COVID-19 – Cybersecurity Awareness

CybersecurityThe coronavirus outbreak is still a rising issue for many countries and related lock-downs have forced many people into teleworking – working at home, while communicating with their office by phone or email, or using the Internet.  This raises cybersecurity concerns.

Malign actors are actively exploiting these new challenging circumstances to target remote workers, businesses and individuals alike.  It is vitally important for everyone to be fully aware of the threats and to ensure that anything transacted over the Internet is done safely and securely.

To help with this awareness Europol has provided ‘Safe Teleworking Tips and Advice’ for both employees and employers, as well as tips on  ‘How To Make Your Home a Cyber Safe Stronghold’ (available for download in 13 languages).

EAST and Europol have worked together since 2004 and EAST provides secure platforms for public/private sector cooperation in the fight against organised criminal groups engaged in financial crime.  Click here for more information on EAST’s law enforcement relationships.

The EAST Payments Task Force (EPTF) has a specific focus on cybersecurity.  This Group, which meets twice a year, adds value to the payments industry by using the unique and extensive EAST National Member platform and Associate Member network to provide information and outputs that are not currently available elsewhere.

EAST Publishes European Fraud Update 1-2020

EAST has just published its first European Fraud Update for 2020. This is based on country crime updates given by representatives of 18 countries in the Single Euro Payments Area (SEPA), and 2 non-SEPA countries, at the 50th EAST meeting held in Vienna on 12th February 2020.

Payment fraud issues were reported by eighteen countries. Seven countries reported CNP fraud occurring worldwide. One reported that the card data is either bought in bulk or obtained via card testing/BIN attacks. The attackers use scripts/bots (not real people) to conduct the fraud. Four countries reported BIN attacks. One reported that they are originating from the Middle East for the first time and another reported them in relation to both CP and CNP fraud, with losses reported in the USA, the UK and Brazil. Two countries reported Account Takeover Fraud, one of them in connection with SIM swapping.

Six countries reported phishing. One reported the use of fake emails by criminals to impersonate bank customers, claiming that their bank account details have changed. Another reported that online banking was targeted, and a third country reported phishing using social networks, with related fraud occurring in China. Three countries reported SMS phishing (Smishing). One of them reported this related to token validation transactions – the IP addresses are in Morocco and the fraud occurs in an EU country with losses via Western Union.

To date in 2020 the EAST Payments Task Force (EPTF) has published one related Payment Alert.

ATM malware and logical attacks were reported by twelve countries – one reported successful ATM malware attacks where ‘Cutlet Maker’ was used, and ten reported the usage (or attempted usage) of ‘black-box’ devices to allow the unauthorised dispensing of cash. To date in 2020 the EAST Expert Group on All Terminal Fraud (EGAF) has published one related Fraud Alert.

Card skimming at ATMs was reported by ten countries, and the downward trend continues. Six countries reported the usage of ‘M3 – Card Reader Internal Skimming devices’, and the usage of ‘M1 – Overlay Skimming Devices’ and ‘M2 – Throat Inlay Skimming Devices’ was also reported. Skimming attacks on other terminal types were reported by eight countries. Four reported attacks on unattended payment terminals (UPTs) at petrol stations, and three reported attacks at railway ticket machines. To date in 2020 EAST EGAF has published four related Fraud Alerts.

Year to date International skimming related losses were reported in 14 countries and territories outside SEPA and in 4 within SEPA. The top three locations where such losses were reported remain Indonesia, India and the USA.

Five countries reported card trapping attacks, one of them reporting a new method that allows several cards to be captured in one attack. Three countries reported transaction reversal fraud (TRF) incidents. To date in 2020 EAST EGAF has published two related Fraud Alerts.

Ram raids and ATM burglary were reported by eleven countries and eleven countries reported explosive gas attacks, one of which resulted in a fatality. Eight countries reported solid explosive attacks. The usage of Triacetone Triperoxide (TATP) for solid explosive attacks continues to increase across Europe. Mixing TAPT is a complicated procedure that requires good knowledge of the chemicals, as there is a danger of setting off an unexpected explosion. The spread of such attacks is of great concern to the industry due to the risk to life and to the significant amount of collateral damage to equipment and buildings.
To date in 2020 the EAST Expert Group on ATM & ATS Physical Attacks (EGAP) has published two related Physical Attack Alerts.

The full European Fraud Update is available to EAST Members (National, Global and Associate).

EAST EGAP holds 13th Meeting in The Hague

The 13th meeting of the EAST Expert Group on ATM and ATS Physical Attacks (EGAP) took place on Tuesday 3rd March 2020 in The Hague.

