ATM Security & Fraud Prevention

Cash will remain king......or will it?

2012-02-24T11:19:00.009Z

According to an article just published by KAL Software: "Every time a new way of paying for something has arrived – credit and debit cards, internet payments, contactless cards,mobile phone payments – the imminent death of cash has been announced. It sounds a reasonable prediction to make given the convenience of these new methods." Written by Peter Jones, the article maintains that cash remains well used in a mixed economy of competing payment methods. It seems that people get 70% of their cash from ATMs, which reduce the cost to banks of dispensing cash by 80%, and can also be used to cut costs further. I can't argue with that.

But it is well known that banks don't like cash; it is expensive to process, to maintain, and to move around. On the other hand people do like cash because it is invisible (no tracking of purchases by any third parties), easy to use, and trusted. I have seen stats from one European country which do however prove that cash is in the descendant when compared to other payment methods. It will be interesting to compare future statistics from countries where all cards and terminals are EMV compliant, with those (such as the USA) which are lagging behind. The heated debate relating to the future of cash has been going for at least a couple of decades now, and the initial assessements of the anti-cash lobby have certainly been proved wrong.

That being said it is all about trust and convenience and, as people become more and more trusting of other payment methods (particularly debit cards), they do use less cash. I know that I do! And regardless of what is in our wallets, as the online economy continues to boom, the correlation must be that less is spent in the cash economy. At the end of the article it states that: "Research by the UK Payments Council has shown that the heaviest users of cash are not just older people, but young adults aged 16-24." This should perhaps cause some concern to the pro-cash lobby. Surely this is the demographic group most likely to embrace mobile technology? Hmmn.......I guess this debate will be going on for some time yet!

Get the whole of the article here.

Singapore takes a joined up approach to ATM Security

2012-01-25T08:23:00.000Z

In 2011 there seemed to be quite a consensus among industry pundits that, while EMV (Chip and PIN) is indeed the way forward for cards and terminals, as long as EMV cards retain magnetic stripes, the cards will still be at risk from skimming. In Europe we have seen the introduction of chip-only debit cards, and of regional card blocking, or geo-blocking, of debit cards by some European card issuers - and there is speculation that many more are following.

Last week I saw an annoucement from the Association of Banks in Singapore (ABS) stating that:

All ATM and ATM-linked debit cards will be EMV cards by 2014.
By June of this year, and to counter a recent spate of skimming incidents, all ABS members will start sending out SMS text alerts to customers when their cards are used for ATM withdrawals at home or abroad
And also by June of this year all Singaporean banks will block ATM and ATM-linked debit cards from being used overseas, unless individual customers request otherwise.

Now that is a joined-up approach to card security! As the new Singaporean EMV cards are rolled out, they will still be vulnerable to skimming attacks, but the fraudsters will find it very difficult to use the counterfeits due to enhanced fraud detection (SMS alerts) and fraud prevention (geo-blocking) measures. This will make life difficult for fraudsters in that market and no doubt incidences of other forms of ATM related crime will appear. Based on the European experience these could well be cash trapping, and physical attacks against ATMs or against those conducting cash replenishment operations.

Peak shopping time increases cardholder risk....

2011-12-12T09:34:00.000Z

As we enter the final run-up to Xmas and the New Year, the shopping bonanza is well under way. This of course presents great opportunities for criminals. Yesterday I noted that the Turkish authorities have just arrested 10 Bulgarian nationals for ATM skimming offences....these guys had skimming devices placed on 4 ATMs in Istanbul for over a week. According to Bulgarian national radio the fraudsters managed to steal data from 300 cards and obtain 50,000 Turkish Lira. The arrests were made in Istanbul, as well as in a hotel on the Turkish-Greek border. A large amount of skimming equipment was also seized. It is good that these guys are safely out of the way for the time being, but there are of course thousands more out there.

What can you do to reduce the risk of your card being skimmed at an ATM?

Always be vigilant when using an ATM (or any payment terminal) and always shield your PIN when entering it. Does this make any difference? Watch seized criminal video footage to see that it does.

Visit the website of the European ATM Security Team (EAST) for other cardholder security tips.

Europe has over 400,000 ATMs.....but watch China!

2011-11-25T08:26:00.004Z

According to the European ATM Security Team (EAST) there are now 403,369 ATMs in Europe. While growth is slowing, the total rose by 1.3% from H1 2010 to H1 2011. EAST has been keeping these stats since 2005 and the chart below shows overall growth since then. You can download a country breakdown from the EAST website.

