ATM fraud losses continue to migrate away from EMV liability shift areas

The European ATM Security Team (EAST) has just published a second Fraud Update for 2012.   This states that:
 "The continued migration of fraud losses away from EMV Chip liability shift areas continues.  From January 2012 to June 2012 such losses were reported in 46 countries and territories outside of the Single Euro Payments Area (SEPA) and in 11 countries within SEPA.  The USA remains the top location for such losses, followed by Peru, Mexico and Brazil."  Next on the list are Thailand and the Dominican Republic.  What does this mean? 

The EMV (Chip and PIN) liability shift is a shift in liability for fraud losses from the card issuer to the card acquirer.  Once a country joins the liability shift, card acquirers become liable for fraud at their terminals, which means that EMV card issuers can charge back related losses to them.  Those acquirers who are slower to upgrade their terminals can get hit with substantial chargebacks during the transition. 

In Europe we saw a big spike in ATM related fraud losses in 2007 as criminals realised that EMV terminal upgrades were going to have a big impact on their ability to easily get cash from counterfeit cards.  According to EAST 99%+ of Europe's ATMs are now EMV compliant, up from just 52% in 2005. 

Initially there was a trend for criminal fraud spend to move away from Europe, to compensate for this.  Now what is being seen is a trend for criminal fraud spend to move away from Liability Shift countries outside of Europe.  Fairly recently countries such as Australia, Canada, Lebananon, Russia, Saudia Arabia and South Africa have joined.  If the big spike in losses in Europe in 2007 is anything to go by, countries that still have not adopted the liability shift, or that are in the process of adopting it, are likely to see a similar spike in losses as criminals capitalise on the remaining opportunities.

European EMV card issuers are further mitigating their risk by introducing geo-blocking.  According to EAST 6 countiers have now introduced some form of geo-blocking by which payment cards are blocked for usage outside of designated liability shift areas. The results continue to be extremely positive with significant falls in skimming incidents and skimming related losses reported.  Wonder when we will see centralised reporting of ATM related fraud losses from other regions, particularly the United States?  Since the spike in European losses in 2007, methods used by criminals have become even more sophisticated..............