EC3 helps to dismantle an international network of payment card fraudsters

Romanian and French law enforcement authorities, supported by the European Cybercrime Centre (EC3) at Europol, have successfully dismantled a Romanian organised crime group involved in international payment card skimming and associated fraud.

During a raid on 17 January 2014, 11 suspects were arrested as they planned to travel to Italy to commit skimming attacks. Among them was the leader of the criminal group as well as the financiers.

In addition, 26 premises were searched and illegal equipment seized. Police also dismantled two factories producing skimming devices, including sophisticated miniaturised versions. This activity followed an earlier week-long surveillance exercise carried out by French and Romanian law enforcement officers.

For more information read the related Press Release on the Europol website.

International Network of Latvian Payment Card Fraudsters Dismantled

The European Cybercrime Centre (EC3) at Europol, working with police in Latvia, Estonia, Poland, Bulgaria, Spain, Lithuania, Norway, Sweden and the United Kingdom, have taken down a criminal network of Latvian payment card fraudsters and arrested eight key members of the group.

The criminals were involved in compromising financial data during cash machine transactions across several EU and non-EU countries. The group posed a major threat for electronic payments by misusing European payment card data in remote destinations such as Mexico, the Dominican Republic, Thailand and the US.

EC3 provided operational and analytical support for the Operation, codenamed ' FatBoy', as well as coordinating the international investigations. Europol’s support also increased the efficiency of communication and cross-border analysis.

For more information read the related Press Release on the Europol website

Europol supports Geo-Blocking

Europol has just published a ‘Situation Report on Payment Card Fraud in the European Union’ to coincide with the launch of the European Cyber Crime Centre (EC3).  The report which covers 2012, highlights that although overall EU payment card fraud has fallen due to the introduction of EMV (Chip and PIN), whilst the number of payment cards (debit and credit) has risen to over 726 million, international losses (fraud losses outside the EU) continue to rise - and mainly in the USA.  The report states that European Organised Crime Groups (OCGs) are making around 1.5 billion euros annually from payment card fraud.

Global card fraud continues to rise

An article from Finextra says that a quarter of people have been hit by card fraud during the past five years, prompting many to ditch their provider - this is according to an ACI Worldwide-commissioned survey covering 17 countries around the world.

According to the Aite Group poll of 5223 people - around 300 for each country - Mexicans are the most likely to fall victim to fraudsters, with 44% hit in the last five years. America comes second (they have not yet adopted EMV or Chip and PIN) on 42%, followed by India on 37%. The UK ranks sixth on 34%, well above its European neighbours, Germany (13%) and the Netherlands and Sweden (both 12%).  Read the full story.

First ECB report on card fraud shows chips have increased the security of physical transactions

The European Central Bank (ECB) has published its first report on card fraud. The report was compiled by the Eurosystem, i.e. the ECB and the 17 national central banks of the euro area. Its main findings are that card fraud has been on a declining trend since 2007, and that technological advances have been key to increasing the security of transactions.  Nothing new there then, but it is good to get further evidence that EMV is working and that steps now need to be taken to prevent losses from payment fraud acquired outside the single euro payments area (SEPA).  SEPA comprises 32 countries and 458 million citizens in Europe.

Hacking attack leads to US$13 million in ATM losses....

Last week the blog 'KrebsOnSecurity' reported that U.S. based Fidelity National Information Services Inc. (FIS) had incurred a loss of of approximately US$13 million related to unauthorised activities involving one client and 22 prepaid cards.  While the attack took place in March, it has been largely unreported in the media and full details of the resultant investigation have not yet been released.

Apparently the balances on these prepaid cards aren’t stored on the cards themselves; rather the card numbers correspond to records in a central database, where the balances are recorded. Some prepaid cards cannot be used once their balance has been exhausted, but the prepaid cards used in this attack could be replenished by adding funds.  

Eastern European fraudsters target US......despite penalties

Have just seen two US press articles put out on the same day (26th May 2011) about Bulgarian fraudsters.  As the United States is not moving to EMV (Chip and PIN) it will increasingly be seen as an attractive market for experienced card fraudsters, although I have not yet seen any incident and loss statistics to support this.  The European ATM Security Team (EAST) recently reported that skimming losses due to ATM related fraud attacks fell nearly 50% from 2008 to 2010, down from €485 million to €268 million.  This must mean that the bad guys are experiencing a big drop in their illicit takings in Europe - hence the attractiveness of the US and other markets where EMV is not being adopted.

It is interesting to note that penalties for such crimes in the US seem to be significantly higher than in Europe - in the US the bank fraud conspiracy charge carries a maximum penalty of 30 years in prison and $1 million fine.  In Europe equivalent sentences can range from as little as a few months to just a few years.  I talked about the penalties in China at the beginning of the year when a convicted fraudster got 10.5 years and a fine of 50,0000 Yuan ($71,429 approx).  Despite the relative severity of penalties, the US market seems to be an increasingly powerful magnet for financial fraudsters...............time to introduce EMV?

