ATMs Hit by Cash TrappersInstitutions Victimized by Fraudsters' Low-Tech Ploy
According to the European ATM Security team, ATM fraud incidents jumped 69 percent during the first half of 2011, relative to the first six months of 2010. The primary fraud driver: a surge in ATM cash-trapping in 11 of the 23 European states EAST reviews.
Cash trapping is a relatively low-tech scheme. Just as it sounds, criminals manipulate an ATM's dispenser so that cash requested during a legitimate ATM withdrawal is blocked or trapped. Once the user gives up and leaves the ATM, the fraudsters come in and remove the cash. Regular inspections of ATMs, remote ATM monitoring and transactional reconciliation can alert financial institutions and other ATM deployers of cash-trapping schemes, but it's often difficult to catch, since fraudsters remove the cash and the trapping device or mechanism when they retrieve the cash.
ATM surveillance is often the best way to monitor what's happening at the ATM, but most institutions don't survey ATMs in real-time. McAfee consultant Robert Siciliano says fraudsters will continue to innovate and maneuver. Banks must learn to keep up. "Sometimes innovation means taking old schemes and breathing new life into them," he says. "Banks are often the last to innovate, especially when it comes to security."
ATM Fraud TrendsOverall, despite an uptick in cash trapping, financial losses associated with ATM fraud have continued to drop within the European Union. Losses associated with ATM-related attacks fell 28 percent from 2010 to 2011, a decrease EAST attributes to a significant reduction in ATM skimming. Losses associated with ATM skimming fell 22 percent, comparatively, from 143 million euro [U.S. $197 million] to 111 million euro [U.S. $153 million] during the first six months of 2011.
"While there has been a significant surge in cash-trapping activity, related losses were less than a half million euro [U.S. $689,500], or just 0.4 percent of total reported fraud related losses," says Lachlan Gunn, director of EAST. "While some cash-trapping losses may not have been reported, criminals are limited to actual customer withdrawal amounts for this form of attack."
The increase in cash trapping reflects the success European ATM deployers and card issuers have had in their battle against skimming, Gunn says. Skimming-related losses over the last seven years have continually decreased in Europe.
"Criminals may be shifting their focus, as cash trapping can succeed in the EMV or chip-and-PIN environment, although counter-measures are being rolled out," Gunn says.
The Non-EMV Market ChallengeEAST estimates that about 77 percent of financial losses associated with ATM skimming attacks result from incidents perpetrated in non-European markets, especially in the United States, where the Europay, MasterCard, Visa standard, better known as EMV, is not mandated.
"The risk of counterfeit EMV cards being used to withdraw cash fraudulently from ATMs in parts of the world that are not EMV-compliant remains high and is leading some European card issuers to implement additional security measures, such as regional card blocking," Gunn says.
Escalating card fraud linked to skimming is a known problem in the U.S. The takedown in Queens, N.Y., earlier this month of five organized crime rings with ties to Europe, Asia, Africa and the Middle East for their involvement in a more than $13 million skimming scheme proves the U.S. is attracting global attention for skimming vulnerabilities. [See Biggest ID Theft Bust in History.]
Unreported LossesAuthorities are calling the New York bust the biggest identity-theft takedown in U.S. history. But industry experts say it's likely a drop in the bucket, relative to skimming fraud that goes unnoticed and under-reported in the U.S.
Randy Vanderhoof, executive director of the Smart Card Alliance, which supports a U.S. migration to EMV, says many cases related to skimming go unprosecuted. "Because it is costly and time-consuming to catch and prosecute the criminals, because of the organized gangs' ability to easily capture U.S. bank card data, produce counterfeit cards and send people to stores to buy goods with them, law enforcement has to pick and choose which cases they want to investigate."
Even increases in different types of ATM fraud, such as the cash-trapping incidents now targeting ATMs in EMV-compliant countries, pale when compared with the escalating skimming trends the U.S. sees. "The numbers [about cash-trapping] are alarming, but it shows the increasing difficulty criminals face when attacking ATMs" in EMV markets, Vanderhoof says. "ATMs are getting cheaper and more ubiquitous, so hardening these machines with retrofits to prevent cash-trapping is a relatively small problem to fix."