EAST presents at the ATEFI Security Committee 2021

EAST Development Director Rui Carvalho presented at the ATEFI Security Committee on 30th April 2021, a virtual event.  The impact of the Covid-19 pandemic has made it more important than ever for the sharing of threat intelligence to strengthen security strategies in Electronic Payments.  The event focussed on both physical and cyber security.  Rui shared key information and statistics from the latest EAST Payment Terminal Crime Report, as well as insights from the 9th Meeting of the EAST Payments Task Force (EPTF) held on 14th April 2021.  He covered:

  • ATM Malware & Logical Attacks
  • Terminal Related Fraud
  • ATM Physical Attacks
  • Payment Fraud (social engineering, ransomware, e-skimming)

The event was attended by public officials, law enforcement agencies, regulatory entities, representatives of international organisations, Managers and Network Security Officials, ATEFI Members from the entire LATAM region and Spain, as well as bank officials, representatives of the Latin American Bank Associations, Credit and Debit Card executives, and specialised media.

ATEFI is the Latin American Association of Operators Electronic Funds Transfer and Information Services and represents 20 ATM networks in 14 countries throughout Latin America.

In May 2016 EAST and ATEFI joined forces in order to further strengthen cross border cooperation in combating all types of payment crime including payment card fraud, hi-tech crime and ATM cyber and physical attacks.

EAST Payments Task Force (EPTF) holds Ninth Meeting

The Ninth Meeting of the EAST Payments Task Force (EPTF) took place on Wednesday 14th April 2021.  Due to the Covid-19 situation it was conducted as a virtual meeting and 24 EPTF members participated.

The EPTF is a specialist task force that discusses security issues affecting the payments industry and that gathers, collates and disseminates related information, trends and general statistics.

The meeting was chaired by Mr Rui Carvalho, EAST Development Director, and key representatives from Card Issuers, International Banks, Law Enforcement, Payment Processors and Solution Providers took part.

INTERPOLEuropol, the US Secret Service and the DCPCU provided the law enforcement perspective, and Group-IB gave a presentation on e-skimming/JavaScript (JS) sniffers.

Short presentations were also made by Cartes Bancaires, Diebold NixdorfFiducia & GAD, HSBC, JP Morgan Chase, ING BankMasterCard Members’ AssociationPAN-Nordic Card AssociationPSAPLUSCARD, SIBs, STMPtietoEVRY and Trend Micro.  Investment scams and non-banking fraud were reported as rising issues.

The Group, which meets three times a year, adds value to the payments industry by using the unique and extensive EAST National Member and EAST Global Member platforms, and the Associate Member network, to provide information and outputs that are not currently available elsewhere.

EAST National & Global Members represent 35 countries and outputs from the group are presented to EAST Global Congress Meetings.  There are 207 EAST Associate Member Organisations from 52 countries and territories.

Carding Action by Police prevents €40 million in losses

EFECCCarding Action 2020, an operation led by law enforcement agencies from Italy and Hungary and supported by the UK and Europol, targeted fraudsters selling and purchasing compromised card details on websites selling stolen credit card data, known as ‘card shops’, and ‘dark web marketplaces’.

The operation sought to mitigate and prevent losses for financial institutions and cardholders. Group-IB and card schemes worked in close cooperation with police authorities from the countries involved. During the three-month operation, 90,000 pieces of card data were analysed and prevented approximately €40 million in losses.

Europol facilitated the coordination and the information exchange between law enforcement authorities and partners from the private sector. Europol’s experts provided operational analysis on large volumes of data and supported with expertise in the field of payment card fraud.

“Cybercrime can affect all aspects of our daily life, from paying in the supermarket, transferring money to our friends to using online communication tools or Internet of Things devices at home. Cybercriminals can attack us in different ways and this requires a robust response not only from law enforcement, but also from the private sector,” said Edvardas Sileris, Head of Europol’s European Cybercrime Centre (EC3). “With more than €40 million in losses prevented, Carding Action 2020 is a great example of how sharing information between private industries and law enforcement authorities is a key in combating the rising trend of e-skimming and preventing criminals from profiting on the back of EU citizens…..” he added.

The expansion of e-skimming attacks targeting merchant point of sale systems and e-commerce merchants also influenced the significant increase of prevented losses. As reported in Europol’s iOCTA 2020, card-not-present (CNP) fraud is a criminal threat in constant evolution, generating millions of euros of losses and affecting thousands of victims from across the EU.

The EAST Payments Task Force (EPTF) is a public-private sector platform that focusses on tackling the issues of e-skimming and payment fraud.

EPTF holds Eighth Meeting

The Eighth Meeting of the EAST Payments Task Force (EPTF) took place on Wednesday 11th November 2020.  Due to the Covid-19 situation it was conducted as a virtual meeting and 19 EPTF members participated.

The EPTF is a specialist task force that discusses security issues affecting the payments industry and that gathers, collates and disseminates related information, trends and general statistics.

The meeting was chaired by Mr Rui Carvalho, EAST Development Director, and key representatives from Card Issuers, International Banks, Law Enforcement, Payment Processors and Solution Providers took part.

There was a detailed discussion on the impact of Covid-19 on fraud, on e-skimming, and on Instant Payments.  INTERPOL, Europol and the DCPCU provided the law enforcement perspective, and short presentations were also made by Diebold Nixdorf, Fiducia & GAD, ING Bank, MasterCard Members’ Association, PAN-Nordic Card Association, PSA, PLUSCARD, STMP, tietoEVRY and Trend Micro.

The Group, which meets twice a year, adds value to the payments industry by using the unique and extensive EAST National Member platform and Associate Member network to provide information and outputs that are not currently available elsewhere.  EAST National Members represent 35 countries and outputs from the group are presented to National Member Meetings.  There are 209 EAST Associate Member Organisations from 53 countries and territories.

EAST presents on ATM Attacks at EUFCC

EUFCC

On 3rd November 2020, Europol and the FS-ISAC hosted the 3rd EU Financial Cybercrime Coalition (EUFCC) meeting. The virtual event brought together EU law enforcement and the financial sector to discuss financially motivated cybercrime in three dedicated workshops. Subject matter experts from both the private sector and law enforcement discussed the latest threats and trends in relation to ransomware, ATM attacks, and cyber-enabled fraud and business email compromise.

In the ATM Attacks session, Europol gave the law enforcement perspective and EAST Executive Director Lachlan Gunn gave a presentation from the viewpoint of the industry. The main issue covered was black box attacks which, as highlighted by the latest crime statistics published by EAST, are a rising threat in Europe.

The EAST presentation highlighted how its public/private sector platforms operate, and the latest ATM Attack trends.  The key topics covered by EAST were:

EAST also touched on e-skimming, and EAST Development Director Rui Carvalho, who also chairs the EAST Payments Task Force (EPTF), commented that, while skimming attacks on terminals are at the lowest level ever reported by EAST, e-skimming is a rising threat.  This is on the Agenda for discussion at the 8th EPTF Meeting, which will be held on 11th November 2020.