You can find links to the two press articles below:
Hoover police arrest two Bulgarian natives linked to electronic skimming operation
Bulgarian pleads guilty to Nutley, Belleville bank fraud

From leader to laggard...the USA and the death of magnetic stripe card technology

For a long time now many of us in Europe have been aware that magnetic stripe card technology is becoming increasingly archaic in a world of smart cards (Chip and PIN or EMV) - yet it seems that those countries that have made a significant investment into this technology have had to grit their teeth and, for various reasons, continue to put up with magnetic stripes on their payment cards.  Belgium recently hit the headlines when the Belgian banks publicly stated that from 17 Jan 2011 Belgian Maestro cards can no longer be used outside of continental Europe.

There is a sense of frustration that just because the USA is not moving towards EMV, the world is being held back in this particular battle against fraudsters - magnetic stripes are relatively easily compromised and the data then used to create cloned or counterfeit cards. 

Cash trapping increases at ATMs in Europe.........

The European ATM Security Team (EAST) has just published its first Fraud Update for 2011.  This is based on country crime updates given by representatives of 15 countries in the Single Euro Payments Area (SEPA) and 2 non-SEPA countries at the 23rd EAST meeting held in Helsinki, Finland on 9th February 2011.

While ATM skimming incidents appear to be decreasing overall (although increases were reported by 7 countries), cash trapping incidents are on the rise across Europe with 8 countries reporting such attacks, compared with just 3 at the previous EAST meeting.  In some cases several ATMs were attacked simultaneously and the most common device used was the 'mouse trap'.

Fraud losses drop on UK cards, cheques and online banking

The UK Cards Association has just released figures that show that Card Fraud losses are at the lowest level since 2000 - a total of £365.4 million was lost in 2010, down from an all time high of £610 million in 2008.  The DCPCU (a special UK police unit funded by the Banks) reminds customers to keep on their guard......

£365.4 million is still an awful lot of money, but it is good to see the loss figure dropping.

With regard to losses at ATMs there was a 9% fall from £36.7 million reported in 2009, to £33.2 million in 2010.  This is a 46% fall from a highpoint of £62 million reported in 2006 as can be seen in the table below.

This table has been extracted from the press release put out by the UK Cards Association.  To get all the available information, including cheque and online banking fraud losses, you can see the press release on the website of the UK Cards Association.

Cash trapping at ATMs....1,738 attacks in 3 months

According to the BBC, City of London police have recently arrested two Romanian men at a flat in Harrow, London.  These guys were found in possession of six cash traps.  These simple devices are placed on an ATM to stop banknotes being dispensed to customers making genuine cash withdrawal transactions.  The money is trapped by the device until the criminals remove it.  Apparently 1,738 of these cash trapping incidents have been recorded in the past three months.

Also recovered at the flat were eight false machine fronts and eight pin hole cameras which capture PIN numbers.  Police Officers also found eight devices used to retain customers' cards and 150 phone top-up cards with PIN numbers written on them.

Seems like the flat was a dual purpose fraud factory, on the one hand making physical devices to capture banknotes and on the other making equipment to be used for Payment Card Fraud.

The full story can be found by following the link http://www.bbc.co.uk/news/uk-england-london-12655833

Ever wondered how skimming at an ATM works?

A lot is heard about card skimming at ATMs.  Most people have a vague understanding of what happens, and how the criminals involved cash out.  But do you really understand what they do, both to get your card data and your PIN, and also how they are subsequently used to create counterfeit cards for illegal cash withdrawals and other financial transactions?

If you can bear the Bond theme musical introduction, there is a video  produced by 'The Real Hustle' that explains quite well how the whole skimming thing works - from initial preparation of a skimming device to the final usage of the cloned cards.  It finishes with two bits of advice. 

1)  If you see anything that has been fixed to or sticking out from the card reader of an ATM, do not use the machine.

2) Always shield your PIN


Blog view:  Its fine to be suspicious of anything fixed to or sticking our from an ATM card reader throat, but bear in mind that such devices can also be genuine anti-skimming devices.  Best to be suspicious though.  Shielding your PIN, however should be routine.  While there are other ways to get your PIN (such as PIN pad overlays), covering your PIN does protect it from most visual compromise.  For more cardholder security tips and to see seized criminal video footage of PIN compromise, visit the website of the European ATM Security Team (EAST).

Global card fraud on the rise...but is it taken seriously?

According to Finextra, a survey carried out by Research Now for ACI Worldwide shows that nearly a third (29%) of the 4,200 people surveyed across 14 countries have been victims of card fraud in the last 5 years.  When comparing data with that from the 8 countries surveyed in 2009, this is a 60% increase. In the UK the numbers are even higher (33%) as I mentioned in a post last month ("One third of UK adults are victims of card fraud").

What is of interest to me is that according to the survey, 81% of the respondents have confidence in the ability of their bank of financial institution to protect them - despite the prevalence of card fraud.  That is a great statistic and reflects the time, energy, commitment, and funding put into battling such fraud by the private sector - as well as the focus and dedication of law enforcement agencies.  There is no argument that from this perspective it is taken seriously.