EAST EGAP is a European specialist expert forum for discussion of ATM and ATS related physical attack trends, attack methodologies and counter-measures, threat protection, and for the provision of regularly updated lists of manufacturers of ATM protective devices. The latest lists can be downloaded from the ‘Stained Banknotes’ page on this website (bottom of page).

The meeting was chaired by Mr Graham Mott of the LINK Scheme and was attended by key representatives from Law Enforcement, Terminal Deployers, ATM Networks and Security Equipment Vendors.  Europol gave a central assessment of the ATM physical attack situation in Europe and National Threat Assessments were shared by representatives from fifteen countries.

A presentation was given by ESTA, the Cash Management Companies Association and an update from the European Central Bank (ECB) was shared.

EAST EGAP, which meets twice each year, enables in-depth and technical discussion to take place. The areas covered include:

  • The latest incidents and criminal MOs
  • The collection and distribution of best practice guidelines
  • The evolution of threats and counter-measures
  • Lessons from and on law enforcement

50th EAST Meeting hosted by PSA in Vienna

The 50th EAST Meeting (National Members) was hosted by Payment Services Austria (PSA) in Vienna on 12th February 2020. The meeting was chaired by Martine Hemmerijckx of Worldline NV/SA, who co-founded EAST with Lachlan Gunn, EAST Executive Director, in 2004.

This was a milestone meeting and the last in the current format as, in June 2020, EAST will hold its 1st Global Congress.  In recognition of her work in founding and supporting EAST, and on behalf of the EAST Board and members, Lachlan presented Martine with an award.

National country crime updates were provided by 20 countries, and a global update by HSBC.  Topics covered included payment fraud and the continuing evolution of payment technology and related threats, terminal related fraud attacks, malware and logical attacks, and ATM related physical attacks.

The Criminal Intelligence Service Austria presented on the prevention of e-commerce fraud.  The European Cybercrime Centre (EC3) at Europol gave a presentation on forthcoming Europol activities for 2020, with a specific focus on Carding Action Week (CAW) .  This was followed by a presentation from the Gulf Cooperation Council Police (GCCPOL) that gave an update on payment and fraud issues seen by their 6 member countries.

Presentations were also given by the EAST Payments Task Force (EPTF) and the EAST Expert Group on All Terminal Fraud (EGAF).  An update was given by the EAST Expert Group on ATM and ATS Physical Attacks (EGAP).

EAST Fraud Update 1-2020 will be produced later this month, based on the national country crime updates provided at the 50th EAST Meeting.  EAST Fraud Updates are available on the EAST Website to EAST Members.

Europol publishes Turkish language version of ATM Logical Attack Guidelines

EuropolATM has just published a Turkish language version of guidelines to help industry and law enforcement counter the ATM Logical Attack threat.  The English version of the document was officially launched in January 2019 at the 17th Meeting of the EAST Expert Group on All Terminal Fraud (EAST EGAF).  The document is now available in EnglishFrench, GermanSpanish, Russian and Turkish.

The production of this document was coordinated by EAST EGAF.  It has three sections:

  1. Description of Modi Operandi (Hareket Tarzi Açiklamas i)
  2. Mitigating the risk of ATM Logical and Malware Attacks, Setting up Lines of Defence (ATM’lere Yönelik Mantiksal ve Kötü Niyetli Yazilim Saldirilarinin Risklerini Hafifletmek Savunma Hatlari Kurmak)
  3. Identifying and responding  to Logical and Malware Attacks (Mantiksal ve KÖTÜ Niyetli Yazilim Saldirilarini Saptamak ve Yanitlamak)

The Guidelines were first published in 2015 and this latest version provides clearer definitions and greater clarity of the criminal methods and techniques encountered in these attacks, along with more detailed recommendations on how to mount a robust and effective response to them.  The recent fall in ATM malware and logical attacks, as reported by EAST in the latest European Payment Terminal Crime Report published in October 2019, reflects the work that has been put into preventing such attacks by the industry and law enforcement.

Circulation of the document is restricted to Law Enforcement and to the banking and payments industry, which includes EAST Members (National and Associate).

EAST EGAF holds 20th Meeting in Amsterdam

The 20th Meeting of the EAST Expert Group on All Terminal Fraud (EAST EGAF) took place on Wednesday 15th January 2020 at ING Domestic Bank in Amsterdam.

EAST EGAF is a regional expert group that focuses on regional and global payment terminal crime and fraud related issues, threats and counter-measures.

