Article

Webinar: Your 10-point plan to combat ATM skimming

You'll need a lot more than gear to win this war.

June 3, 2013 by Suzanne Cluckey — Owner, Suzanne Cluckey Communications

Skimming accounts for less than one-third of reported ATM fraud incidents. But what it lacks in frequency, skimming fraud easily makes up for in impact, constituting 92 percent of ATM fraud losses annually.

Given the high stakes of ATM skimming, it's imperative for operators to stay abreast of the trends in skimming and the tactics of the criminals who carry it out — increasingly in sophisticated, well-coordinated organized gang attacks.

In a May 28 webinar, "10 Essential Facts to Combat ATM Skimming," TMD Security and the European ATM Security Team offered a three-part examination of global skimming crime and countermeasures. The webinar was hosted by ATM Marketplace.

Crime insights

Claire Shufflebotham, global security director at TMD Security, provided a detailed look at the types of skimmers currently used by criminals, starting with the oldest type — digital skimming, which today represents 35 percent of all skimming attacks, and analog skimming, which makes up the remaining 65 percent.

In stereo skimming, the criminal records both the jamming and card data signals. Later, the jamming signal is filtered out,allowing access to card data.

Shufflebotham also discussed a new technique — stereo skimming — which is used to foil one or even two jamming signals. 

The criminal uses a skimming device with two or more read heads. One reads the jamming signal and the card data signal, the other reads just the jamming signal.

There are various methods of stereo skimming, and the technique continues to evolve, Shufflebotham said.

"A skimming device with multiple read heads has been found in the U.K., a failed attempt by the criminal to read the three data tracks on the magnetic stripe." Although this attempt was not a success, "[c]learly criminals are thinking ahead and stereo skimming is an imminent threat," she said.

Case Study

Lachlan Gunn, coordinator and director of EAST, reviewed Europe's experience with fraud migration following the implementation on that continent of EMV chip-and-PIN transactions.

Gunn said that in 2005, EMV compliance stood at 52 percent, but by 2010, it had risen to 98.8 percent. "At the end of 2010, we saw a switch in criminal activity from high-tech skimming attacks to lower tech card and cash trapping attacks, as well as to transaction reversal fraud."

High-tech skimming crime waned as Europe reached nearly full compliance. However it began to rise again in 2012, as gangs began to use data collected in Europe to commit fraud at U.S. ATMs.

Skimming losses in Europe declined dramatically through 2011. Then fraud began to migrate. In 2012, losses by European banks began to rise again as criminals began to use data skimmed in Europe to commit fraud in non-EMV markets. In fact, Gunn said, EAST and Europol estimate that 80 percent of fraud on European cards occurs in the U.S. 

In response, European banks have begun geo-blocking of cards and the EU central bank has mandated that all new cards must be chip only. Likewise, China has mandated that by 2016, all cards must abandon the magnetic stripe.

"Led by Europe and China, the rest of the world is likely to follow," Gunn said.

Anti-skimming checklist

Robin Hamstra, commercial director at TMD, offered webinar attendees a 10-point process for the implementation of an effective skimming protection program.

In the first place, he said, success depends on an in-depth understanding of criminal techniques and threats — and the unique requirements of a self-service environment. Protection from fraud must be be balanced with optimum ATM availability and cardholder convenience. 

In its entirety, an effective anti-skimming program should have these characteristics:

"Tactical approaches to anti-skimming just do not work," Hamstra said. "Fraud, as we know, migrates to the next weakest link, and an effective risk management strategy depends on a smart, informed response to address threats."

The complete webinar, including the accompanying visuals, is now available online for free download.

Read more about security.

cover photo: xbeveridge

About Suzanne Cluckey

---

Suzanne’s editorial career has spanned three decades and encompassed all B2B and B2C communications formats. Her award-winning work has appeared in trade and consumer media in the United States and internationally.