How does this compare to the rest of the world? While the figures for Canada and Russia are provided by EAST, I have found it harder to find accurate statistics for the rest (without paying). My best estimates are as follows:

USA	420,000
China	271,000
Latin America	231,000
Japan	121,000
Russia	100,000
Canada	58,600
India	33,000

According to Retail Banking Research (RBR) China, which had 210,000 ATMs at the end of 2009, will have 545,000 ATMs by 2015. According to the ATMIA Global ATM Clock there are now 2,321,253 ATMs in the world. RBR predicts that by 2015 this will have grown to 2.9 million.

At the moment Europe is the world's second biggest ATM market. By 2015 the pictutre will have changed significantly, and the U.S. will have fallen from the top spot. This must be good news for GRG, the Chinese ATM manufacturer. I wonder what impact this will have on global ATM fraud? The good news is that China is moving towards EMV (Chip and PIN). By 2015, according to China UnionPay, all Chinese cards issued will be EMV cards. Both Visa and MasterCard have now announced the introduction of an EMV liability shift for the U.S., Visa by 2015 and MasterCard by 2013 but, at the moment, only MasterCard has mentioned ATMs.

If you can provide accurate statistics for ATM numbers in any country, please could you post them in a comment on this blog.

Cash trapping continues in Europe, while skimming attacks decrease

2011-11-16T08:08:00.001Z

The European ATM Security Team (EAST) has just published another Fraud Update (3/2011). According to this most of the reporting countries continue to see an increase in cash trapping incidents, a trend reported by EAST in its European ATM Crime Report covering the period January to June 2011, something that I covered in a related post last month, which also gives some background information on the crime.

Attacks are most prevalent against one type of ATM and upgrades to its cash dispenser are still being reported as 100% effective in preventing such attacks. The upgrade is visible, however, and this has led to displacement with attacks shifting to ATMs that have not been upgraded.

The surge in cash trapping incidents appears to mirror a decrease in ATM related card skimming incidents, with most countries reporting falls. Linked to this the trend of the majority of skimming related losses occurring outside of EMV liability shift areas continues; from January to September 2011 such losses were reported in 47 countries outside of the Single Euro Payments Area (SEPA) and in 12 countries within SEPA. The USA remains the top location for such losses, followed by the Dominican Republic, Russia and Brazil.

Regional card blocking (card issuers blocking domestic payment cards for usage outside of Europe) continues to be successful with one country reporting significant resultant falls in skimming related losses.

To download the full Fraud Update (and other EAST outputs such as European ATM Crime Reports) it is necessary to take out an annual subscription, which can be done from the EAST website.

ATM Cash trapped by a snake..........

2011-11-04T10:34:00.001Z

A customer using an ATM at a Caja Madrid bank branch in Llodio, Spain got a bit of shock when trying to take money from the cash dispenser - a snake appeared to deter the action. Apparently it got into the cash dispense mechanism and become trapped! That must be a first.................

Watch the clip to see the drama - the good news is that the snake was set free and sent to a shelter.

ATM cash trapping attacks surge in Europe

2011-10-18T14:13:00.000+01:00

According to data just published by the European ATM Security Team (EAST) there has been a surge in cash trapping activity during the first six months of 2011 - 6,797 incidents were reported, compared to just under 150 during the first six months of 2010. That is a staggering increase. What is cash trapping and why is this happening?

To steal cash criminals install a trap at the ATM's cash dispenser shutter so that when a cardholder makes a cash withdrawal, the transaction is completed as normal, but the cash does not appear. It remains hidden, retained by the trap which is removed by the criminals after the card holder has left the ATM. Why is this happening?

I first picked up on this trend in March 2011 after EAST published a European Fraud Update. When compared to card skimming, this is a high effort low return activity for fraudsters. EAST has just reported 6,797 cash trapping attacks, with related losses of €0.49 million. By comparison EAST reported 3,863 skimming incidents with related losses of €111 million - but skimming losses have declined for the past seven reporting periods, down from a peak of €315 million during the second six months of 2007.

A successful skimming incident can result in the compromise of multiple cards, from which the data is used to create counterfeits. These can then be used to make cash withdrawals at any ATM that is not EMV (Chip and PIN) compliant, or to make purchases or payments. The problem for the criminals is that the migration to EMV in Europe is nearing completion. The vast majority of payment cards, ATMs and payment terminals are now EMV compliant. So what?

