News

EAST reports 2016 crime stats for Europe's ATMs; black box attacks up 287 percent

April 13, 2017

A newly published report from the European ATM Security Team discloses that criminals carried out ATM black box attacks in 10 reporting countries during 2016.

"Black box" refers to an attack in which a criminal physically connects an unauthorized digital device to an ATM and then, through that device, relays commands that cause the ATM to dispense cash.

According to the EAST 2016 Crime Report, member nations reported 58 such attacks in 2016 compared with 15 in 2015 — a 287 percent increase. However, related losses declined 39 percent, from $790,000 to $450,000.

"While the rise in black box attacks is a concern, we are pleased to note that many of these attacks were not successful," EAST Executive Director Lachlan Gunn said in a press release.

The EAST Expert Group on ATM Fraud collaborated with Europol in 2015 to produce "Guidance and recommendations regarding logical attacks on ATMs," a document intended to help the industry combat black box attacks.

Fraud attacks

The EAST crime report also reveals that the number of ATM-related fraud attacks in reporting nations increased 26 percent, from 18,738 in 2015 to 23,588 in 2016.

view larger

This rise was driven mainly by a 147 percent increase in the incidence of transaction reversal fraud (5,104 in 2015 compared with 12,581 in 2016).

The report also relates some good news: The downward trend for card skimming continued in 2016 with 3,315 card skimming incidents compared with 4,131 in 2015 — a decline of 20 percent. 

This is the lowest number of skimming incidents reported since 2005, EAST said.

The bad news: Losses from ATM-related fraud rose 2 percent compared with 2015 (from $349 million to $355 million).

Losses due to skimming occurred mainly in the Asia-Pacific region and the United States, continuing an established trend. Domestic skimming losses rose, as well, from over the same period from $47 million to approximately $57 million, an increase of 24 percent.

Physical attacks

ATM-related physical attacks rose from 2,657 in 2015 to 2,974 in 2016, a 12 percent increase.

ATM explosive attacks (including solid explosives and explosive gas and solid explosive attacks) increased 47 percent from the previous year from 673 incidents in 2015 to 988 in 2016. In both years, reported losses from explosive attacks totaled $52 million.

The estimated cash loss for an ATM ram raid or burglary comes to $15,905; for an explosive attack $18,589; and for a robbery is $21,676. EAST noted that these figures do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in a successful attack.

The complete EAST 2016 Crime Report, with breakdowns for each crime category, is available to EAST members and subscribers.