Hello, Carders! The guys and I thought and decided that since everyone is starting to actively use various types of Pay (Apple Pay, Samsung Pay, Android Pay, and a couple more from vendors are just around the corner), then why not give users the opportunity not only to pay using a smartphone at the store checkout, but also withdrawing money from an ATM. No sooner said than done.
At the entrance, the festival guest received a bracelet and a card linked to it (MasterCard). The bracelet had a built-in smart card, which made it possible to pay by touch at the festival’s retail outlets. This way you got both a pass to the festival and a wallet.
This was 2014, and then the ability to deposit or withdraw cash at an ATM was extended from wristbands to our MasterCard PayPass cards, after which VISA was also finalized.
A new round of development of touch payments was set when vendors actively got involved in the matter. On September 9, 2014, Apple introduced Apple Pay, which not only proved its worth, but also set another trend. Samsung decided not to lag behind, as a result of which the world saw Samsung Pay, and now Android Pay is working in the Russian Federation.
Users who appreciated the convenience of such payment at checkouts could not help but start asking questions about the possibility of interaction between a smartphone and an ATM.
All processing improvements were tested on Apple Pay, so after the release of Samsung Pay and Android Pay, no technical difficulties arose, and in fact, the entire connection of the new system to ATMs depended only on the success of negotiations with the vendor.
When you're doing something with the goal of being the first in the world to launch, speed is going to play a pretty important role. In the minds of the majority, all processes associated with banking and the introduction of something new should be rather leisurely - here are the very specifics of the banking sector, and its inherent bureaucracy, and many other factors, each of which in one way or another slows down the progress of work.
In our case, everything happened so quickly that we first did something, implemented and tested, and only then wrote all the necessary documentation and made possible adjustments from the vendor.
Here we must pay tribute to our contractor, BPC Banking Technologies, who did his part of the work with maximum efficiency.
As a result, it took us a month to do everything about everything in the case of connecting Apple Pay. In April 2017, we go to Apple, and already in early May we conduct the first live tests on ATMs.
That is, if your smartphone supports Apple Pay, Samsung Pay or Android Pay, then you can withdraw or deposit cash at one of our new ATMs using your smartphone. If payment on a pinpad in a store works using a watch, then you can use it with an ATM.
The same applies to security - everything related to the secure storage of a bank card token on a device is provided by the vendor itself.
Additional protection against unauthorized access to your account from an ATM is the need to enter the PIN code from the corresponding card for any operation. For example, if in a cafe you can pay for a cup of coffee with a simple touch, without a PIN code, then interacting with an ATM will require entering a code even if you want to withdraw 100 rubles from your account.
In order to find such an ATM on the map, we made an additional filter on the website. It should soon appear in mobile applications.
These ATMs will be visually distinguished with the help of special stickers, and it will also be noticeable that there is a reader installed under the card slot.
There are some oddities here, because people get used to the appearance of ATMs and begin to suspect something if suddenly some additional detail appears on their favorite machine. Whether it’s a reader or an anti-skimmer, it’s still something new for the user, and therefore suspicious. We have already received a couple of calls about the fact that “someone installed some strange crap on the ATM, which will now definitely withdraw money from all my cards.” In fact, it’s even good that users are vigilant and call us, because cases vary.
By the end of 2017, we plan to increase the number of such ATMs to 700. The restructuring of the ATM network itself is carried out in two ways - this is the installation of the latest ATM models, and the upgrade of current ones (the corresponding software + reader). Moreover, in the case of an upgrade, the cost of such modification is approximately 5% of the price of a new ATM.
Now a couple of weeks have passed since the official launch, so it will be difficult to show any detailed statistics on the use of this function, but general information makes it clear that they are beginning to use it more and more actively. And not so much in the test mode “Let me try to withdraw a thousand with a smartphone,” but also on quite large amounts - there were withdrawals of about 100,000 rubles using Apple Pay. For now, we are inclined to believe that this particular Pay will become the most popular among users, but time will tell.
How it works - all operations (selecting the desired action, specific amount, etc.) are carried out on the smartphone screen through the bank application. After all the details have been clarified, all that remains is to bring your smartphone to the ATM reader and receive or deposit cash. The ATM itself is a rectangular box that only has a reader and a compartment for accepting and dispensing bills.
This, by the way, gives a small plus in terms of security. If previously cameras could be installed above the keyboard at a specific angle to record your PIN code for an attacker (or even use a fake keyboard for the same purposes), then entering a PIN code and other data from the screen of your smartphone eliminates this vulnerability. Just like the problem with skimmers - no card slot = no one clones the magnetic stripe of your card.
Of course, there is a non-zero chance that with time and the growing popularity of contactless, miniature NFC skimmers will appear; this is inevitable, like the eternal confrontation between sword and shield. But, frankly speaking, the level of data protection in a token and in a magnetic stripe is very different.
Of course, we expect the appearance of similar ATMs at our banking colleagues.