So a counterfeit EMV card cannot be used at an EMV compliant payment terminal or ATM as it does not have a Chip. Merchants or ATM deployers in the Single Euro Payments Area (SEPA) still using non-compliant terminals suffer financial penalties if fraudulent transactions are perpetrated at them. Of the €111 million skimming related losses reported by EAST, €85 million were international i.e. took place outside the card issuer's national borders. And the rest of the world is following Europe. Most recently the U.S. has committed to doing the same, with MasterCard stating that by 19th April 2013 all U.S. ATMs should be EMV compliant. Also, some European card issuers are blocking the usage of debit cards outside of EMV areas.

Which brings us back to cash trapping. If you are going to steal cash (banknotes) at an ATM, EMV does not matter. The genuine customer enters a PIN, a genuine transaction takes place, but the cash is trapped and the customer leaves without it. The problem for the bad guys? High effort low reward. The risks are similar to card skimming, but the returns are negligible. Any gain is limited to the transaction amount, and the traps must be physically harvested (unlike skimming where compromised data can be sent remotely by a blue tooth connection).

So yes, cash trapping is soaring in Europe and is a huge inconvenience to any cardholder denied cash from a genuine transaction. But it smacks of a certain desperation in the criminal fraternity. Why engage in this low reward activity? The answer is perhaps the success of EMV. The industry is now alerted to cash trapping and so additional counter-measures will almost certainly be rolled out to counter it. It will be interesting to see what happens over the next year or so.............

You can read the full press release on the EAST Website and subscribers to the EAST Website can download the full European ATM Crime Report.

How to protect your PIN.....by being creative!

2011-10-17T14:31:00.001+01:00

It is the responsibility of an EMV Cardholder (someone holding a Chip enabled card) to protect their PIN when entering it into an ATM, or at any payment terminal. Best industry advice is to shield it whenever entering it into a device, thereby preventing visual compromise. Sometimes this is not easy.........and you have to be creative in how you do it. EURO Kartensysteme in Germany has produced the short amusing video below, which illustrates this point. If you don't read German the text says:

At the Supermarket checkout.......................my PIN remains secret

For more cardholder security tips, and to watch seized criminal video footage of ATM PIN compromise, visit the website of the European ATM Security Team (EAST).

Woman attacks ATM with a shoe!

2011-09-27T13:08:00.002+01:00

A British woman has been given a police caution for attacking a Barclays ATM with her high-heeled shoe. The attack took place in shortly after midnight on Saturday 2nd July 2011 in Chippenham, in the County of Wiltshire.

According to The Telegraph the attack left both the key pad and the screen out of order.

"This was a completely senseless and inane act which caused sufficient damage to make the machine unusable for other customers," said Detective Constable Richard Gardner of Wiltshire Police.

Finextra has reported that, after being interviewed last week, the woman has now been given a conditional caution. She has also re-paid the bank for damage caused to the ATM key pad and screen.

Now you can print out an ATM skimming device!

2011-09-22T12:23:00.003+01:00

According to the blog 'KrebsonSecurity' a gang involved in skimming in the U.S. stole more than US$400,000 using skimming devices built with the help of high-tech 3D printers. Is it possible to print out a workable skimming device?? Apparently it is. 3D printers take two dimensional computer images and build them into three dimensional items by putting down successive layers of powder that are heated, shaped and hardened. The video below from 3D printing company i-materialise clearly shows how this is done.

3D printing in action from i.materialise on Vimeo.

According to Brian Krebs "word is spreading in the cybercrime underworld that 3D printers produce flawless skimmer devices with exacting precision. Last year, i-materialise blogged about receiving a clients order for building a card skimmer. The company said it denied the request when it became clear the ordered product was a fraud device."

Apparently a Federal court case is on-going in the U.S. with four men on trial for re-investing the profits from skimming crime to purchase a 3D printer. These printers are not cheap and can cost from US$10,000 to US$20,000.

Blog view: While this does appear to be one way to get a skimming device, the 3D printing technology is not cheap. It is known that basic skimming devices can be obtained over the internet for just a few hundred US dollars, with more expensive USB, Bluetooth or GSM variants available for a wide variety of ATM models and types (these are in the approximate price range of US$2,500 to US$4,000 and kits are also available that include PIN pads and some blank cards). Why would a criminal invest in such a piece of expensive 3D technology (which might not always create a perfect device and would always be at risk of seizure), when the ready made items can be easily purchased? There must also be costs associated with designing each skimming device variant and with putting together the required two-dimensional drawings. But for those illegally selling skimmers this might be a new way to produce them................

