Patent Application
20250104501
Media handling devices, such as automated teller machines (ATMs) have a variety of different modules one of which is a shutter module. Often, ATMs stage currency withdrawals behind a shutter of the shutter module until a customer withdraws their bank card used to perform a withdrawal transaction. Once the customer removes their card from a card module of the ATM, the shutter opens, and the currency is dispensed to the customer. When the card is not withdrawn after a configurable period of elapsed time, the ATM assumes the transaction was canceled and moves the staged media back into recycling cassettes of the ATM; the customer's transaction is canceled, and no currency is debited from the card account associated with the transaction.
Recently, thieves have discovered a security hole in the above-discussed process. The shutter is shattered off such that the currency dispense slot is accessible. An anonymously funded debit card is used to initiate a valid withdraw transaction at an ATM. When the currency appears adjacent to the slot, the thieves grab ahold of the currency while at the same time holding on to the debit card such that the card module cannot take the card when the card is not withdrawn within a configurable amount of time. The currency is taken, and the card is taken back by the thieves. The ATM cancels the transaction such that the account associated with the debit card is not debited. The thieves then move on to another ATM using the same scam, a different card, or the same card.
The shutter module includes a sensor to report to the ATM when the shutter is opened and closed. However, the sensor does not activate properly when just the shutter covering is broken off. As a result, once the shutter covering is broken off, the shutter module continues to report incorrect shutter states to the ATM. Thus, thieves are taking advantage of this security hole in ATM technology.
In various embodiments, an apparatus, a media handling device, a transaction terminal, and a method for sensing shutter attacks are presented. The apparatus includes a side flange used to allow the blade of a shutter assembly to open and close during a transaction at the media handling device. The side flange includes a pair of apertures, a first aperture includes a pin that allows the blade to be opened and closed as the pin moves through the first aperture. The second aperture is adjacent to the first aperture and weakens the side flange such that when force is applied to the blade, the side flange breaks and causes an upward movement in the side flange. The side flange also includes a bottom rectangular notch that protrudes outward from the side flange.
An optical sensor is placed around the notch such that when the blade is broken and the side flange breaks due to a rupture in the second aperture from force exerted on the blade, the optical sensor detects upward movement when the notch of the side flange moves. A not closed signal/state/event is sent to a printed control board (PCB) of the shutter assembly and is relayed from the PCB to a security agent that executes on the media handling device and/or a transaction terminal to indicate that the blade of the shutter assembly is not closed as it should be. The security agent can process a workflow of security operations based on the blade not closed signal, such as shutting down the media handling device for transactions and raising a security notice or a security alert that the media handling device and shutter blade needs manually inspected for the transaction terminal.
Thieves have discovered a security hole in media handling devices of transaction terminals as discussed above. Typically, a claw hammer of other hard flat and skinny object is wedged between a bottom of the shutter and the outer housing of the media handling device and/or terminal. The thief then pulls up with the object to snap the shutter. Once the shutter is broken, the thief has access to the staging area of the shutter assembly and can grab ahold of any staged currency made for a currency withdraw transaction.
The issue with the conventional shutter assembly 100 is that the left-side flange 120 has very little if any movement when the blade 110D is broken, such that pin 122 does not move; the pin is locked and may not move at all even when the blade is broken. As a result, the closed blade state sensor 140 continues to report that the blade 110D is closed when in fact, the blade is broken into three or more pieces 110A, 100B, and 110C as shown in
The security hole associated with breaking the blade of a shutter assembly is solved with the teachings provided herein. The left-side flange of the shutter assembly is modified to include a bottom protruding and extending notch, which is surrounded by a U-shaped optical sensor. Moreover, a second aperture is added adjacent to the S-shaped aperture, which is adapted to house the pin. The shape and location of the second aperture relative to an edge of the left-side flange and relative to the S-shaped aperture weakens the left-side flange, such that when force is applied under the blade, the left-side flange breaks and causes movement in the notch, which the optical sensor reports as a not closed blade state/event. In an embodiment, cabling from the newly added sensor is integrated into the cabling associated with the closed blade state sensor 140 such that when the pin moves, or the notch moves a not-closed state is reported through the closed-state sensor port to a PCB of the shutter assembly.
Experimentation/Simulation was performed along with physical testing to ensure the size, shape, and location of the second aperture did not weaken the shutter assembly for general use or mild attacks, which would not break the blade. Results proved that the size, shape, and location of the second aperture only ruptured into the first aperture when an attack broke the blade.
Thus, no firmware or software changes are needed to existing firmware with the teachings provided herein. In fact, the PCB of the shutter assembly and the sensor ports are unchanged; rather, and in an embodiment, just the left-side flange, the added optical sensor, and the integration of cabling from the new optical sensor to the existing cabling output from the existing closed-state senor are modified to achieve detection of a broken blade in a shutter assembly. When a blade not closed sensor state or signal is received, the existing firmware sends a security alert to downstream software/firmware for security processing or processing of at least one security action or operation.
