News

EAST issues 2nd update on ATM-related crime in 2017

July 7, 2017

EAST has published its second European Fraud Update for 2017, based on country crime updates from representatives of 21 countries in the Single Euro Payments Area and five non-SEPA countries.

Ten countries reported payment fraud issues. One country reported a new type of fraud in which the card primary account number is compromised in China, leading to fraud in that country. In these cases the CPP is sometimes detected, but most of the time it is not.

Another country reported data compromise due to voice phishing (aka "vishing") attacks, "phishing" websites and "SMiShing" (i.e., attack via SMS phishing).

Fifteen countries reported ATM malware and logical security attacks. So far in 2017, EAST has published 10 related fraud alerts.

Two of the 15 countries reported ATM malware and 14 reported the use (or attempted use) of black box devices to allow the unauthorized dispensing of cash. Five countries reported black box attacks for the first time, further indication that this type of attack is continuing to spread.

Nineteen countries reported skimming at ATMs. The use of M3 category (card reader internal skimming) devices continues to spread.

This type of device can be placed at various locations inside the motorized card reader behind the shutter. Nine countries reported such attacks; in 2017, EAST has published six M3-related fraud alerts.

International skimming-related losses were reported in 49 countries and territories outside of the Single Euro Payments Area and in 9 countries within SEPA. The top three locations for such losses were are the U.S., Indonesia and the Philippines.

Ten countries reported skimming attacks on other terminal types and five countries reported such attacks on unattended payment terminals at petrol stations. Two countries reported the use of card reader internal shimming devices at POS terminals.

Eight countries reported incidents of transaction reversal fraud. One country reported a significant increase in TRF attacks and two countries reported attacks for the first time.

Ram raids and ATM burglaries were each reported by nine countries. This year, EAST has published nine related ATM physical attack alerts.

Six countries reported the use of solid in attacks. The spread of this type of attack is a matter of growing concern to the industry due to the risk it poses to life and to the significant amount of collateral damage to equipment and buildings.