The meeting was chaired by Mr Otto de Jong from ING Bank and was attended by key representatives from Terminal Deployers, Terminal Vendors, Networks, Card Schemes, Security Equipment and Software Vendors, Law Enforcement and Forensic Analysts.

This was a milestone meeting and, in recognition of his work in founding and supporting EGAF, as well as his 16 years of active support for EAST, Otto was presented with an award by Ms Veronica Borgogna of BANCOMAT S.p.A, the current Chair of EAST.

Presentations were made by Europol (AP Cyborg), Geldmaat, Damage Control and Fiducia & GAD IT AG.

The EGAF Group, which meets three times a year in advance of each of the meetings of EAST National Members, enables in-depth and technical discussion to take place on Logical and Malware attacks, Card Skimming, Card Trapping, Cash Trapping and Transaction Reversal Fraud.

In addition EAST EGAF generates EAST Fraud Alerts for all EAST Members (National, Global and Associate). In total 227 EAST Fraud Alerts have been issued, 2 to date in 2020.

EAST Fraud Definitions now available in Portuguese

EAST Terminal Fraud Definitions are now available in the Portuguese language.  At the end of 2018 EAST upgraded its Terminal Fraud Definitions to illustrate what the criminal target outcome is for each fraud type.  In the upgraded definitions each applicable criminal benefit is highlighted next to each terminal fraud type.

The translation was carried out by SIBS, the EAST National Member for Portugal.

These definitions are used by EAST when issuing Fraud Alerts, or when compiling the statistics and other information for European Payment Terminal Reports and Fraud Updates.  The aim is for these definitions, as well as the related criminal benefits, to be adopted globally when describing or reporting payment terminal fraud.  This translation into Portuguese is another step forward towards achieving this.

Below is the  definition for Card Skimming in the Portuguese language.


The definitions have been classified ‘WHITE’ under the terms of the EAST Information Security Policy and may be shared freely, subject to standard copyright rules.

Dutch ATMs to be shut down overnight to counter ATM explosive attacks

ATM explosive attacksTo counter the high level of ATM explosive attacks (known as ‘Plofkraken’ ) Dutch ATMs will temporarily be shut down at night between 2300 and 0700 hours.  This situation will be reviewed at the end of January. Also any ATMs that are deemed to have a high risk for local residents will be relocated to safer locations.  This will be done in close consultation with local government, police, shopkeepers, building managers and residents,

Geldmaat, the operator of the Dutch banking sector’s joint ATM network, is working with De Nederlandsche Bank and the police to take swift action to implement new measures which will render banknotes worthless in the event of an ATM explosive attack.

“ATM explosive attacks undermine our society,” says Chris Buijink, chairman of The Dutch Banking Association. “We cannot be resigned to an explosion going off every few days in our country, often in the vicinity of homes. I am therefore pleased that, together with Ministers Grapperhaus and Hoekstra and all the public and private institutions involved, we are forming a front against this disruptive form of crime.

The night closure is expected to have limited consequences for the availability of cash. Less than 2 percent of all cash withdrawals at ATMs are made at night. Although this will create difficulties for some people, safety is paramount. Anyone can still withdraw or deposit money at ATMs from 0700 to 2300 hours daily.  More information (in Dutch) can be found here.

This year more than 70 arrests were made related to ATM explosive attacks in the Netherlands. The detection of this crime is centrally coordinated nationally and there is also strong international cooperation with law enforcement agencies and the private sector.  The EAST Expert Group on ATM & ATS Physical Attacks (EGAP) provides a public/private sector platform for such liaison.


Message from the Executive Director

On behalf of the EAST Board I would like to thank all those who have worked so hard to provide information, time and resources to help us to meet our targets and objectives during 2019. Some of the highlights are as follows:

We held National Member meetings in Lisbon in February (our 47th Meeting hosted by SIBS), in The Hague in June (our 48th Meeting hosted by EC3 at Europol) and in London in October (our 49th Meeting hosted by the LINK Scheme).

49th EAST Meeting

The 49th Meeting was immediately followed by a Terminal Fraud Seminar and an ATM Physical Attacks Seminar.  These successful events were organised by our Financial Crime & Security (FCS) Events team and were co-located with RBR’s ATM & Cyber Security Conference 2019 (#ACS19).

The EAST Expert Group on All Terminal Fraud (EGAF), chaired by Otto de Jong of ING Bank, held three meetings in January, May and September, all hosted by ING in Amsterdam.

The EAST Expert Group on ATM and ATS Physical Attacks (EGAP), chaired by Graham Mott of the LINK Scheme, held two meetings in March and September, both in The Hague, one hosted by Europol and the other by the LINK Scheme.

