EAST has published a European Payment Terminal Crime Written report covering 2021 which highlights a autumn in ATM jackpotting attacks.

ATM JackpottingATM malware and logical attacks confronting ATMs were down 74% (from 202 to 52). All the reported attacks were aimed at ATM jackpotting, either using black box attacks or malware. A black box assault is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to 'cash-out' or 'jackpot' the ATM. Related losses roughshod from €1.ii million to €0.7 1000000).

EAST Executive Director Lachlan Gunn said, "This fall in ATM malware and logical attacks is great news and reflects the hard work that has been put in by the industry and law enforcement to address the outcome. Well-nigh such attacks remain unsuccessful. A contempo tendency is a shift from logical black box attacks to malware attacks aimed at ATM jackpotting. When executed similar holes are made in the ATM fascia and and then it can be hard to piece of work out which type of assault took place. Our Expert Group on All Terminal Fraud (EGAF) is focussed on countering such attacks, with close cooperation between industry partners and police force enforcement. EGAF is working with Europol right now to update a document entitled 'Guidance & recommendations regarding logical attacks on ATMs', which has been a cardinal tool in the fight against such attacks."

Final related fraud attacks were down viii% (from vi,523 to 5,969 incidents). All fraud types were downwardly except for cash trapping at ATMs, which increased past 14% (from 1,829 to two,086 incidents). Total losses of €198 meg were reported, down 9% from the €218 million reported in 2020. Most losses remain international issuer losses due to menu skimming, which were €166 1000000.

ATM related physical attacks were up 6% (from three,722 to 3,947 incidents). Attacks due to ram raids and ATM burglary were downwards 40% (from 749 to 447 incidents). ATM explosive attacks (including explosive gas and solid explosive attacks) were downwardly 32% (from 923 to 629 incidents). Losses due to ATM related physical attacks were €ten million, a 55% decrease from the €22 one thousand thousand reported during 2020. 64% of these losses were due to explosive attacks, which were downwardly 56% from €fourteen.59 one thousand thousand to €half dozen.35 million.

A summary of the report statistics nether the main headings is in the tabular array beneath.

The full Crime Report is bachelor to EAST Members(National, Global and Associate)

The 25th Meeting of the EAST Expert Group on All Terminal Fraud (EGAF) took place on Wednesday 19th January 2022.  Due to the Covid-xix situation, it was conducted equally a virtual meeting and was chaired by Otto de Jong of ING Bank.

The meeting was attended by 28 fundamental representatives from Terminal Deployers, Terminal Vendors, Networks, Card Schemes, Security Equipment and Software Vendors, Police Enforcement and Forensic Analysts.

EAST EGAF, which meets 3 times a yr in advance of each of the meetings of EAST National and Global Members, enables in-depth and technical word to take place on Logical and Malware attacks, Card Data Compromise and other bug relating to terminal fraud.

A presentation on 'Jackpotting with Malware' was made by Diebold Nixdorf.

Experts from the following organisations also contributed to the meeting:  $.25 A/S, BKA, BVK, Cardtronics, Impairment Control, Dutch Payments Association, Europol, Gendarmerie Nationale (IRCGN), GMV, Group-IB, INTERPOL, KAL, LINK Scheme, Mastercard, MCMA, NatWest Group, NCR, PSA, Swedish National Anti-Fraud Centre, TietoEVRY, TMD Security, and TrendMicro.

EAST EGAF generates EAST Fraud Alerts for all EAST Members (National, Global and Associate). In full 264 Fraud Alerts accept been issued as can be seen in the table below.

EAST

E has published a European Payment Last Crime Report covering the get-go vi months of 2021 which shows a pregnant fall in ATM explosive attacks.

While overall ATM related physical attacks were up 2% (from one,829 to 1,873 incidents), mainly driven by a rise in vandalism, ATM explosive attacks (including explosive gas and solid explosive attacks) were down 52% (from 505 to 241 incidents).  Attacks due to ram raids and ATM burglary were down 42% (from 405 to 234 incidents).  Losses due to ATM related physical attacks were €4.9 million, a 61% decrease from the €12.vi million reported during the same period in 2020.  35% of these losses were due to explosive attacks, which were down 58% from €7.six million to €three.two million.

Eastward Executive Director Lachlan Gunn said, "The first 6 months of this twelvemonth have been influenced by the Covid-19 pandemic, although travel restrictions have eased across Europe. This meaning fall in explosive attacks at ATMs is welcome news for all of us, given the destructive nature of such attacks and the resultant risks to life and property. However, the prize remains an attractive option for criminals and the average cash loss per successful solid explosive attack is now estimated at €40,877. To address the issue our EGAP expert group has worked closely with Europol and other Police force Enforcement Agencies, and all parties remain vigilant to the threat."

