News

ATM logical attacks, losses across Europe soar 230 percent in 2017

April 11, 2018

European nations reported 192 ATM malware and logical attacks in 2017. This represents a 231 percent increase from 58 attacks in 2016, according to a new European Payment Terminal Crime Report by the European Association for Secure Transactions.

According to a press release from EAST, losses from malware and logical attacks rose consistently with attack numbers and were up 230 percent — from 460,000 euros ($568,546) in 2016 to 1.52 million euros ($1.88 million) in 2017.

view larger

All but three of the 2017 attacks involved the use of a "black box" to send commands directly to the ATM cash dispenser, causing it to cash out the machine.

EAST also said that Western and Central Europe saw their first cash-out attacks in 2017, with three such attacks reported by two countries.

"The use of malware, such as Cutlet Maker, to cash out ATMs has been around for some time, but has not been reported in Western or Central Europe until 2017," EAST Executive Director Lachlan Gunn said in the release. "Early indications are that such attacks are continuing this year, although the recent related arrests announced by Europol are encouraging."

Between 2016 and 2017, overall payment terminal-related fraud attacks fell 11 percent (from 23,588 incidents to 20,971). The decline was mainly driven by a 23 percent decrease in card skimming incidents, which dropped from 3,315 in 2016 to 2,556 in 2017.

This is the seventh successive year that the number of skimming incidents has fallen; the number of incidents reported in 2017 is the lowest since EAST first began gathering data in 2004, the association said.

Losses due to payment terminal related fraud attacks were up 6 percent compared with 2016 (from 332 million euros to 353 million).

Within these totals international skimming losses rose 5 percent (from 267 million euros to 280 million euros) and domestic skimming losses were up 21 percent (from 53 million euros to 64 million euros).

From 2016 to 2017, ATM-related physical attacks rose 21 percent (from 2,974 incidents to 3,584). Within this total ATM explosive attacks (both gas and solid explosives) were up 9 percent (988 incidents to 1,081).

Losses due to ATM-related physical attacks totalled 31 million euros, a 37 percent drop from 49 million euros reported in 2016. Part of this decrease is due to the fact that one major ATM deploying country that used to report this data is currently unable to do so.

The average cash loss for a robbery is estimated at 16,899 euros per incident, the average cash loss for a ram raid or burglary attack is 12,804 euros and the average cash loss per explosive or gas attack is 12,591 euros, EAST said.

The figures do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in a successful attack.