As used herein, the phrases “shutter assembly,” “shutter apparatus,” and “shutter module” may be used interchangeably and synonymously. This refers to the electromechanical, hardware, and firmware/software of a shutter system for a media handling device. The shutter system is responsible for accepting and dispensing media, such as currency, for deposits and withdrawals through a slot located behind a shutter or a blade that is opened and closed to receive currency deposits and/or dispense currency.
The terms “media,” “media item,” “banknotes,” “notes,” “currency,” “checks,” and/or “cash” are used synonymously and interchangeably herein and below. These terms refer to the media being transported to, from, and within a deposit and dispense module of a media handling device during a media operation being processed. In an embodiment, the “media operations” include depositing a single note, depositing a bunch of notes, depositing a single check, depositing a bunch of checks, depositing a mixture of notes and checks within a single bunch, dispensing currency, dispensing a bunch of currency, and/or rejecting one or a plurality of media items during a deposit media operation.
In an embodiment, the media handling device is an integrated peripheral device of a transaction terminal. In an embodiment, the transaction terminal is an automated teller machine (ATM). In an embodiment, the transaction terminal is a point-of-sale (POS) terminal operated by a cashier or a teller during a media operation. In an embodiment, the transaction terminal is a self-service terminal (SST) with a consumer performing a self-service media operation; for example, a self-service checkout at a retail or grocery store, a cash withdrawal transaction, etc. The SST includes a deposit and dispense module or media handling device to receive/deposit notes and to dispense notes for purposes of receiving payment and providing change to the consumer for a self-service transaction.
The shutter apparatus 300 includes an S-shaped and first aperture 210 designed to allow a pin of the shutter apparatus 300 to move through the aperture 210 when the blade of the shutter apparatus 300 is opened on instruction from the media handling device or transaction terminal during a media operation. The shutter apparatus 300 also includes a second aperture 220 that is adjacent to both a side edge of the side flange 200 and adjacent to a top portion of the S-Shaped first aperture 210. The second aperture 220 includes a notch 221 situated on an edge of the second aperture 220 in a substantial center of the edge and adjacent to a top-portion of the S-Shaped aperture 210.
In an embodiment, the thickness of the second aperture 220 is approximately 3 millimeters (mm). The notch 221 has approximately 1 mm diameter extending out from the edge of the second aperture 220. The thickness of second aperture 220, diameter of notch 221, and the shape/geometry and placement of both the second aperture 220 with notch 221 is tuned to fail (i.e., rupture or break side flange 220) at an approximate force of 900N (newtons). Force exerted on a blade of the shutter assembly transfers at least 900N to the side flange 200, such that any thief attempting to break the blade will be detected.
Side flange 200 also includes a second manufactured protruding or extending notch 230 located at a bottom of side flange 200. The notch 230 is rectangular in shape. A U-shaped optical sensor 240 includes two extending arms from a base, the notch 230 is adapted to fit inside the two extending arms and abut the base. Any side to side or up a down movement in the notch 230 will cause the optical sensor 240 to report a not-closed state for the blade by indicating that the pin ruptured from the first S-shaped aperture 210 into the second aperture 220 at the notch 221 location.
shapes/geometries between the apertures 210 and 220 of the side flange 220 of
The left-side flange 200 is affixed to a first end of blade 310 while the right-side flange 340 is affixed to a second and opposing end of blade 320. Pin 370 is inserted into the first U-shaped aperture 210. As the pin 370 is driven downward within first aperture 210, the left-side flange 200 moves upward and backward, which lifts blade 310. This movement causes closed state sensor 320 to report through cabling connected to sensor port 350 a not closed or non-closed state for blade 310 to PCB 360. This occurs when the media handling device opens the blade 310 during a media operation and thus unlocks the pin 370.
However, when blade 310 is busted in a blade breaking security breach there is little or no downward movement of pin 370 since the pin 370 is locked into placed for a closed state. This is no longer the case with shutter apparatus 300, because pin 370 ruptures into second aperture 220 when force is transferred from blade 310 to left-side flange 220 causing enough backward and downward movement in side-flange 220 to move notch 230 to one side of the U-shaped optical sensor 240.
In an embodiment, the output produced from U-Shaped sensor 240 is integrated or added to the output produced from closed state sensor 320 within the cabling output from sensor 320. The combined output is an OR condition such that when either the closed state sensor 320 reports a not closed state or the U-shaped sensor reports a blade broken state, the sensor output from both sensors 320 and 240 is reported to PCB 360 through port 350. Thus, no changes are needed nor are any modifications needed to any security firmware or software on the PCB 360 of the shutter assembly 300 or on downstream processors on the media handling device or transaction terminal to address a broken blade 310 security breach. A security breach will automatically be detected by the PCB firmware and downstream software when the media handling device or transaction terminal expects the blade 310 to be in a closed and locked state and receives a not closed state as a result of a broken blade 310 attack because U-shaped sensor 240 will detect, report, and raise a not closed event or state through port 350 to PCB 360, which in turn will report the event or state to the downstream security software of the media handling device or transaction terminal.