U.S. based ATMs will have to take EMV cards by 19 April 2013

2011-09-09T09:56:00.002+01:00

In my blog last month The U.S. moves towards EMV! Visa announces plans.... I finished with the question " I wonder when we will see a similar announcement from other card schemes?" Now MasterCard has entered the arena. According to an article in the Credit Union Times, MasterCard Worldwide spokesperson Seth Eisen has said that "U.S.-based ATMs will have to take EMV cards as of April 19, 2013." It is stated that he offered additional clarification in an email:

“On September 1, MasterCard announced it will extend its existing EMV liability shift program for inter-regional Maestro ATM transactions, as part of an effort to align technology efforts to prevent and manage fraud.............The liability shift will cover both the United States and Asia-Pacific regions and will be effective on April 19, 2013, with the exception of Australia and New Zealand, where the liability shift will become effective on December 31, 2015. South Asia (Bangladesh, Bhutan, India, Maldives, Nepal and Sri Lanka) will continue to be excluded from the inter-regional ATM EMV liability shift program. It should be noted that liability shift already applies for Europe, Canada and the Middle East and Africa and will be completed for Latin America by end of October 2012.”

VISA seized the initiative on U.S. EMV last month, although there was a noticeable absence of anything relating to ATMs. Now it looks as if MasterCard is attempting to regain the initiative with a stated deadline for U.S. ATMs. 19th April 2013 may seem like a long time away, but compliance will require super fast planning if U.S. ATM deployers want to comply by the deadline. Non-compliance could be expensive, a lesson that was learned in Europe as liability for fraud losses was passed from EMV card issuers to the owners of non-EMV compliant ATMs.

The MasterCard announcement is very good news for EMV card issuers!

Hacking attack leads to US$13 million in ATM losses....

2011-09-03T22:14:00.001+01:00

Last week the blog 'KrebsOnSecurity' reported that U.S. based Fidelity National Information Services Inc. (FIS) had incurred a loss of of approximately US$13 million related to unauthorised activities involving one client and 22 prepaid cards. While the attack took place in March, it has been largely unreported in the media and full details of the resultant investigation have not yet been released.

Apparently the balances on these prepaid cards aren’t stored on the cards themselves; rather the card numbers correspond to records in a central database, where the balances are recorded. Some prepaid cards cannot be used once their balance has been exhausted, but the prepaid cards used in this attack could be replenished by adding funds.

According to Brian Krebs the fraudsters were able to drastically increase or eliminate the withdrawal limits for the 22 prepaid cards that they had obtained. They then cloned the prepaid cards, and distributed them to co-conspirators in several major cities across Europe, Russia and Ukraine, who waited until the close of business in the United States on Saturday, 5th March 2011, to launch their attack.

Working into the Sunday evening, fraudsters in Greece, Russia, Spain, Sweden, Ukraine and the United Kingdom used the cloned cards to withdraw cash from dozens of ATMs. Armed with unauthorized access to FIS’s card platform, the crooks were able to reload the cards remotely when the cash withdrawals brought their balances close to zero.

This attack is similar to the 2008 attack against RBS WorldPay, an Atlanta-based unit of the Royal Bank of Scotland. In that operation the fraudsters obtained remote access to RBS’s systems and used 44 counterfeit prepaid cards to withdraw more than $9 million from at least 2,100 ATM terminals in 280 cities worldwide.

ATM cassette standardisation for Europe? The debate has started........

2011-09-03T12:14:00.000+01:00

Since my first blog on this topic ATM Marketplace has published interviews that highlight each side of the argument.

In the first interview EPC Chairman Gerard Hartsink talks about the benefits of standardization, and why there is no need for manufacturers and cash-in-transit companies to complain.

In the second interview Aleksandra Lubavs, director of EMEA marketing, communications and strategy for Diebold highlights the disadvantages and states that this is a short-sighted approach in terms of total cash optimization and elimination of cost within the retail banking self-service market. The expectation is that adopting this approach would inevitably lead to hidden costs. There are clear benefits for the CIT industry though.........and I wonder why Mr Hartsink thinks that they might want to complain?

I go with the second view and reiterate what I said in my first blog - any final decision on this in Europe needs to be taken by the ATM deployers and not by their suppliers! I wonder if the position of the EPC accurately reflects the opinion of the majority of the European ATM deployers, and how far it has been swayed by the lobbying and opinions of some suppliers?

