Mastercard’s ‘reverse ATM’ stunt comes with a hidden risk

Reverse ATMs, which convert banknotes into disposable payment cards, are popping up at cashless events including the Australian Open, prompting financial crime experts to warn they could pose a money-laundering risk.

Mastercard, the official payments partner of the Australian Open, has installed two vending machines at Melbourne Park, which allow attendees at the cashless event to buy payment cards pre-loaded with either $50 or $100.

The vending machines accept cash or digital payment and do not require any registration or identification to activate and use the prepaid cards they dispense, unlike regular credit cards and high-value gift cards that can be obtained only with ID to stop money-laundering.

Cash-to-card machines are a relatively new but have emerged in countries including the United States and Australia as cash use has plummeted, falling from about 62 per cent of payments in 2010 to 13 per cent in 2022, according to most recent Reserve Bank data.

While the individual values of each card are below regulatory thresholds that require reporting of customer identities to Australia’s anti-money laundering agency, AUSTRAC, a customer repeatedly using the machines could convert thousands of dollars of banknotes into anonymous payment cards.

AUSTRAC’s acting deputy CEO of regulation, Brad Brown, said that while in practice, the individual cards were below the reporting threshold, the provider should be monitoring purchases to ensure a threshold wasn’t reached that required reporting.

“If you’re a criminal and you’re seeking to launder some money … people might do that in a small value, or people might do that in a larger value,” he said.

Brown said that with repeated use by one customer, cash-to-card machines that didn’t record transaction details or limit purchases represented a “potential exposure of some of these products to money-laundering”.

A Mastercard spokesperson said that while the cards’ values sat below reporting thresholds, its prepaid management services wing and payment partners took their obligations seriously and “have comprehensive measures in place to detect and respond to unusual purchasing behaviour”.

“These are consistent with the safeguards customers encounter when purchasing a gift card in store,” Mastercard’s spokesperson said.

Mastercard has contracted staff to stand near the vending machines and watch for any suspicious activity; the machines are also monitored by CCTV. However, on numerous occasions throughout the Australian Open, the machines have not been attended by staff in person.

In additional comments provided after publication, Mastercard said it also monitors transaction data remotely as cards are purchased.

In 2018, Commonwealth Bank paid $700 million to settle a landmark anti-money laundering case, admitting it failed to properly file more than 53,000 reports to AUSTRAC over cash deposits of more than $10,000 in its ATMs.

There is no suggestion the machines have been used to launder money, only that AUSTRAC has expressed concern about reverse ATMs potentially being used as a tool for illicit funds transfers.

The items displayed in rows on the vending machines are branded as “gift cards” to be used at the tennis grand slam event, but can be used anywhere in the world that accepts Mastercard, including online.

The prepaid cards cannot be reloaded with additional value, and cannot be used to withdraw cash from traditional ATMs.

Anti-money laundering and counter-terrorism financing laws require any financial service provider that receives cash or bank funds deposited into a reverse ATM to ensure they aren’t banking the proceeds of crime.

Under the regulation, issuers of prepaid value cards must require identification and monitor the use of the cards at certain value thresholds: over $1000 if it can be used to withdraw cash and $5000 if it cannot. Providers must report details of any such transactions to AUSTRAC.

In its most recent assessment, AUSTRAC rated prepaid stored-value cards as a medium risk when viewed alongside other avenues exploited for money-laundering and terrorism financing.

Mastercard has partnered with Australia Post and EML, a financial services firm, to sell the cards. Mastercard said that while EML is ultimately responsible for anti-money laundering obligations, it handles day-to-day regulatory management of these obligations on EML’s behalf.

Anton Moiseienko, an associate professor of law at the Australian National University specialising in financial crime and money-laundering, said that while controls might exist when stored-value cards were sold in store settings, such as salespeople recognising large purchases from one customer, a level of monitoring should be replicated for vending machines offering the same products.

“It might make these cards more attractive for more problematic clientele, but you could make the same argument for any new financial start-up or crypto exchange,” he said.

“If you’re a major organised crime group, it might be more trouble than it’s worth to buy 50 or so of these cards; it might not be that efficient,” Moiseienko said.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.