Europe sees 300 percent leap in ATM black box attacks
The European Association for Secure Transactions has published the European Payment Terminal Crime Report covering the first six months of 2017. During this time, 114 ATM black box attacks were carried out in 11 countries, according to a press release from EAST.
The most recent total represents an increase of 307 percent over the same period in 2016, when there were 28 such attacks.
In a black box attack, criminals connect an unauthorized device to the ATM in order to send commands to the machine to dispense all of its cash.
Losses from these "cash-out" incidents rose 268 percent year-over-year, from 410,000 euros ($481,000) in the first half of 2016 to 1.51 million euros ($1.77 million) during the same time frame in 2017 the release said.
"This sees the continuation of a trend that we first reported in April of this year when we published full year statistics for 2016," EAST Executive Director Lachlan Gunn said in the release. "Our Expert Group on All Terminal Fraud is actively monitoring all logical threats against payment terminals and against the wider banking infrastructure."
Overall payment terminal related fraud attacks rose 10 percent compared with the first half of 2016 — from 10,820 incidents to 11,934. This rise was mainly driven by an 88 percent increase in transaction reversal fraud,from 4,840 incidents to 9,081.
The downward trend for card skimming continued with 1,221 card-skimming incidents reported, a decline of 22 percent from 1,573 in the first half of 2016. This is the lowest number of reported incidents since EAST began gathering skimming data in 2004.
Losses due to payment terminal-related fraud attacks fell 29 percent year over year, from 174 million euros to 124 million euros ($204 million to $145 million).
International skimming included in this total dropped 32 percent, from 142 million euros to 96 million euros ($167 million to $113 million).
Domestic skimming losses fell 15 percent, from 26 million euros to 22 million euros ($31 million to $26 million).
ATM related physical attacks rose 6 percent when compared with the first half of 2016 (up from 1,604 to 1,696 incidents).
Within this total, ATM explosive attacks (using both gas and solid explosives) were down 2 percent, from 492 to 481 incidents.
Losses in the first half due to ATM-related physical attacks dropped 55 percent year-over-year from 27 million euros to 12.2 million euros ($31.7 million to $14.3 million). Part of this decrease is due to the fact that one major ATM deploying country that previously reported this data is unable to do so currently.
The average cash loss per explosive or gas attack is estimated at 14,575 euros ($17,100); the average cash loss for a robbery is 10,357 euros ($12,152) per incident; the average cash loss for a ram raid or burglary attack is 9,761 euros ($11,452).
These figures do not take into account collateral damage to equipment or buildings, which can be significant — often exceeding the value of the cash lost in successful attacks.
The following countries, representing an installed base of 373,453 ATMs, supplied full or partial information for this report: Austria; Belgium; Cyprus; Czech Republic; Denmark; Finland; France; Germany; Greece; Ireland; Italy; Liechtenstein; Luxembourg; Netherlands; Norway; Portugal; Romania; Spain; Sweden; Switzerland; and United Kingdom.
The full report, with breakdowns for each crime category, is available to EAST members and subscribers.