PIN compromise using thermal imagery unlikely at metal ATM PIN pads

2011-08-30T09:14:00.001+01:00

Since my last post I have come across more information on the thermal camera threat relating to PIN compromise. Having read the research paper it seems that most ATMs are not at risk from this threat as, at the moment, the possibility of PIN compromise from thermal imaging technology really only exists for PIN entry at plastic PIN pads, and even then the success rate is not high - although the researchers claim that it is economically viable. As most ATMs seem to have metal key pads, this is a relief for the industry. The possibility of using thermal imaging for PIN compromise was first demonstrated by Michael Zalewski in 2005.

At the Woot '11 5th USENIX Workshop on Offensive Technologies held on 8th August 2011 in San Francisco, a presentation entitled Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks was delivered. This was based on research and analysis carried out by Keaton Mowery, Sarah Meiklejohn, and Stefan Savage from the University of California, San Diego. If you want to read more you can visit the website of the USENIX Workshop and download the slide presentation made by Mowery et al and/or the full research paper.

Covering your PIN may not protect it from cameras?

2011-08-25T08:37:00.004+01:00

The industry is already aware that covering a PIN when entering it may not be 100% effective as, if the criminals use a PIN pad overlay, the PIN will be compromised regardless. It is still recommended as cardholder 'best practice', however, as the risk of visual compromise is significantly mitigated. For cardholder security tips, and a criminal video showing actual PIN compromise, visit the website of the European ATM Security Team.

Now, according to Security News on msnbc.com, new research in the U.S. has indicated that thermal cameras can be used for PIN compromise, even if the cardholder covers their hand when the PIN is entered. How? Apparently the keys touched by a human hand still retain some residual heat and this can be detected be a thermal camera once the hand has been removed. Researchers from the University of California have carried out a series of proof-of-concept attacks using a thermal camera mounted above a traditional ATM pinpad.

These tests, using 27 randomly selected four-digit codes on both plastic and brushed metal PIN pads, revealed that, although the metal PIN pad made thermal detection attacks almost impossible, thermal cameras can detect a cardholder's keystrokes after after the person has left the ATM. Unlike metal keys, which retain heat for only a few seconds due to their high conductivity, rubber keys retain heat much longer: The researchers detected PINs with approximately 80 percent accuracy 10 seconds after the person entered their PIN. 45 seconds after being pressed, the thermal cameras were still able to determine PINs with 60 percent accuracy.

According to the researchers ""Using a thermal camera........provides an attacker the ability to recover the code even in the cases where, for example, a user's body is blocking the keypad throughout the transaction, or he just covers the keypad with his hand as he types in the PIN..."

Is this a threat that the industry should take seriously? Perhaps not right now due to cost: the researchers' camera costs US$1,950 per month to rent, and US$17,950 to buy. But its a worry nonetheless and, after cost-benefit analysis, some crimninals may decide that the technology is worth a punt. Read the whole msnbc.com article here.

Have you registered for SMS alerts when your debit card is used?

2011-08-18T09:46:00.000+01:00

I am used to getting texts from my bank whenever one of my debit cards is used. There is something reassuring about the 'beep beep' of an incoming text shortly after I have made a transaction, and especially when I am travelling. If that debit card was fraudulently used, I would quickly know about it.............With my bank this is an 'opt-in' service for cardholders, and not every bank that I use provides it.

I have just noticed that, according to an article in the Times of India, with effect from July 2011, the Reserve Bank of India (RBI) has made it mandatory for ALL Indian banks to provide this service to debit card holders, and all debit card holders are required to register their mobile phone numbers with their bank for this purpose. Clearly card fraud is on the rise in India and this is a sensible step for the market to be taking to help counter it. As a card holder it always feel good to be pro-active in the fight against card fraud, and registering for SMS alerts is within my power, as is covering my PIN when making a transaction at ATM or a payment terminal.

Does your bank over an SMS alert service for debit card transactions? It might be worth asking the question........

The U.S. moves towards EMV! Visa announces plans....

2011-08-12T09:01:00.002+01:00

Visa has just announced its plans to accelerate chip migration and adoption of mobile payments. This is great news as there is now a roadmap for (partial) EMV implementation in the U.S. Visa will bring in a U.S. liability shift for domestic and cross-border counterfeit card-present POS transactions, with effect from 1st October 2015. Merchants selling fuel will have an additional two years, until 1st October 2017. Unfortunately there is no mention of ATMs - the preferred channel for fraudsters to obtain cash!

