News

In Europe, surging costs from ATM skimming, physical attacks

According to EAST's full-year 2015 report, card fraud carried out in non-EMV markets remains a huge headache for European issuers; locally, lower-tech card trapping and explosive attacks spiked.

April 14, 2016

The newly released full-year 2015 European ATM Crime Report from the European ATM Security Team reveals that losses stemming from bankcard data skimmed at European ATMs and used outside of Europe have risen to their highest level since 2008.

The number of ATM-related fraud attacks jumped from 15,702 to 18,738 between 2014 and 2015, corresponding to a 19 percent increase, according to an EAST press release.

The increase was mainly driven by a significant rise in transaction reversal fraud attacks (up from 160 to 5,104) and a smaller rise in card-trapping attacks (up from 5,298 to 6,352).

EAST member nations recorded a decline in the number of card-skimming incidents in the reporting period. However, amounts lost as a result of these attacks rose from 280 million euros to 327 million euros ($320 million to $373 million), or 17 percent, between 2014 and 2015.

This increase was driven largely by a jump in international skimming losses from 238 million euros to 274 million euros ($272 million to $313 million), or 15 percent, during the period.

Most of these losses were reported in the U.S. and the Asia-Pacific region; domestic skimming losses rose from 37 million euros to 44 million euros, or 19 percent, over the same period.

EAST Executive Director Lachlan Gunn said that while regional card blocking has proven effective at minimizing international skimming losses it has not prevented a rise in the cost of skimming.

"EAST is now working closely with Europol to increase awareness among experts in Asia-Pacific and the Americas about all types of noncash means of payment, including card skimming, ATM malware, Internet fraud and e-commerce fraud," he said.

ATM-related physical attacks were up 34 percent compared with 2014. This increase is explained in part by a 9 percent rise in reported solid explosive and explosive gas attacks.

During the period 673 such attacks were occurred, compared with 619 in 2014. Nine countries reported such attacks.

The number of reported robberies increased from 60 in 2014 to 838 in 2015. However, EAST said, the rise is explained in part by the fact that more countries are now able to provide such data.

Losses due to ATM related physical attacks rose 81 percent during the reporting period — from 27 million euros ($31 million) in 2014 to 49 million euros ($56 million) in 2015. The average cash loss from ram raid or ATM burglary was 17,830 euros ($19,565) per incident, and the average cash loss for an explosive or gas attack is 15,602 euros ($17,808) per incident. While around 40 percent of such attacks do not result in cash loss, collateral damage to equipment and buildings can be significant, the release said.

EAST began to collect statistics for ATM Malware attacks after the first incidents were reported in Western Europe in 2014. Member nations reported 15 incidents in 2015, down from 51 in 2014. These were all ‘cash-out’ or ‘jackpotting’ attacks. EAST member nations reported average losses of 743,000 euros ($848,037) down from 1.23 million euros ($1.37 million) in 2014.

To counter the malware threat, the EAST Expert Group on ATM Fraud worked with the European Cybercrime Centre at Europol to produce "Guidance & recommendations regarding logical attacks on ATMs." Europol published the document in June 2015.