But regarding the spread of this throughout the world, the following trend is currently observed. ATMs are growing fastest in Asia. Some new functions and experiments most often appear there (but in the case of deposits and withdrawals via smartphone, we were the first in the world).
The West, despite the fact that ATMs first appeared there, is not progressing as actively in terms of ATMs. This is largely due to the fact that their ATM fleet has gone through all the stages of evolution, from the first ATMs that processed checks (that's what they were invented for) to the ATMs that you can see in the United States today.
Barclays Bank, 1967, photo - AP.
This thing was the world's first cash dispenser for the public. The user inserted a check into the slot and received cash. In this case, cash was limited to 10 pounds, because at that time it was not possible to check how much money the client had in the account in principle. But already at that time they were fighting against counterfeits, and these checks that the bank issued were marked with the carbon-14 isotope. For a person, the isotope is quite harmless, and the ATM could understand whether the correct check was inserted into it, or someone decided to enrich themselves at the bank’s expense in an unsolicited way.
Now in the USA the situation is such that most of the cards used are with magnetic stripes, and not with chips, not to mention contactless. By the way, it is for this reason that cloned cards are taken for cashing from the Russian Federation to the USA. Let's say you have a card with a chip. Somehow, at an ATM that was not installed in the most secure place, you came across skimmers that read the magnetic stripe and PIN code, after which the attacker used a blank to make a clone of your card.
So, using this clone in the Russian Federation will be useless - banks have information that the card is also protected by a chip, so withdrawing money from the clone through an ATM will not work. But you can take the clone to the USA and cash it there, without checking for the chip.
Now the ATM network in the United States is so huge that modernizing it will take a colossal amount of money and time. Coupled with a certain conservatism, we have what we have - a noticeable lag behind the rest of the world in working with maps.
Why are we luckier? Because ATMs began to actively appear in our country in the 90s of the last century. We started with fairly normal technologies that we managed to develop in accordance with the needs of users and our ideas.
Therefore, now it is much easier for us to introduce something new.
That's what we're trying to do.
PS By the way, if you want to take part in the development of such solutions, we have recently opened several new vacancies, perhaps we need you.
Where it all started
The idea that it would be nice to gradually transfer payment processes to contactless came to us during the first Alfa Future People festival. At the time, this idea fit well with the concept that there should be no cash on the festival grounds. It was suggested to pay using a bracelet.
At the entrance, the festival guest received a bracelet and a card linked to it (MasterCard). The bracelet had a built-in smart card, which made it possible to pay by touch at the festival’s retail outlets. This way you got both a pass to the festival and a wallet.
This was 2014, and then the ability to deposit or withdraw cash at an ATM was extended from wristbands to our MasterCard PayPass cards, after which VISA was also finalized.
A new round of development of touch payments was set when vendors actively got involved in the matter. On September 9, 2014, Apple introduced Apple Pay, which not only proved its worth, but also set another trend. Samsung decided not to lag behind, as a result of which the world saw Samsung Pay, and now Android Pay is working in the Russian Federation.
Users who appreciated the convenience of such payment at checkouts could not help but start asking questions about the possibility of interaction between a smartphone and an ATM.
Negotiation
We talked to the guys from Apple and explained to them what we wanted to do and how. The idea was received with enthusiasm.All processing improvements were tested on Apple Pay, so after the release of Samsung Pay and Android Pay, no technical difficulties arose, and in fact, the entire connection of the new system to ATMs depended only on the success of negotiations with the vendor.
When you're doing something with the goal of being the first in the world to launch, speed is going to play a pretty important role. In the minds of the majority, all processes associated with banking and the introduction of something new should be rather leisurely - here are the very specifics of the banking sector, and its inherent bureaucracy, and many other factors, each of which in one way or another slows down the progress of work.
In our case, everything happened so quickly that we first did something, implemented and tested, and only then wrote all the necessary documentation and made possible adjustments from the vendor.
Here we must pay tribute to our contractor, BPC Banking Technologies, who did his part of the work with maximum efficiency.
As a result, it took us a month to do everything about everything in the case of connecting Apple Pay. In April 2017, we go to Apple, and already in early May we conduct the first live tests on ATMs.
What smartphones does it work on and how safe is it?
The answer to both of these questions is essentially simple - it all depends on the vendor’s payment system itself.That is, if your smartphone supports Apple Pay, Samsung Pay or Android Pay, then you can withdraw or deposit cash at one of our new ATMs using your smartphone. If payment on a pinpad in a store works using a watch, then you can use it with an ATM.
The same applies to security - everything related to the secure storage of a bank card token on a device is provided by the vendor itself.
Additional protection against unauthorized access to your account from an ATM is the need to enter the PIN code from the corresponding card for any operation. For example, if in a cafe you can pay for a cup of coffee with a simple touch, without a PIN code, then interacting with an ATM will require entering a code even if you want to withdraw 100 rubles from your account.
