologies. With a long history deeply rooted in the financial services sector, FIS serves more than 14,000 institutions in over 100 countries. Headquartered in Jacksonville, Fla., FIS employs more than 37,000 people worldwide and holds leadership positions in payment processing and banking solutions, providing soft-ware, services and outsourcing of the technology that drives financial institutions. First in financial technology, FIS tops the annual FinTech 100 list, is 434 on the Fortune 500 and is a member of Standard & Poor’s 500® Index.

About the sponsor:

“Security: Cardless Cash Access provides added security to standard ATM use by dramatically reducing the threat of skimming and shoulder‐surfing. Additionally, consumers are more likely to quickly detect a lost or stolen phone than a lost or stolen card. The app requires a PIN and possibly a second code if the smartphone is locked. Additionally, pre-ordered transactions are “live” for only a specified pe-riod of time, no payment data is stored on the smartphone, and security alerts for activity are tied into the app.

Convenience: Cardless Cash Access provides conve-nience by allowing consumers to keep the familiar user in-terface present on their smartphones. Additionally, receipts are automatically sent to the smartphone. Finally, the QR code scans from 6 to 8 feet away, which can help with ac-cessibility concerns.

Speed: Cardless Cash Access is faster at the ATM, requir-ing as little as 8 to 9 seconds to complete a pre-ordered cash withdrawal, according to Wintrust. For comparison, a normal transaction takes 30–40 seconds, even with Wintrust’s ‘Fast Cash’ ATM access. Wintrust also found that drive‐through times were decreased by two‐thirds, partly because the QR scanner was able to reach farther distances than expected.”

According to the FIS case study, Wintrust’s costs for mobile cash access deployment included internal research and development efforts, as well as the additional costs of upgrading its ATMs and, if necessary, installing signal boosters or secure Wi‐Fi connections.

14© 2015 Networld Media Group | Sponsored by FIS

“Exploring the business case for ATM-mobile integration” by Robin Arnfieldhttp://www.mobilepaymentstoday.com/articles/exploring-the-business-case-for-atm-mobile-integration/

ATM Industry Associationwww.atmia.com

“Best Practices for Cardless Transactions at the ATM: Inter-national Minimum Security Guidelines and Best Practices”ATMIAwww.atmia.com

Aurigawww.aurigaspa.comhttp://www.atmmarketplace.com/companies/showcases/auriga-spa/

“Omnichannel strategy boosts customer profitability” by Vincenzo Fiore, Auriga’s CEORBR’s Banking Automation Bulletinhttp://www.rbrlondon.com/newsletters/b332_Auriga.pdf

EMV Connectionhttp://www.emv-connection.com/emv-faq/

EMVcohttps://www.emvco.com/

NFC Forumhttp://nfc-forum.org/

PCI Security Standards Councilhttps://www.pcisecuritystandards.org/

“Cash Box: The Invention and Globalization of the ATM” by Tom Harper and Bernardo Batiz-Lazohttp://www.networldmediagroup.com/inc/sdetail/8593/14915

REFERENCES

ATM Marketplacewww.atmmarketplace.com

“What millennials really want from the ATM,” by Suzanne Cluckeyhttp://www.atmmarketplace.com/articles/gen-y-and-the-next-gen-atm/

“ATM Future Trends 2015,” sponsored by Aurigahttp://www.atmmarketplace.com/whitepapers/atm-future-trends-2015/

“2014 ATM Software Trends and Analysis,” by Robin Arn-field, sponsored by KAL ATM Softwarehttp://www.atmmarketplace.com/whitepapers/2014-atm-software-trends-and-analysis/

“2015 ATM and Self-Service Software Trends,” by Kim Schneider, sponsored by KAL ATM Softwarehttp://www.atmmarketplace.com/whitepapers/2015-atm-and-self-service-software-trends/

Mobile Payments Todaywww.mobilepaymentstoday.com

“ATM - Mobile Integration Guide: Strategies for Successful Omnichannel Banking” by Robin Arnfield, sponsored by Aurigahttp://www.mobilepaymentstoday.com/whitepapers/atm-mo-bile-integration-guide-strategies-for-successful-omnichan-nel-banking/

“Mobile Payments Security 101” by Robin Arnfieldhttp://www.mobilepaymentstoday.com/whitepapers/mobile-payments-security-101/

“ATM and mobile: A perfect match,” by Terry Dooleyhttp://www.mobilepaymentstoday.com/blogs/atm-and-mo-bile-a-perfect-match/