EAST Publishes European Fraud Update 3-2014
EAST has just published its third European Fraud Update for 2014. This is based on country crime updates given by representatives of 17 countries in the Single Euro Payments Area (SEPA), and 2 non-SEPA countries, at the 34th EAST meeting held at Sistema 4B in Madrid on 8th October 2014.
Card skimming at ATMs was reported by 16 countries, with increases reported by 2 countries and decreases by 7 countries. One country reported the reappearance of skimmers at ATMs with DIP card readers and 2 countries reported card data compromise through wire-tapping or ‘Eavesdropping’. The use of side bars to conceal cameras for PIN compromise appears to be becoming more prevalent.
European fraud counter-measures such as Geo-blocking, fraud monitoring capabilities and fraud detection continue to improve and most ATM related card skimming losses occur outside Europe and are migrating away from EMV Chip liability shift areas. In 2014 such losses have been reported in 46 countries and territories outside of the Single Euro Payments Area (SEPA) and in 7 within SEPA. The USA remains the top location for such losses, followed by Indonesia and Thailand.
Skimming attacks on other terminal types were reported by 9 countries. Attacks on unattended payment terminals (UPTs) at petrol stations were seen in 6 countries, while 3 countries saw attacks at point-of-sale (POS) terminals. In an action day (Operation Imperium) on 30th September 2014 Bulgarian and Spanish judicial and law enforcement authorities, working in close cooperation with Europol’s European Cybercrime Centre (EC3) in The Hague, dismantled another significant Bulgarian organised crime network suspected of a variety of crimes including large scale ATM skimming, electronic payment fraud and forgery of documents.
Cash trapping incidents appear to be on the increase and were reported by 14 countries. One country reported the emergence of a new type – trapping cash deposited at ATMs with a banknote recycling function. 5 countries reported transaction reversal fraud (TRF) incidents and card trapping incidents were also reported by 5 countries.
ATM malware incidents were reported by 3 countries. These were related to ‘cash out’ or ‘jackpotting’ and in two of the countries the malware was recognised as the Backdoor.Padpin Trojan. On 16th July 2014 an international organised cybercrime network was successfully taken down in Romania and France with the support of EC3 at Europol. The network was suspected of electronic payment crimes including intrusions into international non-cash payment systems (through malware attacks), illegal worldwide financial transactions and money transfers, card data compromising (via skimming attacks), money laundering and drug trafficking.
Ram raids and ATM burglary were reported by 8 countries, with one of them reporting increases in this type of attack. 8 countries reported explosive gas attacks and one of them also reported attacks on ATMs using solid explosives. Criminal groups are sharing information across borders and are exploiting the opportunities created by national borders.
The full Fraud Update is available to EAST members and subscribers and details of how to join EAST can be found at https://www.association-secure-transactions.eu/east-membership/