I have commented in the past about the fact that the U.S. is lagging behind the rest of the world due its reluctance to adopt EMV or Chip and PIN technology. The gap that is opening up as a result can be separated into two main parts:

Firstly card fraudsters are now increasingly using compromised EMV cards to obtain cash in the U.S. - this is possible as an active magnetic stripe can be copied or skimmed from an EMV card, and a counterfeit created. While overall European card skimming related losses are dropping, an increasing proportion of these are now occurring in the U.S. as is stated in the 2010 European ATM Crime Report produced by EAST. Also, of course, domestic fraud losses for U.S. card issuers will almost certainly be rapidly rising.

Secondly, the holders of U.S. stripe only cards are increasingly unable to use their cards for transactions at Chip only terminals in other parts of the world, leading no doubt to substantial drops in related transaction volumes and revenue, as people use Chip enabled travel cards or other alternatives.

The Visa announcement is a positive step in the right direction, although 2015 is still a long way off and U.S. ATM transactions still need to be added to the domestic and cross-border liability shift. I wonder when we will see a similar announcement from other card schemes?

One size fits all? Should Europe adopt a single standard ATM cassette?

2011-07-20T10:42:00.003+01:00

The European Payments Council (EPC) wants all ATMs in Europe, 398,040 as at the end of 2010 according to the European ATM Security Team, to use a standard cash cassette. It is claimed that this will lead to substantial savings in the cost of cash, as well as to benefits when integrating Intelligent Banknote Neutralisation Systems (IBNS's), which are activated in the event of a robbery or theft to stain the banknotes with ink.

The EPC is committed to driving for an increase in electronic payments and states that the introduction of a standard ATM cash cassette would be for the medium term to ensure the efficient management of the SEPA ATM infrasructure.

Apparently an initial dialogue has been conducted with cash-in-transit (CIT) companies, ATM manufacturers and vendors of IBNS. Hmmmn! These types of organisation are always looking to find ways to lock in their customers - the ATM deployers and the actual owners of Europe's ATMs. In particular the CIT industry has been known to try (often successfully) to dictate business terms to their banking clients. Is reducing the cost of cash a burning issue for such organisations that, after all sell their products and services for a profit to the ATM deployers? Or could this be another way to improve margins?

I can definitely see benefits to cassette standardisation, but any final decision on this in Europe needs to be taken by the ATM deployers and not by their suppliers. To read the EPC paper written on this topic by Leonor Machado, Chair of the EPC Cash Working Group, click here.

Europol busts international cross border skimming operation

2011-07-18T11:39:00.003+01:00

Europol has just had a resounding success in the fight against organised criminals conducting international card skimming operations. An operation code-named Operation Night Clone has resulted in 61 arrests in 5 countries - including 2 in the USA. It is estimated that the criminal group targeted caused losses of €50 million as a result of card skimming in the EU, with the majority of these losses occurring outside the EU. Both Europol and the European ATM Security Team (EAST) have been bringing focus onto the fact that as long as magnetic stripes remain on EU payment cards, these cards will remain vulnerable to skimming. Both organisations have also noted that an increasing number of skimming related losses from compromised EU cards are now occurring outside the EU, with a growing percentage being seen in the USA.

Operation Night Clone has taken out one of the most significant international criminal groups active in the field of card skimming. The criminal leaders were based in Bulgaria where 47 arrests were made. The European Commission (EC) has expressed satisfaction with the operation with the EU Commissioner for Home Affairs, Cecilia Malmstrom, saying that the EC is committed to exploring all possible opportunities to reverse the effects of the skimming problem. The European Central Bank has called on several occasions for magnetic stripes to be removed from EU payment cards.

There are calls in the USA, led by the US Federal Reserve bank of Atlanta, for the development of a well-thought-out, participatory, multi-year plan to move the country to the emerging global payments EMV card standard......calls that have been echoed in this blog.

At least the skimming issue is now moving up the Agendas of these important organisations, good news for card holders and for all those involved in the fight against such crime!

Reverse PIN Scam is back.......

2011-07-01T21:32:00.011+01:00

The other day I was sent an email by a friend who knows that I have something to do with ATM security. He felt that I needed to know about the message, and he was right..........I was able to let him know that the message is a hoax and to ignore it and not pass it on. The message in the scam email is below:

PIN advice - good information
ATM PIN Number Reversal - Good to Know!!
If you should ever be forced by a robber to withdraw money from an ATM
machine, you can notify the police by entering your PIN # in reverse.
For example, if your pin number is 1234, then you would put in 4321.
The ATM system recognizes that your PIN number is backwards from the
ATM card you placed in the machine. The machine will still give you
the money you requested, but unknown to the robber, the police will be
immediately dispatched to the location. All ATM’s carry this emergency
sequencer by law.

