Article

EAST publishes European fraud update

The U.S. is becoming increasingly attractive to criminals using non-EMV compliant counterfeit cards.

July 18, 2011

The European ATM Security Team (EAST) has released its second European Fraud Update for 2011. The report is based on country crime updates given by representatives from 21 countries in the Single Euro Payments Area (SEPA), and two non-SEPA countries, at the 24th EAST meeting held in The Hague, Netherlands on June 8.

Skimming attacks at ATMs continue with 20 countries reporting incidents. Eight countries reported increases in such incidents, and two countries decreases. Two countries have reported a new variant of skimming device, and three countries reported that anti-skimming devices have been successfully thwarted or removed by criminals.

Despite a continuing fall in overall losses, the trend of the majority of losses due to skimming occurring outside of EMV "liability shift" areas continues, with such losses reported in 35 countries outside of SEPA, and in seven countries within SEPA.

"When countries which have not adopted the EMV standard finally do so, they will join the EMV 'liability shift,'" said Lachlan Gunn, EAST coordinator and author of the report. "The 'liability shift' means that acquirers, such as merchants and ATM deployers, will become liable for any fraud that results from transactions on systems owned by them that are not EMV capable. This is a great incentive to get the laggards moving, although there are of course costs for terminal upgrade." 

The U.S. is the top location for such losses, followed by Argentina, the Dominican Republic and Russia. Several countries have now seen the introduction of regional card blocking, with some card issuers blocking domestic cards for usage outside of Europe.

There is still a risk of EMV cards being skimmed as long as they have an active mag-stripe on them. Assuming PIN compromise, a counterfeit EMV card cannot be used at an EMV compliant terminal unless the card issuer allows fall back.

Fall back occurs when the transaction falls back from the chip to the stripe in the event that the chip is damaged, or does not function or does not exist, in the case of a counterfeit. Increasingly, European card issuers are switching off fall back. Fall back does not apply in a market such as the U.S., which is not EMV compliant, which is why the U.S. is now attractive to criminals using counterfeit cards from other parts of the world that are EMV compliant.  

"As a result some European card issuers are now blocking all debit card stripe transactions outside of ‘liability shift’ areas. In some cases, the card holder can opt in to allow them. The case for chip-only cards is also building, such as the V Pay cards from Visa," Gunn said.

Additionally, skimming attacks have again been reported on unattended petrol station terminals, with six countries reporting such attacks. Anti-skimming devices, where implemented, have been effective, according to the report. Seven countries reported skimming attacks at POS terminals, with one reporting card skimming attacks. 

"Anti-skimming devices will always have a part to play as long as there are cards with magnetic stripes on them. In some European countries, such devices are mandatory for all ATMs, or for ATMs that have been attacked by fraudsters," Gunn said.

Ram raids and ATM burglary were reported by eleven countries, with two reporting decreases in such attacks.  Explosive gas attacks were reported by five countries and EAST members are currently investigating measures to counter this form of attack, according to a press release.

The following countries supplied full or partial information for the update: Austria; Belgium; Bulgaria; Canada; Cyprus; Denmark; Finland; France; Germany; Hungary; Ireland; Italy; Liechtenstein; Luxembourg; the Netherlands; Norway; Poland; Portugal; Russia; Slovakia; Sweden; Switzerland; the United Kingdom.