US charges cyber-crooks over US$45 million ATM crime

US officials have charged 8 people with taking part in two cyber-attacks that resulted in US$45 million of fraudulent cash withdrawals from ATMs in 27 countries.  According to the US Justice Department, the gang broke into the computers of two credit card processors, one in India in December 2012 and the other in the United States this February. They hacked data relating to pre-paid cards and then raised the balance limits, before sending the data to cells around the world that cloned the cards and used them fraudulently (with PINs) to withdraw cash from ATMs.

At last there is finally an ATM EMV liability shift in the USA!

The MasterCard EMV liability shift for Maestro debit cards at US ATMs is good news for the rest of the world, where card issuers have long had to put up with huge counterfeit fraud losses in the USA.  According to Europol around 80% of non-EU fraud against EU payment cards is committed in the US.  Criminals like cash, and ATMs that are not EMV compliant (i.e. perform transactions on magnetic stripes, rather than Chips) allow cash withdrawals on counterfeit EMV cards. 

U.S. based ATMs will have to take EMV cards by 19 April 2013

In my blog last month The U.S. moves towards EMV! Visa announces plans.... I finished with the question " I wonder when we will see a similar announcement from other card schemes?"  Now MasterCard has entered the arena.  According to an article in the Credit Union Times, MasterCard Worldwide spokesperson Seth Eisen has said that "U.S.-based ATMs will have to take EMV cards as of April 19, 2013."  It is stated that he offered additional clarification in an email:

“On September 1, MasterCard announced it will extend its existing EMV liability shift program for inter-regional Maestro ATM transactions, as part of an effort to align technology efforts to prevent and manage fraud.............The liability shift will cover both the United States and Asia-Pacific regions and will be effective on April 19, 2013, with the exception of Australia and New Zealand, where the liability shift will become effective on December 31, 2015. South Asia (Bangladesh, Bhutan, India, Maldives, Nepal and Sri Lanka) will continue to be excluded from the inter-regional ATM EMV liability shift program. It should be noted that liability shift already applies for Europe, Canada and the Middle East and Africa and will be completed for Latin America by end of October 2012.”

The U.S. moves towards EMV! Visa announces plans....

Visa has just announced its plans to accelerate chip migration and adoption of mobile payments. This is great news as there is now a roadmap for (partial) EMV implementation in the U.S.  Visa will bring in a U.S. liability shift for domestic and cross-border counterfeit card-present POS transactions, with effect from 1st October 2015.  Merchants selling fuel will have an additional two years, until 1st October 2017.  Unfortunately there is no mention of ATMs - the preferred channel for fraudsters to obtain cash!

I have commented in the past about the fact that the U.S. is lagging behind the rest of the world due its reluctance to adopt EMV or Chip and PIN technology.  The gap that is opening up as a result can be separated into two main parts: 

Europol busts international cross border skimming operation

Europol has just had a resounding success in the fight against organised criminals conducting international card skimming operations.  An operation code-named Operation Night Clone has resulted in 61 arrests in 5 countries - including 2 in the USA.  It is estimated that the criminal group targeted caused losses of €50 million as a result of card skimming in the EU, with the majority of these losses occurring outside the EU.  Both Europol and the European ATM Security Team (EAST) have been bringing focus onto the fact that as long as magnetic stripes remain on EU payment cards, these cards will remain vulnerable to skimming.  Both organisations have also noted that an increasing number of skimming related losses from compromised EU cards are now occurring outside the EU, with a growing percentage being seen in the USA.

Will US actions to counter card skimming be too little, too late?

Cindy Merrit, Assistant Director of the Retail Payment Risks Forum of the of the Federal Reserve Bank of Atlanta in the US, has just published an article in the blog 'Portals and Rails' headed 'Stemming the rising tide of card breach incidents: PCI compliance or chip-and-pin?  It is a well written blog and is part of an increasing amount of coverage being given to the topic of chip and PIN (EMV) in the US. 

