EAST Publishes European Fraud Update 3-2016

east-european-fraud-update-3-2016EAST has just published its third European Fraud Update for 2016. This is based on country crime updates given by representatives of 18 countries in the Single Euro Payments Area (SEPA), and 6 non-SEPA countries, at the 40th EAST meeting held in Bucharest, Romania on 12th October 2016.

Card skimming at ATMs was reported by nineteen countries. The usage of M3 – Card Reader Internal Skimming devices continues. This type of device is placed at various locations inside the motorised card reader behind the shutter.  Seven countries reported such attacks.

International skimming related losses were reported in 57 countries and territories outside of the Single Euro Payments Area (SEPA) and in 10 within SEPA. The top three locations where such losses were reported are the USA, Indonesia and India.

Skimming attacks on other terminal types were reported by eight countries and six countries reported such attacks on unattended payment terminals (UPTs) at petrol stations.

ATM malware and logical security attacks were reported by eight countries all involving the usage (or attempted usage) of ‘black-box’ devices to allow the unauthorised dispensing of cash. To help counter such attacks the Europol document ‘Guidance and Recommendations regarding Logical attacks on ATMs’ is now available in four languages: English, German, Italian and Spanish.

Ram raids and ATM burglary were reported by nine countries and eleven countries reported explosive gas attacks, four of them seeing big increases in such attacks.  The use of solid explosives continues to spread and six countries reported such attacks.

Payment fraud issues were reported by eight countries. Two of them reported data breaches and one updated on contactless card fraud. One country reported fraud relating to a popular games console and another fraud related to advertising on social media.

The full Fraud Update is available to EAST Members (National and Associate).

EAST publishes European Fraud Update 2-2016

EAST - EUROPEAN FRAUD UPDATE 2 - 2016EAST has just published its second European Fraud Update for 2016. This is based on country crime updates given by representatives of 17 countries in the Single Euro Payments Area (SEPA), and 6 non-SEPA countries, at the 39th EAST meeting held at Europol in The Hague on 8th June 2016.

Card skimming at ATMs was reported by eighteen countries.  An emerging trend is the usage of M3 – Card Reader Internal Skimming devices.  This type of device is placed at various locations inside the motorised card reader behind the shutter.  Five countries reported such attacks.

The trend of losses due to skimming occurring outside of EMV Chip liability shift areas continues.  International losses were reported in 52 countries and territories outside of the Single Euro Payments Area (SEPA) and in 9 within SEPA.  The top three locations where such losses were reported are the USA, Indonesia and Jamaica.

Skimming attacks on other terminal types were reported by nine countries and eight countries reported such attacks on unattended payment terminals (UPTs) at petrol stations.

ATM malware and logical security attacks were reported by five countries – three of them reported the successful usage of ‘black-box’ devices to allow the unauthorised dispensing of cash.  To help counter such attacks the Europol document ‘Guidance and Recommendations regarding Logical attacks on ATMs’ is now available in three languages: English, German and Spanish.

Ram raids and ATM burglary were reported by ten countries and eight countries reported explosive gas attacks.  The use of solid explosives continues to increase and five countries reported such attacks.

For the first time this European Fraud Update also includes information on Payment Fraud, with nine countries reporting related issues.  Three of them reported data leakage from hotel booking sites and one country reported contactless card fraud.

The full Fraud Update is available to EAST Members (National and Associate) and Subscribers.

EAST publishes ATM Physical Security Guidelines

ATM Physical Security GuidelinesEAST has published a document entitled ‘ATM Physical Security Guidelines.’

These Guidelines have been put together by members of the EAST Expert Group on ATM Physical Attacks (EGAP).

An ATM physical attack is defined as one where the criminals’ aim is obtain the cash from within the ATM, either entirely or partially, through a breach in the safe or ATM’s mechanism, or as it is being delivered.  It excludes attacks which are aimed getting relatively small amounts of cash such as cash trapping and also system attacks where the ATM does un-authorised transactions and functions, for example malware or system penetration.  These would be classed as “Fraud”.

ATM Physical attacks come in three main categories, Ram Raid, ATM Burglary and Robbery (ATM replenishment attack).

The document, which is designed to help ATM operators, ATM network operators and Law Enforcement, covers three main themes for the various physical attack types:

  • Identification
  • Advice for Police and Law Enforcement attending the scene
  • Prevention

These ATM Physical Security Guidelines are available for download on the EAST Intranet to EAST members (National and Associate), and there is a version available for wider circulation.  EAST Associate Membership is free for Law Enforcement Officers.

EAST Publishes European Fraud Update 3-2015

EAST - EUROPEAN FRAUD UPDATE 3 - 2015EAST has just published its third European Fraud Update for 2015. This is based on country crime updates given by representatives of 17 countries in the Single Euro Payments Area (SEPA), and 3 non-SEPA countries, at the 37th EAST meeting held in London on 7th October 2015.

Card skimming at ATMs was reported by seventeen countries. One country reported the successful usage of a stereo-skimming device, the first time that this has been reported. Another country reported an unsuccessful attack using an ATM shimming device.

The trend of losses due to skimming occurring outside of EMV* Chip liability shift areas continues. International losses were reported in 53 countries and territories outside of the Single Euro Payments Area (SEPA) and in 10 within SEPA. The top three locations where such losses were reported were the USA, Indonesia and the Philippines.

Skimming attacks on other terminal types were reported by nine countries and one country reported such attacks at payment terminals linked to docking stations for the hire of bicycles.

Eleven countries reported cash trapping attacks and six countries card trapping incidents.

ATM malware and logical security attacks were reported by two countries – one of them reporting malware used for ‘cash-out’ attacks and the other black-box attacks used for the same purpose.

Ram raids and ATM burglary were reported by seven countries and seven countries also reported explosive gas attacks. In one country the average duration of an ATM explosive gas attack is 3-5 minutes.

The full Fraud Update is available to EAST Members (National and Associate) and Subscribers.

EAST Publishes European Fraud Update 2-2015

EAST - EUROPEAN FRAUD UPDATE 2 - 2015EAST has just published its second European Fraud Update for 2015. This is based on country crime updates given by representatives of 19 countries in the Single Euro Payments Area (SEPA), and 2 non-SEPA countries, at the 36th EAST meeting held at Europol in the Hague on 10th June 2015.

Card skimming at ATMs was reported by 17 countries, with decreases reported by 7 countries and increases by two. Six countries reported card data compromise through wire-tapping or ‘Eavesdropping’ – the criminals cut a hole in the fascia near to the card reader, insert a device which is connected internally to the card reader and then cover the hole with a fake decal.

Skimming attacks on other terminal types were reported by 8 countries and overall the number of attacks appears to be decreasing.

Fourteen countries reported cash trapping attacks and 7 countries incidents of transaction reversal fraud (TRF).

ATM malware incidents were reported by four countries. These were ATM ‘cash out’ or ‘jackpotting’ attacks. Two of the countries reported such attacks for the first time. To help counter this threat Europol has recently published a document entitled ‘Guidance and Recommendations regarding Logical attacks on ATMs’.

Ram raids and ATM burglary were reported by 9 countries, with one of them reporting increases in this type of attack and another a new method for accessing the ATM from below. Eleven countries reported explosive gas attacks, and two of them also reported attacks on ATMs using solid explosives.

The full Fraud Update is available to EAST Members (National and Associate) and Subscribers.