EAST FCS Terminal Fraud Seminar 2018

terminal fraudAn EAST FCS Terminal Fraud Seminar was held on 10th October 2018 in London, co-located with RBRs ATM & Cyber Security 2018 Conference. The interactive and successful event focused on two key outputs of the EAST Expert Group on All Terminal Fraud (EGAF):

  • Guidelines regarding logical attacks on ATMs
  • Standardised fraud definitions

An introduction to EGAF by the Chair, Otto de Jong, was followed by a presentation by EAST’s Executive Director Lachlan Gunn, covering the latest EAST fraud statistics from the H1 2018 European Payment Terminal Crime Report. This highlighted that losses due to card fraud at payment terminals have fallen to the lowest level since 2005. Total losses of €107 million were reported and the decrease is primarily due to a fall in losses due to card skimming (down from €118 million to €104 million). Overall payment terminal related fraud incidents were down 43% (from 11,934 to 6,790). Within this total card skimming incidents were down 19% (from 1,221 to 985) and well below the peak of 5,743 incidents reported during the same period in 2010.

Juan Jesus Leon Cobos of GMV then covered the evolution of ‘Cash-out’/jackpotting attacks, sharing the latest trends from Latin America.  This was followed by a presentation from Tobias-Christian Wieloch of the European Cybercrime Centre (EC3) at Europol which focused on Europol’s published ‘Guidance & Recommendations regarding Logical & Malware Attacks on ATMs’, and an update to it that will soon be available.

Nick Webber, an independent forensic expert, then shared insights into card shimming and ‘wedge’ attacks, with a particular focus on the UK experience.

The final presentation came from Ben Birtwistle of the Royal Bank of Scotland and Claire Shufflebotham of TMD Security, who jointly covered the existing fraud definitions published by EAST, and steps being taken to update and simplify the definitions using graphics, as well as the addition of criminal benefits for each fraud type.  Otto de Jong then summarised the event and what would be taken forward for future discusson.

Attendance to the regular EAST EGAF work group meetings is limited and this event enabled active participation and input from a much wider pool of expertise.  Due to the positive response received from delegates, this Terminal Fraud Seminar is expected to be repeated in 2019.

More information on the event, which was sponsored by NCR, can be found on the EAST Events Website


.

2018 EAST FCS Terminal Fraud Seminar Sponsor

 

 

Card fraud losses fall to 13 year low

EAST has just published a European Payment Terminal Crime Report covering the first six months of 2018 which reports that losses due to card fraud at payment terminals have fallen to the lowest level since 2005.

Total losses of €107 million were reported and the decrease is primarily due to a fall in losses due to card skimming (down from €118 million to €104 million). Overall payment terminal related fraud incidents were down 43% (from 11,934 to 6,790). Within this total card skimming incidents were down 19% (from 1,221 to 985) and well below the peak of 5,743 incidents reported during the same period in 2010.

EAST Executive Director Lachlan Gunn said, “The significant drop in card skimming incidents and losses reflects the continued effectiveness of EMV, as well as the work that has been put in by payment terminal deployers and card issuers with regard to counter-measures such as geo-blocking, fraud monitoring capabilities and fraud detection. Europe led the way with EMV, which is now a global standard, and all stakeholders in the payment card industry are benefitting from the increased security.”

Logical attacks against ATMs were down 46% (from 114 to 61) and all the reported ‘jackpotting’ attacks were ‘black box’ attacks.  Related losses were down 83% (from €1.51 million to €0.25 million) reflecting the fact that many of these attacks are unsuccessful.

ATM related physical attacks were up 21% (from 1,696 to 2,046 incidents).  Attacks due to ram raids and ATM burglary were up 26% (from 470 to 590 incidents) and ATM explosive attacks (including explosive gas and solid explosive attacks) were up 2% (from 481 to 490 incidents).  Losses due to ATM related physical attacks were €15.1 million, a 24% increase from the €12.2 million reported during the same period in 2017.

