News

European ATM Security Team says EMV has led to significant drop in ATM skimming

October 22, 2009

The European ATM Security Team (EAST) has announced the launch of a European ATM crime report that covers the first six months of 2009. For the third consecutive six-month reporting period, the overall number of fraud incidents (6,197) has remained stable, EAST says, with a slight increase of only 1 percent.

Card-skimming incidents are down by 19 percent, from 5,693 to 4,629 incidents, but card trapping is up 640 percent (from 141 to 1,045 incidents). Losses from card skimming are down 30 percent, from â‚¬222 million (U.S. $333.7 million) to â‚¬156 million (U.S. $234.5 million), while losses related to card trapping are up nearly 900 percent, from â‚¬590,000 (U.S. $886,900) to â‚¬5.8 million (U.S. $8.7 million).

EAST says the drop in skimming is a glowing endorsement for EMV, whose rollout in Europe is 92-percent complete.

But criminals have started to trap EMV cards, as a captured EMV card can be used at EMV-compliant ATMs and other payment terminals until it is blocked by the issuing bank. Losses related to card trapping remain much lower than skimming-related losses, but EAST says card trapping is an emerging threat.

EAST director and coordinator Lachlan Gunn says the drop in skimming losses, however, is definitely encouraging:

As other parts of the world also roll out EMV, concern remains that the USA appears to have no plans to follow suit. A significant part of overall European losses now occur there. To reduce this risk, a debate is now opening as to how it can be mitigated, and next month EAST will be conducting a related Web site research poll.

Data compromises also on the rise

Data compromise from cases of hacking or other fraud at data processors is another emerging threat that EAST is monitoring. Cases have been reported in Ukraine, the United States and the Dominican Republic.

Card data obtained from such attacks can be used to create counterfeit mag-stripe cards that can be used at ATMs to withdraw cash if the PIN also has been obtained. Without a PIN, the cards also could be used for signature-based POS transactions or for card-not-present transactions, if only the card number and expiration date have been obtained.

Physical attacks on European ATMs have risen by 12 percent, with small increases seen in ram raids and robberies. While the cash losses for such attacks are well below fraud levels, the risks to people and the collateral damage to property continue to remain of great concern. The deployment of banknote ink-dye staining systems continues to increase as a result.