Transaction terminal 400 includes a processor 402; a non-transitory computer-readable storage medium, which includes instructions for a security agent 403; a media handling device 410, and peripheral devices 430. The instructions when executed by processor 401 cause processor 401 to perform operations discussed herein with respect to security agent 403.
Media handling device 410 is an integrated peripheral device of terminal 400. Media handling device 410 includes shutter apparatus/module 300 and other media handling modules 420. For example, the other media handling modules 420 can include, by way of example only, an upper media transport module, a media deskew module, a media verification module, a media diverter module, a lower media transport module, an escrow module, a recycler module, media cassettes modules, etc.
The peripheral devices 430 include, by way of example only, a card reader peripheral, a print receipt peripheral, a touchscreen peripheral, a contactless card reader peripheral (e.g., a near field communication (NFC) transceiver), a bioptic scanner peripheral, a handheld scanner peripheral, a vertical scanner peripheral, a horizontal scanner peripheral, a weigh scale peripheral, a bag scale peripheral, a combined scanner and scale peripheral, one or more camera peripherals, etc. Again, the media handling device 410 is also an integrated peripheral of terminal 400.
Media handling device 410 includes the shutter apparatus 300 discussed above with
The side flange 200 also includes a specialized shape and located second aperture 220 adapted based on its geometry and location relative to an edge of the side flange 200 and the S-shaped aperture to rupture and move side flange 200 backward and slightly upward when force is applied to blade 310 and when the pin 370 is locked during a locked shutter state of apparatus 300. The side flange 200 also includes a bottom extending or protruding notch 230 surrounds on three sides by a U-shaped optical sensor 240. Any movement in notch 230 is detected by sensor 240 and a signal corresponding to a blade not closed state/event is raised through cabling through port 350 to firmware on PCB 360. PCB 360 raises the event where it is detected by security agent 403.
When security agent 403 is expecting a blade closed state such as when transaction terminal 400 is idle or when a current state of a transaction at terminal 400 does not correspond to an opening of blade 310 and security agent 403 has received a blade not closed event/state raised by PCB 360, security agent 403 processes a workflow of security operations. For example, the workflow includes forcing a shutdown of media handling device 410, which in turn disables shutter apparatus 300 and cancels any current media operation being processed on the media handling device 420; forcing a shutdown of terminal 400; activating a camera peripheral device 430 to capture video of an area adjacent to the terminal 400; streaming the video to computer vision applications or systems for analysis; dispatching a service engineer to the transaction terminal; etc.
In an embodiment, notch 230 can be of any shape and optical sensor 240 is of a compatible shape to that which is associated with notch 230. In an embodiment, firmware on PCB 360 is updated to receive a broken blade state/event directly from sensor 240. In an embodiment, security agent 403 processes a customized workflow for a broken blade state/event raised from sensor 240 via PCB 360.
In an embodiment, the device that executes the firmware is PCB 360 of shutter apparatus 300. In an embodiment, the device that executes the firmware is media handling device 410. In an embodiment, the devices that executes the firmware is transaction terminal 400. In an embodiment, the firmware is a combination of both firmware and software executed by any combination of or by each of PCB 360, media handling device 410, and/or transaction terminal 400.
At 510, the firmware receives a blade closed signal from a first sensor 320 of a shutter apparatus when a blade 310 of the shutter apparatus 300 is closed. That is, the first sensor 320 does not detect any movement in pin 370 and thus regardless as to whether a blade breaking or shattering attack is occurring the first sensor 320 still reports the blade 310 is closed, as discussed above.
At 520, the firmware overrides the blade closed signal with a blade not closed signal. The blade not closed signal is received from a second sensor 240 of the shutter apparatus 300 when a threshold force on the blade 310 causes movement in a side flange 200 of the shutter apparatus 300. This is an indication the blade 310 was broken or an attempt was made to break the blade 310 of the shutter apparatus 300 when the shutter apparatus 300 was expected to be in a blade closed state.
In an embodiment, at 530, the firmware disables and cancels any current media operation on the media handling device 420 based on 520. Thus, if a cash withdrawal operation was in progress and currency was staged behind the blade 310 awaiting for a customer to remove a card from a card reader peripheral 430 of the transaction terminal 400, the firmware moves the cash back into the media handling device 420 into the corresponding cash denomination cassettes and the media handling device 420 is disabled for any further media operations until a service engineer inspects the shutter apparatus 300 and/or the blade 310.
It should be appreciated that where software is described in a particular form (such as a component or module) this is merely to aid understanding and is not intended to limit how software that implements those functions may be architected or structured. For example, modules are illustrated as separate modules, but may be implemented as homogenous code, as individual components, some, but not all of these modules may be combined, or the functions may be implemented in software structured in any other convenient manner. Furthermore, although the software modules are illustrated as executing on one piece of hardware, the software may be distributed over multiple processors or in any other convenient manner.
The above description is illustrative, and not restrictive. Other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of embodiments should therefore be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.
In the foregoing description of the embodiments, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting that the claimed embodiments have more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Description of the Embodiments, with each claim standing on its own as a separate exemplary embodiment.