ATM malware and logical attacks against ATMs were down 74% (from 129 to 33) and all just 1 of the reported attacks were Black Box attacks. A Black Box set on is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to 'cash-out' or 'jackpot' the ATM. Related losses were down 37% from €one.0 to €0.63 meg. Almost such attacks remain unsuccessful.

Terminal related fraud attacks were down 24% (from 3,631 to 2,775 incidents). Card skimming vicious to another all-fourth dimension depression (downwardly from 321 to 279 incidents) and transaction reversal fraud (TRF) at ATMs decreased by 100% (down from 108 to zero incidents). Total losses of €102 million were reported, down 6% from the €109 million reported during the same period in 2020. Most losses remain international issuer losses due to bill of fare skimming, which were €86 one thousand thousand.

A summary of the report statistics under the main headings is in the table below.

The full Offense Written report is bachelor to E Members(National, Global and Acquaintance)

The 23rd Coming together of the EAST Proficient Group on All Terminal Fraud (EGAF) took place on Midweek 12th May 2021.  Due to the Covid-19 situation, information technology was conducted as a virtual coming together and was chaired by Otto de Jong of ING Banking company.

The meeting was attended by 28 key representatives from Last Deployers, Last Vendors, Networks, Card Schemes, Security Equipment and Software Vendors, Police Enforcement and Forensic Analysts.

Eastward EGAF, which meets iii times a year in advance of each of the meetings of Due east National and Global Members, enables in-depth and technical word to have place on Logical and Malware attacks, Menu Information Compromise and other issues relating to final fraud.

Presentations were made by Europol, INTERPOL, Swedish Police, Harm Control Mexico, and Diebold Nixdorf.

Experts from the post-obit organisations too contributed to the coming together:  Bits A/S, BVK, Cennox, GMV, Mastercard, NatWest Group, NCR, PSA, KAL, Santander Banking concern, TietoEVRY, TMD Security, and TrendMicro.

The coming together approved a list of recommended Countermeasures against ATM Malware and Black Box attacks, which volition be shown, as applicable, in hereafter E Fraud Alerts.

E EGAF generates East Fraud Alerts for all EAST Members (National, Global and Associate). In total 260 EAST Fraud Alerts have been issued equally tin can be seen in the table beneath.

East Development Director Rui Carvalho presented at the ATEFI Security Committee on 30th April 2021, a virtual effect.  The impact of the Covid-19 pandemic has made it more than important than always for the sharing of threat intelligence to strengthen security strategies in Electronic Payments.  The event focussed on both physical and cyber security.  Rui shared key information and statistics from the latest EAST Payment Terminal Criminal offence Report, equally well every bit insights from the ninth Meeting of the EAST Payments Task Strength (EPTF) held on 14th April 2021.  He covered:

  • ATM Malware & Logical Attacks
  • Terminal Related Fraud
  • ATM Physical Attacks
  • Payment Fraud (social engineering science, ransomware, e-skimming)

The consequence was attended by public officials, law enforcement agencies, regulatory entities, representatives of international organisations, Managers and Network Security Officials, ATEFI Members from the entire LATAM region and Kingdom of spain, as well as bank officials, representatives of the Latin American Bank Associations, Credit and Debit Card executives, and specialised media.

ATEFI is the Latin American Association of Operators Electronic Funds Transfer and Information Services and represents 20 ATM networks in xiv countries throughout Latin America.

In May 2016 Eastward and ATEFI joined forces in lodge to further strengthen cantankerous edge cooperation in combating all types of payment crime including payment carte fraud, hello-tech crime and ATM cyber and physical attacks.

The 22nd Meeting of the EAST Expert Group on All Terminal Fraud (EGAF) took place on Wednesday 20th Jan 2021.  Due to the Covid-19 situation, it was conducted as a virtual meeting and was chaired by Otto de Jong of ING Bank.

The meeting was attended by 29 fundamental representatives from Concluding Deployers, Last Vendors, Networks, Card Schemes, Security Equipment and Software Vendors, Law Enforcement and Forensic Analysts.

EAST EGAF, which meets 3 times a yr in advance of each of the meetings of EAST National and Global Members, enables in-depth and technical discussion to accept identify on Logical and Malware attacks, Card Data Compromise and other issues relating to concluding fraud.

Presentations were made by Europol, INTERPOL, BKA, Diebold Nixdorf, Fiducia & GAD, and the MCMA.

