ATM Skimming / Skimming / Data Compromise

ATM skimming was widespread in February, as were the number of court appearances and arrests of suspects. In the USA, a Romanian suspect pleaded guilty after being apprehended with an ATM skimming device and miniature spy camera. Due for sentencing in March, the suspect could face up to 32 years in prison. Also in the USA, three Bulgarian nationals were charged following 44 days of ATM skimming attacks with attributed losses exceeding $137,000.  In Canada, police discovered skimming equipment after stopping a vehicle linked to the theft of fuel (gas). During February, fuel-pump skimming was reported in the USA, motivating some fuel (gas) stations to change the locks on their fuel pumps. EFTPOS compromise was reported in Australia and elsewhere. In India, a Sri Lankan suspect was arrested for fraudulent spend using compromised cards and PINs. Pre-head tapping was suspected in the UK.  Also during February, ATM fraud was reported in Kenya.

Phishing / Vishing /Smsishing / Advanced Fee / Funds Transfer Fraud

During February, phishing, included variants on Tax Refund Fraud. Various regions reported tax refund scams, normally initiated by an e-mail which points to a fraudulent web site and subsequently invites the victim to provide their card and PIN details in order to receive a refund from the tax authorities. Magnetic card-writers imported from China were used in Nigeria to create cards after the card numbers and PINs were obtained by phishing. In India, a suspect accused of stealing cash during replenishment of ATMs was himself the victim of a Nigerian 419 (advanced fee) fraud. In Thailand, Iranian, Thai, and Taiwanese suspects were arrested for ATM  funds transfer fraud.

Transaction Reversal Fraud / Manipulation / Denomination Fraud

Transaction reversal fraud was detected in the UK and suspected elsewhere in Europe during February.

ATM Cheque (check) Fraud / Fake Cheque / False Deposit

In countries such as the USA, where it is common to allow access to funds deposited at an ATM prior to full clearing and validation, criminals exploit the system by using fake cheques. During February, some victims innocently helped the perpetrator - who claimed to not have a bank account - cash his cheque for a small fee. Unfortunately, after funds were passed to the perpetrator, the cheque did not clear.

Legislation / Law

The State Parliament, Queensland, Australia, passed amendments to the Criminal Code in February, making the possession of equipment used to obtain or deal with identification information a criminal offence.

Card Trapping / Card Theft / Distraction / Card Swapping

Throughout February, card trapping was prevalent in the UK. In one UK town, police were reported to be checking ATMs hourly for evidence of card traps such as Lebanese Loops and spy cameras. In Malaysia, distraction and shoulder surfing was used to steal cards and PINs often after a low-valued bank note was dropped to distract the victim while using an ATM.

Ram Raid Attacks / Theft of ATM / Smash-and-Grab

In Saudi Arabia, an alarm was activated and the theft of an ATM failed. February continued the trend of ram raid attacks, particularly in the UK and in the USA, causing significant damage to premises whether the theft was successful or not. In one US incident, the perpetrators ignored the warning sign declaring the ATM out-of-service and empty of cash.

Safe Cutting / Safe Breaking / Frontal Attacks / Theft from ATM

While power tools and other cutting equipment are the usual equipment of choice, a failed attempt with an axe was reported in February. An Austrian military patrol disrupted an attempted break-in to an ATM near the Hungarian border.

Explosive Attacks

South African police arrested four suspects believed to be linked to ATM bombing attacks. Two suspects in the USA were arrested with Improvised Explosive Devices (IEDs), which were believed to be intended to be used in an ATM attack. During February, ATM explosive attacks were reported in The Netherlands.

 Event in Focus

Combating ATM Fraud in Africa is an in-depth and highly advanced ATM Fraud and Security training course which will be held in Nairobi, Kenya, between March 15 and 18.  Facilitated by Douglas Russell, DFR Risk Management Ltd, and organized by PPTI Africa, the course is highly relevant to all stakeholders in the industry, including banks, independent ATM deployers, government regulators, law-enforcement agencies and ATM vendors.

.

The above digest is provided by DFR Risk Management, who provide consultancy services advising ATM and self-service terminal deployers and manufacturers, as well as law-enforcement agencies, on how to manage ATM and self-service terminal fraud and security threats.

Contact us: contact@dfrRiskManagement.com

www.dfrRiskManagement.com