US charges cyber-crooks over US$45 million ATM crime

US officials have charged 8 people with taking part in two cyber-attacks that resulted in US$45 million of fraudulent cash withdrawals from ATMs in 27 countries.  According to the US Justice Department, the gang broke into the computers of two credit card processors, one in India in December 2012 and the other in the United States this February. They hacked data relating to pre-paid cards and then raised the balance limits, before sending the data to cells around the world that cloned the cards and used them fraudulently (with PINs) to withdraw cash from ATMs.

The European ATM Security Team creates new membership category

The European ATM Security Team (EAST) has created a new Associate Membership category.  Banks and other approved ATM stakeholders from any country can now apply to join EAST through this category.  For more information visit the Associate Membership page on the EAST website.  According to the related EAST press release:

"In 2011 EAST embarked on a long term strategic planning process designed to take the Group to the next stage of its development. Up to now the focus has been on strengthening our national membership. As many of the threats we are facing are global, and with European ATM related fraud losses now increasingly seen outside of Europe, EAST decided to open the new Associate Membership category globally. It is hoped that this will help to further improve flows of information into and out from the Group. In 2013 EAST is planning to hold its first annual conference, with an Agenda set by our national members.”

 

 

 

 

Regional card blocking (geo-blocking) - the basic facts

In several posts I have touched on regional card blocking, often known as geo-blocking.  What is it? Why is it done? How is it done? Where is it done? Does it work? In this post I will try to briefly answer these questions.

What is Geo-blocking?
Many European card-issuers have spent a lot of money issuing EMV (Chip and PIN) compliant cards. When a card present payment transaction takes place the terminal reads the EMV chip on the card, while it is authenticated by the cardholder's PIN (either online or offline).  Geo-blocking is when an EMV card issuer blocks its cards from being used in certain countries or regions where magnetic stripe transactions are routinely performed.  All EMV cards are blocked unless they are 'white-listed' (i.e. the card holder intends to travel to a high risk country/region).

EMV is working in Europe...EAST shares latest stats

The European ATM Security Team (EAST) has just published an update for the month of June.  It includes a chart which shows the impact of EMV on European ATM fraud migration.

Domestic issuer losses (losses committed inside national borders by criminals using stolen card details) have fallen by 63% from a high point of €62 million during the first six months of 2006, to a low of €23 million during the second six months of 2010.   Even when all ATMs are fully EMV compliant in EU-SEPA countries, fraudulent withdrawals can still take place because of the usage of  ’mag stripe only’ cards from non EMV card issuers, or because EMV card issuers authorize ‘mag stripe fall back’ transactions.

A big spike in international losses (losses committed outside national borders by criminals using stolen card details) occurred in 2007 when such losses increased by 201% from €93 million during the first six months of the year, to €280 million during the second six months.  In such cases counterfeit EU payment cards are used to make cash withdrawals in countries where all or some of the ATMs are not yet EMV compliant.  As long as 'mag stripes' are present on EMV cards, the cards are vulnerable to skimming.  International losses during the second half of 2010 were down by 64% from the highpoint in 2007, with losses of €100 million reported.