Experts from the following organisations besides contributed to the meeting:  AXEPTA – BNP Paribas, $.25 A/Southward, BVK, Cardtronics, Cennox,  Impairment Control, Dutch Payments Association, Group-IB, GMV, Mastercard, NatWest Group, NCR, PSA, KAL, TietoEVRY, TMD Security, and TrendMicro.

In addition E EGAF generates EAST Fraud Alerts for all East Members (National, Global and Associate). In total 256 EAST Fraud Alerts have been issued as can be seen in the tabular array beneath.

The 21st Meeting of the Due east Expert Group on All Concluding Fraud (EGAF) took identify on Midweek 16th September 2020.  Due to the Covid-xix situation, it was conducted equally a virtual meeting and was chaired by Otto de Jong of ING Bank.

The meeting was attended by 28 key representatives from Terminal Deployers, Terminal Vendors, Networks, Card Schemes, Security Equipment and Software Vendors, Law Enforcement and Forensic Analysts.

Eastward EGAF, which meets three times a year in advance of each of the meetings of East National Members, enables in-depth and technical discussion to take identify on Logical and Malware attacks, Card Skimming, Card Trapping, Cash Trapping and Transaction Reversal Fraud (TRF).

Presentations were made by Europol, INTERPOL, Impairment Control, Diebold Nixdorf, Group-IB, KAL, Mastercard and NCR.

Experts from the following organisations likewise contributed to the coming together:  Bits A/Due south, Cardtronics, Cennox,  Dutch Payments Association, Fiducia & GAD, GMV, NatWest Grouping, TietoEVRY, TMD Security, TrendMicro.

An increasing number of TRF incidents are being reported and, to help mitigate the gamble, EAST EGAF has produced a general Security Alarm well-nigh the threat, which was ratified by the meeting.

In improver Eastward EGAF generates EAST Fraud Alerts for all EAST Members (National, Global and Acquaintance). In full 247 EAST Fraud Alerts accept been issued, 22 to date in 2020. Since 2013 there have been 15 Fraud Alerts issued relating to TRF.

According to French prosecutors an international network engaged in ATM jackpotting has been cleaved up by police (Source: AFP/SecurityWeek).

In a statement on Friday xv May Paris prosecutor Remy Heitz said that two suspects (aged 26 and 31) and already known to the authorities, have been charged and placed in detention.  He said that, betwixt May ten-12, several individuals from the "Russian-speaking community" suspected of belonging to an "international jackpotting organisation" were detained in Colombes outside Paris, Laval in western France and the southern city of Nice, while trying to damage an ATM.  The criminal group worked across Europe to insert malware into ATMs, attacking the machines at night. "A hacker, operating from abroad, would take command of the cash dispensing software," the argument said.

Nineteen incidents beyond France have already come to low-cal, with the fiscal damage estimated at €280,000.

"We have a new wave of 'jackpotting' in France," Francois-Xavier Masson, head of France's agency for combating crimes in data and communication technologies (OCLCTIC), told AFP, adding that more than 60 incidents have been identified since the end of 2019. "There was a previous wave in 2018 and then it came to a halt, before resuming at the end of 2019. The way the groups act is changing, the teams are more international. Just nosotros are besides changing how we act", he added.

ATM jackpotting has become a recognised trouble across the world in contempo years.  This is done by either using malware, or by using an unauthorised device (known as a black box), to 'jackpot' or 'cash-out' an ATM. Typically all the cash in the machine is illegally ejected in such attacks, and collected past the criminals at the scene.  The E Expert Group on All Terminal Fraud (EGAF) focuses on the prevention of malware and black box attacks and, since 2016, has produced 48 malware and blackness box related Fraud Alerts from 24 countries, which are available to EAST Members.

EAST EGAF has also produced standard definitions for both methods, which can exist seen in the below images (for a full listing of all Final Fraud Definitions and related criminal benefits encounter the Terminal Fraud Definitions page on this website).

terminal fraudEastward has but published a European Payment Terminal Crime Report covering 2019 which reports that final fraud attacks were up 35%.

Terminal related fraud attacks rose from 13,511 to eighteen,217 incidents, mainly driven by an 87% increase in ATM transaction reversal fraud attacks (upwards from four,843 to 9,054 incidents), while card skimming incidents roughshod 21% to an all-time depression (downwardly from 1,883 to i,496 incidents).

EAST Executive Director Lachlan Gunn said, "Despite the overall rise in final fraud incidents, total reported losses were almost unchanged. Transaction reversal fraud losses did rise from €2.half dozen 1000000 to €v.ii million, but the continued driblet in skimming incidents has helped to proceed the overall loss position stable."