The average cash loss per explosive or gas attack is estimated at €14,748, the average cash loss for a robbery is €14,613 per incident and the average cash loss for a ram raid or burglary attack is €12,275.  These figures do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in successful attacks.

A summary of the report statistics under the main headings is in the table below.

card fraud

The full Crime Report is available to EAST Members (National and Associate)

ATM Malware Criminals Apprehended

Five members of an international organised criminal group (OCG) have been arrested and three of them convicted so far as a result of a complex operation led by law enforcement agencies from Europe and Asia, with the active support of Europol’s European Cybercrime Centre (EC3).  One arrest was made by the Romanian National Police, three arrests by the Taiwanese Criminal Investigation Bureau and one arrest by the Belarusian Central Office of the Investigative Committee.  EC3 assisted the investigation by providing analytical support, organising operational meetings in Europe and Asia as well as analysing the seized data/ equipment.

This OCG is responsible for carrying out highly-sophisticated ATM malware attacks against bank ATMs, which were made to dispense all the money they contained (known as cash-out or jackpotting).  The modus operandi employed was highly sophisticated and involved:

  • spear-phishing emails with attachments containing malicious programmes,
  • penetration of the banks’ internal networks,
  • compromising and controlling the network of ATMs,
  • special computer programmes which deleted most of the traces of the criminal activity, etc.

Related losses suffered by the affected banks are estimated at around EUR 3 million. In some cases, after the cashing-out, the stolen money was partially recovered from the criminals.

EC3A key factor for the successful dismantling of this international cybercrime syndicate was close police cooperation on the global level and deep involvement of the Europol Liaison Office at the INTERPOL Global Complex for Innovation (IGCI).

Steven Wilson, Head of EC3, said: “The majority of cybercrimes have an international dimension, taking into account the origins of suspects and places where crimes are committed. Only through a coordinated approach at the global level between law enforcement agencies can we successfully track down the criminal networks behind such large-scale frauds and bring them to justice.”  Mr Wilson will give the keynote address at the EAST Financial Crime and Security Forum which will be held in The Hague on 8th/9th June 2017.

To further strengthen international police cooperation the Third Strategic Meeting on Payment Card Fraud (PCF) was held last month at the Electronic Transactions Development Agency (ETDA) in Bangkok, Thailand.

Europol, working with the EAST Expert Group on ATM Fraud (EGAF), has published guidelines to help industry and law enforcement counter the threat presented by ATM logical and malware attacks.

ATM Jackpotting and Cyber-Skimming – an Update from Ukraine

cybercrimeThe use of malware for ATM ‘cash out’ or ‘jackpotting’ attacks appears to be on the increase globally. In a European ATM Crime Report covering the full year 2014, EAST reported 51 such incidents, with related losses of €1.23 million. EAST defines such attacks as ‘Malware that takes control of the ATM cash dispense function, thereby allowing the criminals to take out cash’.

EMA LogoAt EAST FCS 2015 Olesya Danylchenko, Deputy Director of the Ukrainian Interbank Payment Systems Members Association (ЕМА), will highlight payment fraud issues identified in Ukraine and neighbouring countries, trends in skimming and recent developments in Jackpotting attacks.

About Olesya Danylchenko

Olesya DanylchenkoOlesya is Head of Payment Instruments and Credits Security Forum and administrator of the interbank anti-fraud exchange-online system at EMA.
Prior to joining EMA, she was Head of the Payment Cards Security Department of the Banking Security Department at PJC Ukrsotsbank (Member of Unicredit Group) for 10 years. She was a Software Engineer and fraud monitoring system manager at the Interbank Processing Center Topaz, National Bank of Ukraine.

Book soon to ensure you don’t miss your opportunity to attend the EAST Financial Crime and Security (FCS) Forum 2015. Places are limited and registration priority will be given to EAST Members, National and Associate