Article

Card trapping incidents decline, but thieves get more from the attacks

Card trapping incidents unexpectedly declined in Europe, and no one is sure why.

November 1, 2010

A judge in London's Old Bailey Court recently sentenced two men to prison after police arrested them for card trapping.

Gabriel Trifan and Cristenel Lazar, both of Romania, were found guilty of conspiracy to defraud, and each was sentenced to three years in prison. The Dedicated Cheque and Plastic Crime Unit of the London police arrested Trifan and Lazar after catching them fitting ATMs in two locations with card-trapping equipment. The two also were convicted of filming cardholders typing in their four-digit PINs.

The sentencing of Trifan and Lazar made headlines. Card trapping also is making headlines within the ATM industry because card trapping incidents have unexpectedly declined in Europe, and no one is sure why. Trapping occurs when a person's card is physically captured inside the ATM and the PIN is compromised.

Thieves steal the card by inserting a strip or sleeve of metal or plastic called a "Lebanese Loop" in the ATM's card slot. When the cardholder inserts his ATM card, the loop is sufficiently long for the card to be fully drawn into the machine and read. The cardholder types in his PIN and requests his funds. The ATM attempts to eject the card, but a "lip" folded at the end of the loop prevents the card from being ejected. The machine senses that the card has not been ejected and pulls the card back into the machine.

The cash drawer does not open, and the money that has been counted is retained by the machine. After the frustrated card owner storms off without his card, thieves remove the card from the ATM with the "Lebanese Loop." Later, thieves use the stolen card to make fraudulent cash withdrawals.

ATM industry experts predicted card trapping would become the next big challenge for the ATM industry because ATM officials believed they had tamed card skimming — the leading type of ATM crime — with the deployment of EMV-capable ATMs throughout Europe.

Instead the opposite happened. Card skimming increased between January and June, but card trapping dived, according to the 2010 European ATM Security Team (EAST), which is based in Edinburgh, Scotland.

EAST gathered data from 22 countries that are EAST members. The 22 countries have an installed base of 360,721 ATMs. They are: Austria, Belgium, Cyprus, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Liechtenstein, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, Switzerland and the United Kingdom.

EAST recently reported that there were 756 reported incidents of card trapping between January and June, down 28 percent compared with 1,045 incidents during first six months of 2009.

Financial losses from card trapping slightly increased.

The ATM-related losses from card trapping were 608,600 euros in the first six months of 2010, compared with 583,800 euros in the first six months of 2009.

"There's no direct answer to the decline in card trapping," explained Lachlan Gunn, EAST coordinator. Gunn speculated that card trapping is not very attractive to thieves because they can only use a stolen card two or three days before the card owner's bank blocks card withdrawals. According to London police, cardholders did not suffer any financial losses as result of the exploits of Larzar and Trifan.

Despite the decline in card trapping, the ATM Industry Association and Gunn consider card trapping a threat. ATMIA recently published best practices for preventing card trapping.

ATMIA recommends that banks educate customers on what it calls the three "Nevers."

1. Never accept help from a stranger at an ATM.

2. Never disclose your PIN or allow anyone standing behind you in line to watch you enter your PIN.

3. Never allow yourself to be distracted while carrying out a transaction.

The manual discusses types of card trapping devices, methods and counter-measures, and includes a checklist of recommendations, such as regular checking of the ATM fascia for illegal devices, which may have been attached to the machine.