Terminal Fraud

EAST has just published a European Payment Terminal Crime Report covering 2022 which highlights an increase in explosive attacks on European ATMs.

ATM related physical attacks were down 6% (from 3,947 to 3,728 incidents) but, within this total, ATM explosive attacks (including explosive gas and solid explosive attacks) were up 16% (from 629 to 727 incidents) and attacks due to ram raids and ATM burglary were up 8% (from 447 to 484 incidents).  Losses due to ATM related physical attacks were €11 million, a 10% increase from the €10 million reported during 2021.  60% of these losses were due to explosive attacks, which were up 4% from €6.35 million to €6.60 million.

EAST Executive Director Lachlan Gunn said, “This rise in ATM explosive attacks is of great concern to the industry, in particular solid explosive attacks that account for over 60% of the blasts.  While extensive measures have already been taken to mitigate the risk of such attacks, each attack creates significant collateral damage to equipment and buildings and can pose a threat to life.  The removal of travel restrictions post-lockdown has led to a significant increase in criminal mobility and many of the organised criminal groups operate cross-border.  Our EAST Expert Group on ATM and ATS Physical Attacks (EGAP), a public-private sector platform, is helping to share information and intelligence to counter this threat”.

ATM malware and logical attacks were down 40% (from 52 to 31) and all but one of the reported attacks were black box attacks.  A black box attack is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to ‘cash-out’ or ‘jackpot’ the ATM.  Most such attacks remain unsuccessful, and total losses of €135,844 were reported, an 80% decrease from the previous year.

Terminal related fraud attacks were up 70% (from 5,969 to 10,141 incidents).  This increase was primarily due to a rise in cash trapping at ATMs, a trend first reported during H1 2022.  These attacks increased by 244% (from 2,086 to 7,166 incidents).  Man-in-the middle/relay attacks were reported for the first time in H1 2022 and 502 cases were reported over the year.  The successful attacks resulted in cash out at ATMs.  Total losses of €200 million were reported, up 1% from the €198 million reported in 2021.  Most losses remain international issuer losses due to card skimming, which were €167 million.

A summary of the report statistics under the main headings is in the table below.

explosive attacks included in ATM related physical attacks

The full Crime Report, with breakdowns for each crime category, is available to EAST Members (National, Global and Associate)