This information was recently broadcast on by Crime Stoppers however it
is seldom used because people just don't know about it.

Please pass this along to everyone.

This is the kind of information people don't mind receiving, so pass it
on to your family and friends

To the best of my knowledge this hoax email has been doing the rounds since 2006. I think that there might be one US State where reverse PIN is being considered, but I am not sure. If you see it best to break the chain and let others know that it is a hoax.
I recommended that my friend visit the Cardholder Security Tips page on the website of the European ATM Security Team (EAST) for more information on using an ATM securely.

EMV is working in Europe...EAST shares latest stats

2011-06-21T16:09:00.002+01:00

The European ATM Security Team (EAST) has just published an update for the month of June. It includes a chart which shows the impact of EMV on European ATM fraud migration.

Domestic issuer losses (losses committed inside national borders by criminals using stolen card details) have fallen by 63% from a high point of €62 million during the first six months of 2006, to a low of €23 million during the second six months of 2010. Even when all ATMs are fully EMV compliant in EU-SEPA countries, fraudulent withdrawals can still take place because of the usage of ’mag stripe only’ cards from non EMV card issuers, or because EMV card issuers authorize ‘mag stripe fall back’ transactions.

A big spike in international losses (losses committed outside national borders by criminals using stolen card details) occurred in 2007 when such losses increased by 201% from €93 million during the first six months of the year, to €280 million during the second six months. In such cases counterfeit EU payment cards are used to make cash withdrawals in countries where all or some of the ATMs are not yet EMV compliant. As long as 'mag stripes' are present on EMV cards, the cards are vulnerable to skimming. International losses during the second half of 2010 were down by 64% from the highpoint in 2007, with losses of €100 million reported.

In addition to the impact of the EMV roll out, this fall in international losses can be also be attributed to the effectiveness of anti-skimming devices, where they have been deployed, to improvements in the detection and monitoring of fraudulent transactions, and to regional card blocking for 'card present' transactions.

Many EU countries are now reporting that losses in the United States are making up the largest percentage of international losses, where there are no known plans to migrate to EMV. This is in line with the latest Organised Crime Threat Assessment published by Europol which states that around 80% of non-EU fraud against EU payment cards is committed in the United States.

Read the whole Update here or visit the EAST website to download the EAST ATM Fraud Analysis Report 2011 to which the Update refers.

Will US actions to counter card skimming be too little, too late?

2011-06-01T22:36:00.005+01:00

Cindy Merrit, Assistant Director of the Retail Payment Risks Forum of the of the Federal Reserve Bank of Atlanta in the US, has just published an article in the blog 'Portals and Rails' headed 'Stemming the rising tide of card breach incidents: PCI compliance or chip-and-pin? It is a well written blog and is part of an increasing amount of coverage being given to the topic of chip and PIN (EMV) in the US.

In 1942 Great Britain experienced its worst ever military disaster when Malaya and Singapore fell to the advancing Japanese army - not in 100 days as the Japansese had planned, but in just 70 days. The British High Command took a long time to face up to stark reality (the main defences in Singapore were all facing the wrong way anticipating an attack from the sea, not overland through Malaya), despite repeated calls to action from an experienced and aware minority of officers. One of that minority subsequently published a book entitled "Too little, too late!"

That is the heading that comes to my mind when reading inside views from the US on the growing problem of card skimming. It is quite clear that, despite the costs of shifting to chip and PIN, the US market will have to do it - yet there is still a great deal of prevarication and avoidance of reality. Cindy Merrit correctly points out - "The vulnerabilities inherent in mag-stripe technology are expected to contribute to ongoing skimming attacks in the future, not to mention the associated credit and debit card losses. Other countries, including Canada and many in Europe, that have converted to the EMV chip technology standard have effectively mitigated skimming."