Yet it would be great if governments would play their part too, by better understanding that Financial Crime (and Payment Card Fraud in particular) is something that is of great concern to the vast majority of their people, and not just a problem for the industry.  In many countries the penalties for convictions for financial crime are weak, and therefore not a real deterrent to the criminals (often organised criminal gangs) that commit such offences.

If the pundits are right, and cash is (increasingly) no longer king, it's replacement is electronic payments, which means increased usage of payment cards.  That means that payment card fraud will continue to increase as a problem for both the industry and society - to counter this, perhaps punishments for convicted criminals should now be reviewed ........and where possible increased to levels commensurate with the seriousness of such crimes. 

As well as being distressing and inconvenient for cardholders and society, and expensive and time consuming for the industry and law enforcement, such crime also generates proceeds that can be used for the finance of global terrorism, and other sinister agendas.  Now is the time for governments to recognise this and for a tougher stand to be taken by legislators and the judiciary.

One third of UK adults are victims of card fraud..........

According to the annual Card Fraud Index released yesterday by life assistance company CPP, Card fraud has now affected a total of 13 million people in the UK during their lifetimes.

But there is some good news.  2010 saw a three per cent reduction in the number of card fraud incidences with seven per cent of people saying they had suffered from card fraud in the last 12 months compared to 10 per cent in 2009.  However, card fraud is still a problem and people need to remain vigilant and take responsibility when using their cards.

The Card Fraud Index also reveals the methods criminals are using, with most victims (20%) having the magnetic stripe on their card cloned at an ATM or via a payment terminal.  This is a three per cent increase on 2009. One in five victims have been defrauded online with criminals using the internet to obtain card details.

Alarmingly a third of card fraud victims (33 per cent) don't even know how they became a financial victim, with a third hearing directly from their bank (34 per cent) and six per cent being refused money at an ATM. A further six per cent found out when their card was refused at point of sale.  Victims of card fraud reported the average amount stolen was £417 with one in 20 (four per cent) reporting losses of more than £2,000.

According to Nick Jones at the CPP blog it seems that younger people are most at risk.  Card cloning or counterfeit fraud is the most dominant type of fraud.  The research shows that:

•    18-24 year olds tend to be the least security conscious overall only 37% checking their bank statements on a regular basis, verses 67% of people aged 65+,

•    This younger demographic are also more likely to not shield their PIN number at an ATM and check an ATM for tampering, but let others shop online with their cards and share their PIN details with other people.

Don't be a victim of card fraud!  Below are some card fraud prevention tips from CPP, and for more information on the above see http://www.cpp.co.uk/ or http://blog.cpp.co.uk/

Top tips from CPP to help avoid being a victim of card fraud

1) Don't carry multiple debit/credit cards in a wallet – only carry the essential cards you need
2) Don't leave belongings unattended while shopping
3) Don't carry debit/credit cards loose in a bag or pocket
4) If your cards are registered with a Card Protection company make sure you have their emergency loss reporting number
5) Don't ever write down your PIN number
6) Don't let a shop assistant take your debit/credit card out of sight – they could be copied or cloned
7) Don't let someone else take money out on your behalf
8) Check your receipts against your statements when you get home
9) If you are concerned your cards may have been lost or stolen, contact your bank immediately to get the card cancelled
10) Make sure your bank has up-to-date contact details for you, including your mobile phone number in case they need to check if transactions are genuine.

How much do you know about payment card fraud?

In this day and age most of us carry plastic payment cards (credit/debit) in our wallets.  These cards are attractive to criminals because stealing or copying them can lead to financial gain.  When using an ATM, as has already been mentioned in this blog, protecting your PIN is one of the key steps to protecting the integrity of your card, as is being aware of your personal space.  But what about a more holistic view of card protection?  What are the risks to your card when shopping in a retail store, by telephone, or online?

The Irish Payment Services Organisation (IPSO) has set up an informative website called 'SafeCard' (http://www.safecard.ie/) to raise awareness about the harmful effects of card fraud.  The site is aimed at providing advice to retailers (risk prevention), cardholders (top tips) and the media (facts and figures).

Cardholders can get advice and best practice information on the following topics:

• Lost & Stolen Cards – General Safety Guidelines
• Counterfeit and Skimmed Card Prevention
• Be Safe at the ATM
• Tips for shopping by mail, by phone or on the Internet
• Securing your card when shopping on the internet (with 3D Secure)
• Identity Theft – Tips to Keep Your Identity Safe from thieves
• Phishing – when you receive an email that looks like it has come from your bank
• 419 Fraud – when you receive an email claiming that you’ve won the lottery
• Keeping your cards safe when travelling abroad
• Problems using non-Chip & PIN cards
• Frequently Asked Questions

This website is an excellent reference point for all Cardholders and is well worth visiting and sharing - who do you know who carries payment cards in their wallet? - pass it on.......................................................