Full losses of €249 million were reported, upwards i% from the €247 million reported in 2018. Overall losses due to carte skimming were unchanged and losses due to card trapping were down by 14% (from €two.9 one thousand thousand to €2.v meg).

ATM related physical attacks were up 0.5% (from four,579 to 4,571 incidents). Attacks due to ram raids and ATM break-in were downwards 11% (from 1,256 to i,122 incidents) and ATM explosive attacks (including explosive gas and solid explosive attacks) were downward 7% (from 1,052 to 977 incidents). Losses due to ATM related concrete attacks were €22 million, a 39% subtract from the €36 million reported in 2018.

The average greenbacks loss for a robbery is estimated at €20,369 per incident, the average cash loss per explosive or gas assail is €10,735 and the boilerplate greenbacks loss for a ram raid or burglary set on is €ix,377. These figures practice not have into account collateral damage to equipment or buildings, which can exist significant and ofttimes exceeds the value of the cash lost in successful attacks.

A total of 140 ATM malware and logical attacks were reported, down from 157 in 2018, an 11% decrease. All the reported attacks were 'cash out' or 'jackpotting' attacks. In 118 attacks equipment typically referred to as a 'black box' was used, and malware was used in the other 22 attacks. Related losses were up 142%, from €0.45 million to €ane.09 1000000.

A summary of the report statistics under the chief headings is in the table below.

The full Criminal offence Report is available to EAST Members (National, Global and Associate)

EAST has just published its kickoff European Fraud Update for 2020. This is based on country crime updates given past representatives of eighteen countries in the Single Euro Payments Area (SEPA), and 2 not-SEPA countries, at the 50th Due east meeting held in Vienna on 12th Feb 2020.

Payment fraud issues were reported by 18 countries. Vii countries reported CNP fraud occurring worldwide. One reported that the card data is either bought in bulk or obtained via card testing/BIN attacks. The attackers use scripts/bots (non real people) to conduct the fraud. Four countries reported BIN attacks. I reported that they are originating from the Middle East for the first time and another reported them in relation to both CP and CNP fraud, with losses reported in the United states of america, the U.k. and Brazil. 2 countries reported Account Takeover Fraud, one of them in connection with SIM swapping.

Half-dozen countries reported phishing. One reported the use of faux emails past criminals to impersonate banking company customers, claiming that their bank account details have changed. Some other reported that online banking was targeted, and a third country reported phishing using social networks, with related fraud occurring in China. Three countries reported SMS phishing (Smishing). One of them reported this related to token validation transactions – the IP addresses are in Morocco and the fraud occurs in an Eu country with losses via Western Union.

To date in 2020 the East Payments Task Force (EPTF) has published 1 related Payment Alert.

ATM malware and logical attacks were reported by twelve countries – one reported successful ATM malware attacks where 'Cutlet Maker' was used, and 10 reported the usage (or attempted usage) of 'blackness-box' devices to allow the unauthorised dispensing of greenbacks. To appointment in 2020 the Eastward Expert Group on All Terminal Fraud (EGAF) has published one related Fraud Warning.

Card skimming at ATMs was reported by ten countries, and the downward trend continues. Six countries reported the usage of 'M3 – Card Reader Internal Skimming devices', and the usage of 'M1 – Overlay Skimming Devices' and 'M2 – Throat Inlay Skimming Devices' was also reported. Skimming attacks on other final types were reported past eight countries. Four reported attacks on unattended payment terminals (UPTs) at petrol stations, and three reported attacks at railway ticket machines. To date in 2020 EAST EGAF has published four related Fraud Alerts.

Yr to appointment International skimming related losses were reported in 14 countries and territories outside SEPA and in 4 within SEPA. The top three locations where such losses were reported remain Indonesia, India and the United states of america.

Five countries reported card trapping attacks, i of them reporting a new method that allows several cards to be captured in ane set on. Three countries reported transaction reversal fraud (TRF) incidents. To date in 2020 Due east EGAF has published two related Fraud Alerts.

Ram raids and ATM burglary were reported by eleven countries and 11 countries reported explosive gas attacks, one of which resulted in a fatality. Eight countries reported solid explosive attacks. The usage of Triacetone Triperoxide (TATP) for solid explosive attacks continues to increase across Europe. Mixing TAPT is a complicated procedure that requires good noesis of the chemicals, every bit there is a danger of setting off an unexpected explosion. The spread of such attacks is of not bad business to the industry due to the adventure to life and to the significant amount of collateral damage to equipment and buildings.
To date in 2020 the EAST Expert Group on ATM & ATS Physical Attacks (EGAP) has published ii related Physical Assault Alerts.

The full European Fraud Update is available to E Members (National, Global and Associate).