Lax security enables ATM card fraud, report says