I would use stronger language and state that the continuance of mag-stripe only cards in the US will definitley lead to an increase in skimming attacks as the rest of the world continues to roll out chip and PIN. If anyone can provide statistics for such attacks in the US it would be great to see the actual picture. It is not just Canada and many European countries that are moving to chip and PIN, it is all 31 countries in the Single Euro Payments Area, Canada, Australia, South Africa and many many others......... China UnionPay has stated that by 2015 all Chinese Payment Cards will be chip only. The bad guys know this which is why they are increasing their efforts in the US, secure in the knowledge that skimming techniques honed to perfection in other parts of the world will still generate revenue for them in the US long after Chip only cards have appeared in other markets.

Continuing to try to secure the magnetic stripe on payment cards will soon become yesterdays war for the payment card industry in much of the world, leaving the US to fight on virtually alone. As skimming related losses in the US continue to rise, and my assumption is that they will, too little too late could well be how history will judge the actions taken by those in the payment card industry in the US. Yes a coordinated move to EMV in the US will be challenging and expensive, but the cost of delaying the inevitable will continue to rise !

Eastern European fraudsters target US......despite penalties

2011-05-27T09:09:00.003+01:00

Have just seen two US press articles put out on the same day (26th May 2011) about Bulgarian fraudsters. As the United States is not moving to EMV (Chip and PIN) it will increasingly be seen as an attractive market for experienced card fraudsters, although I have not yet seen any incident and loss statistics to support this. The European ATM Security Team (EAST) recently reported that skimming losses due to ATM related fraud attacks fell nearly 50% from 2008 to 2010, down from €485 million to €268 million. This must mean that the bad guys are experiencing a big drop in their illicit takings in Europe - hence the attractiveness of the US and other markets where EMV is not being adopted.

It is interesting to note that penalties for such crimes in the US seem to be significantly higher than in Europe - in the US the bank fraud conspiracy charge carries a maximum penalty of 30 years in prison and $1 million fine. In Europe equivalent sentences can range from as little as a few months to just a few years. I talked about the penalties in China at the beginning of the year when a convicted fraudster got 10.5 years and a fine of 50,0000 Yuan ($71,429 approx). Despite the relative severity of penalties, the US market seems to be an increasingly powerful magnet for financial fraudsters...............time to introduce EMV?

You can find links to the two press articles below:
Hoover police arrest two Bulgarian natives linked to electronic skimming operation
Bulgarian pleads guilty to Nutley, Belleville bank fraud

65% of EAST Poll respondents always cover their PIN at an ATM

2011-05-26T07:28:00.003+01:00

“Do you protect your PIN at an ATM?” That was the question asked by EAST in its website research poll conducted from January to March 2011. The poll showed the following results:

Why should you cover your PIN? If the magnetic stripe on your card is compromised or skimmed, the criminals need your PIN to maximize fraudulent usage of it. You can watch seized criminal footage of PIN compromise on the EAST Website to see what the criminals see. If you cover your PIN you are at least protected against visual compromise.

Covering ones PIN at an ATM, or at any other terminal, should be second nature to everyone – after all very few people would hold their wallet or purse open to allow others to easily see how much money they are carrying, so why advertise your PIN?

It is encouraging to see that 65% of the poll respondents always cover their PIN at an ATM. If you are one of those who never covers their PIN, or who just does it occasionally, remember that doing this is the top cardholder security tip recommended by EAST, and by many other organisations.

Explosive gas attacks on the increase in Europe

2011-04-27T08:33:00.002+01:00

Explosive gas attacks are on the increase in Europe. According to the European ATM Security Team explosive and gas attacks rose by 88% in 2010, when compared to 2009, increasing from 148 reported incidents in 2009 to 278 in 2010.

It is not all plain sailing for the criminals though: In a recent attack reported in Croatia thieves detonated gas from a cylinder in order to rob an ATM machine in the small locality of Mihovljani in Zagorje (north of Zagreb). The thieves blew up the ATM machine late in the evening of Wednesday 20th April after it had been filled with cash. The ATM was located in a retail store which was demolished in the incident.

One typical methodology is for the criminals to feed a small tube through the cash dispense shutter of an ATM and fill it with gas. They then move back to a safe distance and ignite the gas; after the explosion they move around the area picking up the banknotes that often fly around like confetti.

It seems that the hard part for the criminals is working out exactly how much gas to use to blow open the door of the cash safe without totally destroying, the ATM, most of the surrounding building, and either destroying the money or blowing it over too wide an area to make effective recovery possible within the available time frame. Collateral damage in some of these reported attacks is huge, and there are risks to any people in the immediate vicinity. Some of the more sophisticated criminals appear to have worked out ways to regulate the amount of gas to use, but there do seem to be a large number of opportunistic criminals still experimenting with this technique.