Terminal related fraud attacks fall in Europe

EAST has just published a European Payment Terminal Crime Report covering H1 2023 which highlights a fall in terminal related fraud attacks.

Terminal related fraud attacks were down 40% (from 5,022 to 3,021 incidents).  This decrease was primarily due to a fall in cash trapping at ATMs. These attacks decreased by 40% (from 2,984 to 1,805 incidents).  Man-in-the middle/relay attacks continued to occur with 63 cases reported during the 6-month period.  The successful attacks resulted in cash out at ATMs. Total losses of €105 million were reported, up 8% from the €97 million reported in H1 2022.  Most losses remain international issuer losses due to card skimming, which were €88 million.

EAST Executive Director Lachlan Gunn said, “This fall in terminal related fraud attacks is very good news for the industry, for law enforcement, and for all stakeholders.  The excellent work done by our EAST Expert Group on All Terminal Fraud (EGAF) has played a major role in highlighting the risks of such attacks, and what can be done to mitigate them.  The group has also helped to counter ATM malware and logical attacks for which the numbers are now very low.  While terminal fraud levels are falling, social engineering, along with major scams, is a rising threat and our Expert Group on Payment and Transaction Fraud is focussed on countering this.”

ATM malware and logical attacks were down 33% (from 6 to 4) and all of the reported attacks were black box attacks.  A black box attack is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to ‘cash-out’ or ‘jackpot’ the ATM.  Most such attacks remain unsuccessful, and total losses of just €2,237 were reported.

ATM related physical attacks were down 4% (from 2,008 to 1,931 incidents).  Within this total, ATM explosive attacks (including explosive gas and solid explosive attacks) were up 7% (from 354 to 378 incidents) and attacks due to ram raids and ATM burglary were down 9% (from 274 to 249 incidents).  Losses due to ATM related physical attacks were €3.8 million, a 34% decrease from the €5.8 million reported during H1 2022. 57% of these losses were due to explosive attacks, which were down 1% from €2.19 million to €2.17 million.  While on average around 40% of such attacks do not result in cash loss, the loss figures shown do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in successful attacks.

A summary of the report statistics under the main headings is in the table below.

The full Crime Report is available to EAST Members (National, Global and Associate)