The EAST Payments Task Force (EPTF), chaired by EAST Development Director Rui Carvalho, held two meetings in April and November, both hosted by the BPFI in Dublin.

Rui Carvalho now represents EAST at Europol’s Advisory Group on Financial Services and attended three meetings of the Group in March, June and November.

AG-Financial Services

In addition to the above we supported Law Enforcement during the year as follows:

  • In January I participated in and presented at a Conference on the Prevention of ATM Physical Attacks, jointly organised by the EUCPN and Europol.
  • In May and November Rui participated in and presented at P3 CyberFraud trainings in Austria and Finland. These events, which were organised by the European Cyber Crime and Fraud Investigators (ECCFI), were funded by the ‘European Union Internal Security Fund – Police’.
  • In July Rui participated in and presented at the fifth edition of the Europol Training Course on Payment Card Fraud Forensics and Investigations at the Spanish National Police Academy in Ávila, Spain.  Rui Carvalho represented EAST.
  • In November I presented remotely to a Skimming Working Group Meeting organised by the US Secret Service and the NCFTA in Scottsdale, Arizona.

EAST continues to keep abreast of the latest fraud trends and crime information, publishing our European Payment Terminal Crime Reports and European Fraud Updates.  Our thanks again go out to all the people and organisations that have shared information for the above, and for EAST Fraud Alerts (25 sent out this year to date), EAST Physical Attack Alerts (9 sent out this year to date) and EAST Payment Alerts (6 sent out this year to date).

EAST Associate Membership continues to grow. We now have 213 Associate Member organisations from 53 countries and territories. This membership category is open for worldwide application to all Banks, Law Enforcement (free membership available), and other approved ATM Stakeholder organisations.  Next year we will announcing a new membership category!

Every best wish for a wonderful festive break and a very happy New Year!

Kind regards


European Money Mule Action (EMMA 5) leads to 228 Arrests

The 5th European Money Mule Action (EMMA 5) resulted in 228 arrests.  3833 money mules were identified alongside 386 money mule recruiters. 1025 criminal investigations were opened, many of them still ongoing.  Money mule schemes rope in victims who are often unaware that the money they are sending is part of an elaborate money laundering scheme.

EMMA 5, which ran from September to November 2019, was driven by Law enforcement authorities from 31 countries, supported by Europol and Eurojust.  Supported by the European Banking Federation (EBF), over 650 banks, 17 bank associations and other financial institutions helped to report 7520 fraudulent money mule transactions, preventing a total loss of €12.9 million.

Europol and Eurojust organised various operational and coordination meetings in The Hague to discuss the unique approach of each Member State to tackle money muling in their respective country. During the three-month action, Europol supported the operations by assisting the national authorities with cross-checks against Europol’s databases and intelligence gathering for further analysis, while Eurojust contributed to the swift forwarding and facilitation of the execution of European Investigation Orders.


Money mules, unlike their drug-trade counterparts, are not shuffling illicit goods over a physical border. Instead, they take part – often unknowingly – in money laundering activities by receiving and transferring illegally obtained money between bank accounts and/or countries. Recruiters of money mules are coming up with ingenious ways to lure in their candidates. This year, cases involving romance scams were reported on the rise, with criminals increasingly recruiting money mules on online dating sites, grooming their victims over time to convince them to open bank accounts under the guise of sending or receiving funds. Criminals are also more and more turning to social media to recruit new accomplices through get-rich-quick online advertisements. This technique is particularly popular when it comes to targeting students and young adults.


Even if money mules act unwittingly, they are committing a crime. Law enforcement will turn first to whoever’s name features on the bank account, and the legal consequences can be severe. Depending on the country’s legal framework, mules may face lengthy imprisonments and acquire a criminal record that could seriously affect the rest of their lives, such as never being able to secure a mortgage or open a bank account.

Raising awareness of the issue is vital and the Europol website provides key information on Money Muling and how to prevent it.  The Europe-wide money muling awareness campaign #DontbeaMule started yesterday. With awareness-raising material, available for download in 25 languages, the campaign informs the public about how these criminals operate, how they can protect themselves and what to do if they become a victim.

Following on from EMMA 5, and for the next week, international partners from law enforcement and judicial authorities, together with financial institutions, will be supporting the campaign at national level.

Do you think you might be used as a mule? Act now before it is too late: stop transferring money and notify your bank and your national police immediately.

The EAST Payments Task Force (EPTF) provides a public/private sector platform which focusses on raising awareness of payment crime issues and related factors such as money muling.