EAST presents at INTERPOL Dialogue

EAST presents at INTERPOL DialogueOn 13th July 2017 Otto de Jong from ING Netherlands and chair of the EAST Expert Group on All Terminal Fraud (EGAF) attended and presented at the INTERPOL event Countering Cyber and Financial Crimes: A High-level Dialogue for a New Governance Architecture in Lyon, France.

Otto de Jong (second from right in the picture) gave an overview of EAST and covered ATM Crime and Card Fraud rising threats from the perspective of the private sector.

Nearly 190 representatives from law enforcement, financial, telecommunications and Internet sectors discussed cyber-enabled fraud issues and recommendations aimed at streamlining the global response in the face of escalating cyber and financial crime threats.

ATM Explosive Attacks surge in Europe

european-atm-crime-report-h1-2016In a European ATM Crime Report covering the first six months of 2016 EAST has reported that ATM explosive attacks were up 80% when compared to the same period in 2015.

A total of 492 explosive attacks were reported, up from 273 during the same period in 2015.  While the majority were explosive gas attacks, 110 were solid explosive attacks.  EAST Executive Director Lachlan Gunn said, “This rise in explosive attacks is of great concern to the industry in Europe as such attacks create a significant amount of collateral damage to equipment and buildings as well as a risk to life.  The EAST Expert Group on Physical Attacks (EGAP) is working to analyse the attacks and to share intelligence best practice information across the industry and law enforcement that can help to mitigate the threat.”

Overall ATM related physical attacks rose 30% when compared with H1 2015 (up from 1,232 to 1,604 incidents).  Losses due to ATM related physical attacks rose 3% to €27 million (up from €26.3 million in 2015).  The average cash loss for a ram raid or burglary attack is estimated at €17,327, the average cash loss per explosive attack is €16,631 and the average cash loss for a robbery is €20,017.  These figures do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in successful attacks.

EAST also reported a 28% increase in ATM related fraud attacks, up from 8,421 in H1 2015 to 10,820 in H1 2016.  This rise was mainly driven by a 281% increase in Transaction Reversal Fraud (up from 1,270 to 4,840 incidents).  The downward trend for card skimming continues with 1,573 card skimming incidents reported, down 21% from 1,986 in H1 2015.

Losses due to ATM related fraud attacks were up 12% when compared with H1 2015 (up from €156 million to €174 million).  This rise was largely driven by an 8% rise in international skimming losses (up from €131 million to €142 million).  The Asia-Pacific region (particularly Indonesia) and the USA are where the majority of such losses were reported.  Domestic skimming losses rose 24% over the same period.

The number of ATM logical attacks reported continues to rise.  28 incidents were reported (all ‘cash out’ or ‘jackpotting’ attacks), up from just 5 during the same period in 2015.  Related losses were €0.4 million.

A summary of the report statistics under the main headings is in the table below:

h1-2016-crime-report-summary-stats

The full Crime Report is available to EAST Members (National and Associate).

Card skimming losses continue to rise outside Europe

EAST 2015 Crime ReportIn a European ATM Crime Report covering the full year 2015 EAST has reported that skimming losses relating to the usage of stolen European card data outside Europe have risen to the highest level seen since 2008.

There was a 19% increase in ATM related fraud attacks, up from 15,702 to 18,738 in 2015.  This increase was mainly driven by a significant rise in Transaction Reversal Fraud (TRF) attacks (up from 160 to 5,104) and a smaller rise in card trapping attacks (up from 5,298 to 6,352).  4,131 card skimming incidents were reported, down 27% from 5,631 in 2014.

Losses due to ATM related fraud attacks were up 17% when compared with 2014 (up from €280 million to €327million).  This rise was largely driven by a 15% rise in international skimming losses (up from €238 million to €274 million).  The USA and the Asia-Pacific region are where the majority of such losses were reported.  Domestic skimming losses rose 19% over the same period (up from €37 million to €44 million).

EAST Executive Director Lachlan Gunn said, “While regional card blocking, often known as geo-blocking, is effective at minimising international skimming losses when implemented, the continued rise of such losses is of concern to Europe.  EAST is now working closely with Europol to increase awareness among experts in Asia-Pacific and the Americas about all types of non-cash means of payment, including card skimming, ATM malware, internet fraud and eCommerce fraud.  Most recently we supported the Second Strategic Meeting on Payment Card Fraud.  This event, which was organised by Europol’s European Cybercrime Centre (EC3) in Kuala Lumpur on 22-23 March 2016, provided the regional law enforcement community with a comprehensive overview of the ATM fraud and its migration to Asia, and the focus is now to establish a cross-regional network to assist international investigations.”

ATM related physical attacks rose by 34% when compared with 2014 (up from 1,980 to 2,657 incidents).  This is partly explained by a 9% increase in reported solid explosive and explosive gas attacks.  673 such attacks were reported, up from 619 in 2014.  Nine countries reported such attacks, four of them countries with more than 40,000 ATMs installed.  The number of reported robberies also increased, up from 60 in 2014 to 838 in 2015.  This rise is partly due to the fact that more countries are now apply to provide such data.

