Article
Jackpotting makes its way to Western Europe's ATMs
Though malware attacks constitute a minority of ATM crimes in Europe, the stealth, speed, criminal finesse — and cash — involved make them particularly worrisome to deployers.
October 16, 2014 by Suzanne Cluckey — Owner, Suzanne Cluckey Communications
In the first half of 2014, Western European nations reported 20 ATM malware attacks. In the larger scheme of things, it's not a lot. But it's a first. And this has ATM deployers in Western Europe concerned that jackpotting might be the next ATM crime wave.
The European ATM Security Team publicized this unsettling statistic in its European ATM Crime Report for the first half of 2014, released just this week. The announcement was accompanied by a statement from Lachlan Gunn, executive director of EAST:
While this was one group of criminals attacking a single ATM type in a specific type of location, this is a worrying new development for the industry in Europe. Through the EAST Expert Group on ATM Fraud we have been working with the ATM vendors, and vendors of logical security systems and services, to communicate the steps that should be taken by ATM deployers and networks to mitigate these risks across all ATM types and locations. The industry in Europe has taken significant steps to reduce ATM-related fraud and the overall drop in incidents reflects this.
Jackpotting, or "cash out" at an ATM involves the physical installation of malware (by means of a CD or USB drive) on the machine's computer. With the corrupt code installed, criminals can send a series of commands to the ATM to dispense cash, emptying the unit in short order.
Though widely publicized, malware attack makes up the minority of ATM crimes. For the first half of the year, EAST cited a far greater number of physical attacks across reporting nations — via gas and explosives, cash and card trapping, and brute force using everything from a prybar to a forklift.
But the degree of stealth, speed and criminal finesse involved in ATM cash out make it a more insidious — and worrisome — crime. And the amount of cash involved makes it the kind of attack that ATM deployers will lose a lot more sleep over.
"ATM Malware incidents are most concerning, with the potential for significant cash losses for ATM operators," the ATM Industry Association Executive Director for Europe, Ron Delnevo, told ATM Marketplace. However, he added, "There are some countermeasures which can be employed which should contain these incidents when rigorously implemented ... Full implementation of security measures already available would be an excellent step in the right direction."
Kaspersky Lab, which first identified the latest malware version, called Tyupkin, has published a list of recommendations for preventing malware attacks — including steps as simple as changing factory-set passwords.
The big money is still in fraud
As might be expected given the past few years' trend, the number of ATM-related fraud attacks declined in the first half of 2014. However the amount of the drop-off was startling — 42 percent compared with the same period in 2013.
Nevertheless, ATM-related fraud losses were up 7 percent year over year, at 132 million euros ($169 million), compared with 124 million euros ($159 million) in the first half of 2013.
The majority of losses — 129 million euros ($165 million) were due to card skimming, driven by an increase in international losses (i.e., losses on domestic cards taking place outside national borders). Such losses rose 11 percent to 111 million euros ($142 million) compared with 100 million euros ($128 million) during the same period in 2013.
Nearly all skimming losses occurred in the United States, Asia-Pacific and Latin America, EAST found. The migration of skimming fraud from Europe is likely to continue until EMV becomes widely adopted in these regions.
"It is possible that criminals anticipating the full implementation of EMV in the U.S. may rush to take advantage of the current gap," Delnevo said. "However, even if this is occurring, it will ultimately be a small price to pay by comparison to the long term advantage of closing the U.S. off to such criminal activity."
Trapping incidents decline ...
For the first time card trapping incidents were in the majority with 2,579 such incidents reported, up 49 percent from the 1,735 incidents reported in H1 2013. Card skimming incidents fell by 21 percent, continuing a downward trend that started in 2010. Cash trapping attacks dropped 52 percent and incidences of transaction reversal fraud plummeted 96 percent.
While physical attack losses mount.
The incidence of ATM-related physical attacks on European ATMs increased by 3 percent (from 1,007 to 1,032) driven by an increase in vandalism and other minor attacks.
The number of solid explosive and explosive gas attacks at ATMs fell by 12 percent (298 in H1 2014 compared with 337 in H1 2013). Such attacks were reported by eight countries, four of them countries with more than 40,000 ATMs installed. An increase in solid explosive attacks is an emerging trend.
Overall reported losses due to ATM physical attacks rose 29 percent to 13 million euros ($17 million), according to EAST. Combined losses due to ram raids, ATM burglary and explosive attacks increased by 24 percent compared with the same period in 2013; the average cash loss per attack was 14,109 euros ($18,084) per incident.
Information for the EAST H1 2014 report was provided by these countries: Austria; Belgium; Czech Republic; Denmark; Finland; France; Germany; Greece; Ireland; Italy; Liechtenstein; Luxembourg; the Netherlands; Portugal; Romania; Slovakia; Spain; Sweden; Switzerland; the United Kingdom. EAST national members represent 29 countries with a total deployment of 639,379 ATMs.
photo courtesy andy tyler | flickr
About Suzanne Cluckey
Suzanne’s editorial career has spanned three decades and encompassed all B2B and B2C communications formats. Her award-winning work has appeared in trade and consumer media in the United States and internationally.
Included In This Story
ATM Industry Association (ATMIA)
The ATM Industry Association, founded in 1997, is a global non-profit trade association with over 10,500 members in 65 countries. The membership base covers the full range of this worldwide industry comprising over 2.2 million installed ATMs.
