Decrease in skimming losses
International losses due to skimming attacks fell by 43%, continuing a downward trend for each six monthly reporting period first noticed at the end of 2007. This is further indication that the EMV rollout at ATMs in Europe (now 94% complete) is helping to reduce skimming losses, and also that fraud counter-measures, fraud monitoring capabilities and fraud detection continue to improve. Losses continue to be reported globally, and the risk of counterfeit EMV cards being used to withdraw cash fraudulently from ATMs in parts of the world that are not EMV compliant remains.
In a skimming attack the card details and PIN are captured at the ATM and used to produce counterfeit cards for subsequent fraudulent cash withdrawals. The customer sees a normal transaction and retains the card. Multiple cards are compromised in one attack at one ATM.
A number of preventative measures can be taken by ATM operators to stop or reduce skimming. The developed several recommendations with regard to such measures; a link to the relevant document is included below.
Incidents of card trapping are on the rise
Despite this drop in losses, overall ATM related fraud attacks rose 8% with a total of 13,269 incidents reported. This rise has been led by a 209% increase in the number of cases of card trapping while the total number of skimming incidents reported decreased by 1% over the same period. Card trapping is when a card is physically captured at the ATM, and the PIN is compromised. Later the card is used to make fraudulent cash withdrawals. The customer loses the card. One card is lost in each attack.
EAST first reported an increase in card trapping incidents at the end of the first six month period in 2009 and the figures for the second six months have shown a further increase. Assuming the PIN has been compromised, a captured EMV card can be fraudulently used at EMV compliant ATMs and other payment terminals, until it is blocked by the issuing bank.
Fewer physical attacks on European ATMs
Physical attacks on European ATMs, have fallen by 2% when compared with 2008 (down from 2,520 to 2,468 incidents), primarily due to a decrease in the number of reported ram raids and ATM burglaries. In these attacks the ATM is either ripped out (Ram Raid) or the safe attacked in-situ (Burglary). The attacks can be carried out by brute force, or by using explosives or gas.
Despite this drop in incidents, overall losses rose 7% to €28 million (up from €26 million in 2008). Attacks on staff involved in the cash replenishment and servicing of ATMs rose by 40% (from 365 to 510 incidents) although the number is still well below the 1,950 cases reported in 2007.
More information on EAST and the report can be found on the EAST website at www.european-atm-security..
Lachlan Gunn is Coordinator and a Director of EAST.
These recommendations should not be seen as a complete or permanent solution and further recommendations may follow in due course.
If you would like to comment on this article, please identify yourself with your first and last name. Your name will appear next to your comment. Email addresses will not be published. Please note that by accessing or contributing to the discussion you agree to abide by the EPC website conditions of use.