Eastern European fraudsters target US......despite penalties

Have just seen two US press articles put out on the same day (26th May 2011) about Bulgarian fraudsters.  As the United States is not moving to EMV (Chip and PIN) it will increasingly be seen as an attractive market for experienced card fraudsters, although I have not yet seen any incident and loss statistics to support this.  The European ATM Security Team (EAST) recently reported that skimming losses due to ATM related fraud attacks fell nearly 50% from 2008 to 2010, down from €485 million to €268 million.  This must mean that the bad guys are experiencing a big drop in their illicit takings in Europe - hence the attractiveness of the US and other markets where EMV is not being adopted.

It is interesting to note that penalties for such crimes in the US seem to be significantly higher than in Europe - in the US the bank fraud conspiracy charge carries a maximum penalty of 30 years in prison and $1 million fine.  In Europe equivalent sentences can range from as little as a few months to just a few years.  I talked about the penalties in China at the beginning of the year when a convicted fraudster got 10.5 years and a fine of 50,0000 Yuan ($71,429 approx).  Despite the relative severity of penalties, the US market seems to be an increasingly powerful magnet for financial fraudsters...............time to introduce EMV?

You can find links to the two press articles below:
Hoover police arrest two Bulgarian natives linked to electronic skimming operation
Bulgarian pleads guilty to Nutley, Belleville bank fraud

EMV, a view from America.....

A lot is heard about EMV from those countries that are embracing it, but what about the view from the US?  The European Payments Council have today published their latest news letter.  In it there is a very good article entitled  “The Magnetic Stripe: Why it is Hard for Americans to Say Good-Bye  - In the US, clinging to old-fashioned payment methods is more than just a bad habit”. 

Some key points from the article, which is written by Bob Sullivan, are below:

• US banks generally perceive fraud losses to be less than the cost of upgrading the card infrastructure to comply with EMV standards. Until those lines cross, there are no incentives for the US financial system to engage in such a dramatic change.
• It might however be worth the while to do the maths again. Some US card industry observers recently indicated that losses due to fraudulent card transactions in the US might already exceed the costs of EMV migration.
• It should not be expected that the US government will enforce migration to EMV.
• US consumers are satisfied with the fraud fighting measures other than chip and personal identification number (PIN) technology, which are currently in place. In their view, having to enter a PIN when making a card payment creates a ‘solution in search of a problem’.
• More could be done however to enlist consumers as fraud-fighters and to convince them of the added value of chip and PIN technology. US travellers whose magnetic stripe cards are increasingly refused as a means of payment in Europe, could be the first to ask for change.
• It will take a combination of consumer education, ease of use, cost-saving technological advancements, clearer fraud accountability and government enticements to break down the Americans’ loyalty to the magnetic stripe card

You can read the whole article on the EPC website

Two major US Banks to trial EMV cards....

I have been going on for some time about the need for the USA to take some concrete steps towards the implementation of the EMV standard - as it falls further and further behind the rest of the world.  So it was with interest that I read an article published by the Mail Online a couple of days ago.  It seems that two of the largest U.S. banks, JP Morgan Chase and Wells Fargo will start to trial EMV cards.  The trial will be available to larger business customers and frequent travellers. 

One driver for such change is of course fraud, in particular card skimming, and the US market is likely to become a honeypot for skimming fraudsters as they move there to practise techniques honed in other parts of the world during the shift towards the EMV.  As recently reported by the European ATM Security Team (EAST), losses due to card skimming at ATMs in Europe have fallen for the sixth sucessive six month reporting period, and an  increasing proportion of such losses are now international, i.e. occuring outside the card issuer's country.  It would be interesting to see similar statistics for the USA.

The other driver for change to EMV is of course that the holders of stripe only cards are increasingly unable to use their cards for transactions at Chip only terminals.  The article in the Mail Online quotes a study that has quantified the impact of such lost transactions - according to financial advisory firm Aite Group a 2009 study found that issues with U.S. cards not being accepted abroad cost $4 billion in missed transactions in 2008.  Since then there has been significant further roll out of EMV globally and so I'm guessing that the equivalent figure for 2010 will have been a lot larger.  And then of course there is the matter of reputational risk as disgruntled card holders realise that their bank is issuing them with cards that are not fit for purpose in all markets.

Two of the largest U.S. banks have announced that are to start EMV card pilots, I wonder how long it will take others to follow?

Need more information?  Read the full article on the Mail Online