Where you can try it in action
As of the beginning of July, we have so far installed 20 such terminals in Moscow, with a total of 300 in Russia. Priority in installation is given to Alfa-Bank branches, but ATMs are also installed in business centers.In order to find such an ATM on the map, we made an additional filter on the website. It should soon appear in mobile applications.
These ATMs will be visually distinguished with the help of special stickers, and it will also be noticeable that there is a reader installed under the card slot.
There are some oddities here, because people get used to the appearance of ATMs and begin to suspect something if suddenly some additional detail appears on their favorite machine. Whether it’s a reader or an anti-skimmer, it’s still something new for the user, and therefore suspicious. We have already received a couple of calls about the fact that “someone installed some strange crap on the ATM, which will now definitely withdraw money from all my cards.” In fact, it’s even good that users are vigilant and call us, because cases vary.
By the end of 2017, we plan to increase the number of such ATMs to 700. The restructuring of the ATM network itself is carried out in two ways - this is the installation of the latest ATM models, and the upgrade of current ones (the corresponding software + reader). Moreover, in the case of an upgrade, the cost of such modification is approximately 5% of the price of a new ATM.
Now a couple of weeks have passed since the official launch, so it will be difficult to show any detailed statistics on the use of this function, but general information makes it clear that they are beginning to use it more and more actively. And not so much in the test mode “Let me try to withdraw a thousand with a smartphone,” but also on quite large amounts - there were withdrawals of about 100,000 rubles using Apple Pay. For now, we are inclined to believe that this particular Pay will become the most popular among users, but time will tell.
What's next
There are plans to introduce so-called topless ATMs into the ATM fleet. Contrary to expectations, such an ATM will not have a pretty assistant nearby to help you withdraw or deposit cash, it is just an ATM without a top (no screen and no keyboard). Similar ATMs are already in use in a number of countries.How it works - all operations (selecting the desired action, specific amount, etc.) are carried out on the smartphone screen through the bank application. After all the details have been clarified, all that remains is to bring your smartphone to the ATM reader and receive or deposit cash. The ATM itself is a rectangular box that only has a reader and a compartment for accepting and dispensing bills.
This, by the way, gives a small plus in terms of security. If previously cameras could be installed above the keyboard at a specific angle to record your PIN code for an attacker (or even use a fake keyboard for the same purposes), then entering a PIN code and other data from the screen of your smartphone eliminates this vulnerability. Just like the problem with skimmers - no card slot = no one clones the magnetic stripe of your card.
Of course, there is a non-zero chance that with time and the growing popularity of contactless, miniature NFC skimmers will appear; this is inevitable, like the eternal confrontation between sword and shield. But, frankly speaking, the level of data protection in a token and in a magnetic stripe is very different.
Of course, we expect the appearance of similar ATMs at our banking colleagues.
But regarding the spread of this throughout the world, the following trend is currently observed. ATMs are growing fastest in Asia. Some new functions and experiments most often appear there (but in the case of deposits and withdrawals via smartphone, we were the first in the world).
The West, despite the fact that ATMs first appeared there, is not progressing as actively in terms of ATMs. This is largely due to the fact that their ATM fleet has gone through all the stages of evolution, from the first ATMs that processed checks (that's what they were invented for) to the ATMs that you can see in the United States today.
Barclays Bank, 1967, photo - AP.
This thing was the world's first cash dispenser for the public. The user inserted a check into the slot and received cash. In this case, cash was limited to 10 pounds, because at that time it was not possible to check how much money the client had in the account in principle. But already at that time they were fighting against counterfeits, and these checks that the bank issued were marked with the carbon-14 isotope. For a person, the isotope is quite harmless, and the ATM could understand whether the correct check was inserted into it, or someone decided to enrich themselves at the bank’s expense in an unsolicited way.
Now in the USA the situation is such that most of the cards used are with magnetic stripes, and not with chips, not to mention contactless. By the way, it is for this reason that cloned cards are taken for cashing from the Russian Federation to the USA. Let's say you have a card with a chip. Somehow, at an ATM that was not installed in the most secure place, you came across skimmers that read the magnetic stripe and PIN code, after which the attacker used a blank to make a clone of your card.
So, using this clone in the Russian Federation will be useless - banks have information that the card is also protected by a chip, so withdrawing money from the clone through an ATM will not work. But you can take the clone to the USA and cash it there, without checking for the chip.
Now the ATM network in the United States is so huge that modernizing it will take a colossal amount of money and time. Coupled with a certain conservatism, we have what we have - a noticeable lag behind the rest of the world in working with maps.
Why are we luckier? Because ATMs began to actively appear in our country in the 90s of the last century. We started with fairly normal technologies that we managed to develop in accordance with the needs of users and our ideas.
Therefore, now it is much easier for us to introduce something new.
That's what we're trying to do.
PS By the way, if you want to take part in the development of such solutions, we have recently opened several new vacancies, perhaps we need you.