Losses due to ATM related physical attacks rose 81% to €49 million (up from €27 million in 2014).  The average cash loss for ram raids/ATM burglary was €17,830 per incident, and the average cash loss for an explosive or gas attack is €15,602 per incident.  While around 40% of such attacks do not result in cash loss, collateral damage to equipment and buildings can be significant.

In 2014 EAST began to collect statistics for ATM Malware after the first incidents were reported in Western Europe.  15 incidents were reported in 2015, down from 51 in 2014.  These were all ‘cash out’ or ‘jackpotting’ attacks.  Related losses of €743,000 were reported, down from €1.23 million in 2014.

To counter the malware threat, the EAST Expert Group on ATM Fraud (EGAF) worked with the European Cybercrime Centre (EC3) at Europol to create ‘Guidance & recommendations regarding logical attacks on ATMs’, a document published by Europol in June 2015.

 A summary of the report statistics under the main headings is in the table below.

EAST 2015 Crime Report Summary Stats

The full Crime Report is available to EAST Members (National and Associate).

EAST presents at ISMG Fraud Summit in London

tower guoman hotelEAST Executive Director Lachlan Gunn presented EAST and the latest EAST European ATM Crime Report at a Fraud Summit held by the Information Security Media Group (ISMG) in London on 27th October 2015.

The event was held at the Tower Guoman Hotel beside Tower Bridge and the Tower of London.  A key theme of the summit was that fraud is a global problem and that to fight it global collaboration is essential.

Other speakers who covered payment fraud included Neira Jones, an independent cyber and payments security expert who focused on social engineering; and Jeremy King, the PCI Security Standards Council’s International Director, whose talk highlighted that European data breaches are under-reported.

More information can be found on The Fraud Blog by Tracy Kitten.

 

 

EAST Presents at NCR Security Summit

NCR Security SummitEAST Executive Director, Lachlan Gunn, presented at the NCR Security Summit held in London on 12th October 2015.  The event, which was well attended by delegates from around the world, focused on the threats facing the ATM channel and what can be done to counter them.  NCR updated on Kalpana and the evolution of their security innovation.

EAST gave an overview of the ATM crime situation in Europe during the first six months of 2015, using statistics from the latest EAST European ATM Crime report (subsequently published on 13th October 2015).

Graham Mott of the LINK Scheme, and Chair of the EAST Expert Group on ATM Physical Attacks (EGAP), was also present at the event.

NCR is an Associate Member of EAST.

European ATM Related Fraud Incidents fall 26%, although Skimming Losses rise

EAST ATM Crime Report 2014In a European ATM Crime Report covering the full year 2014 EAST has reported that ATM related fraud incidents fell 26% when compared to 2013, although related losses were up 13%.

EAST reported a 26% decrease in ATM related fraud attacks, down from 21,346 in 2013 to 15,702 in 2014. This fall was mainly driven by a 95% reduction in Transaction Reversal Fraud (TRF) attacks and a 31% reduction in cash trapping attacks. 5,631 card skimming incidents were reported, down 3% from 5,822 in 2013. Card trapping incidents fell 2% over the same period (down from 5,394 to 5,298). Trapped cards can be used in the EMV environment (if the PIN has also been compromised).

Losses due to ATM related fraud attacks were up 13% when compared with 2013 (up from €248 million to €280 million). This rise was largely driven by an 18% rise in international skimming losses (up from €201 million to €238 million). The USA and the Asia-Pacific region are where the majority of such losses were reported. Domestic skimming losses fell 9% over the same period.

EAST Executive Director Lachlan Gunn said, “The rise in international skimming losses is not being seen in European countries where regional card blocking, often known as geo-blocking, has been widely implemented. Keeping an active magnetic stripe on a European EMV card continues to make that card vulnerable to card skimming and geo-blocking significantly reduces the risk of successful compromise.”

ATM related physical attacks fell 6% when compared with 2013 (down from 2,102 to 1,980 incidents). This is partly explained by an 11% decrease in reported solid explosive and explosive gas attacks. 619 such attacks were reported, down from 696 in 2013. Nine countries reported such attacks, five of them countries with more than 40,000 ATMs installed.

Losses due to ATM related physical attacks rose 17% to €27 million (up from €23 million in 2013). The average cash loss for ram raids/ATM burglary was €25,640 per incident, up from €11,393 in 2013. While around 40% of such attacks do not result in cash loss, collateral damage to equipment and buildings can be significant.

In 2014 EAST began to collect statistics for ATM Malware after the first incidents were reported in Western Europe. These were ‘cash out’ or ‘jackpotting’ attacks. In 2014 51 such incidents were reported, with related losses of €1.23 million.

A summary of the report statistics under the main headings is in the table below.

2014 Summary Results Table

The full Crime Report is available to EAST Members (National and Associate) and Subscribers.