The European Network and Information Security Agency, whose mission is to achieve a high level of network and information security within the European Union via technologies such as broadband, online and ATM banking, e-commerce and mobile phones, says annual ATM losses associated with crime in Europe are approaching €500 million (U.S. $724.8 million).
Now ENISA, in response to what it calls an "alarming" trend, is urging consumers to be more aware of the risks and is advising precautions to avoid personal losses. The rapid growth in the number of ATMs, combined with more sophisticated attacks and fraud, resulted in a 149-percent increase in ATM attacks from 2007 to 2008.
ENISA's findings, along with information and case studies highlighting the different ATM crimes, have been published this week in a paper by ENISA called "ATM Crime: Overview of the European situation and golden rules on how to avoid it."
Europe's number of ATMs increased 6 percent last year and now totals nearly 400,000 machines. Many of those ATMs are located off-site at convenience stores, airports and gas stations. Seventy-two percent of European ATMs are located in United Kingdom, Spain, Germany, France and Italy.
ENISA found most ATM-related fraud is conducted through skimming and shoulder-surfing attacks, when fraudsters obtain PINs. In 2008, a total of 10,302 skimming incidents were reported in Europe.
Other methods used to extract money include trapping and then retrieving users' cards, preventing cash withdrawals in the middle of the transaction, only to have the fraudster complete the transaction later, after the victim has left the ATM.
Organized crime rings also are using sophisticated phishing techniques and hacking into bank computer systems and Web sites to obtain PINs and account information, ENISA says.
ATM burglaries and physical attacks, including ram raids and explosions, also are on an upswing, increasing 32 percent over the last 12 months.
Andrea Pirotti, executive director at ENISA, says ATMs are attractive to criminals because they are seen as being relatively easy targets:
ATMs are attractive to criminals because they contain bank notes, while the bank cards themselves give thieves access to customers' bank accounts. Looking ahead, ATM crime is likely to become even more attractive as the latest generation of ATMs is designed to dispense other services and products, such as phone top-ups and stamps. The first line of defense against ATM crime is increasing awareness of the risks so that users can take simple precautions such as shielding their PIN when entering it and by keeping alert to any signs of tampering or suspicious activity at an ATM.
In its report, ENISA also recommends that financial institutions and payment schemes take their own precautions, Pirotti says:
Information security has for too long been focusing on technical solutions to maximize protection. Most ATM crime is focused on exploiting the human element, and cardholders must be more aware of the risks they are exposed to and how to prevent fraud (from) occurring.
