ATM Physical Attacks rise in Europe
The European Association for Secure Transactions (EAST) has just published a European Payment Terminal Crime Report covering 2023 which highlights a rise in ATM related Physical Attacks.
ATM related physical attacks were up 24% (from 3,728 to 4,637 incidents). Within this total, ATM Theft (Rip- out)/ATM Burglary (In-situ) attacks were up 5% (from 484 to 506 incidents) and Explosive Attacks were down 2% (from 727 to 714 incidents). Losses due to ATM related physical attacks were €9 million, an 18% decrease from the €11 million reported during 2022. 61% of these losses were due to Explosive Attacks, which were down 19% from €6.6 million to €5.36 million.
EAST Executive Director Lachlan Gunn said, “This rise in ATM Physical Attacks is mainly driven by an increase in Non-Specific Attacks, primarily vandalism. Vandalism attacks are often evidence of criminal research and development for other attack types. It is good to see a slight drop in Explosive Attacks, although they remain of great concern to the industry. While extensive measures have already been taken to mitigate the risk of such attacks, each attack creates significant collateral damage to equipment and buildings and can pose a threat to life. Our EAST Expert Group on ATM and ATS Physical Attacks (EGAP), a public-private sector platform, is helping to share information and intelligence to counter this threat”.
ATM malware and logical attacks were down 77% (from 31 to 7) and all the reported attacks were black box attacks. A black box attack is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to ‘cash-out’ or ‘jackpot’ the ATM. Most such attacks remain unsuccessful, and total losses of just €66,847 were reported.
Terminal related fraud attacks were down 30% (from 10,141 to 7,115 incidents). This decrease was primarily due to a fall in cash trapping at ATMs. These attacks decreased by 33% (from 7,166 to 4,795 incidents). Relay Attacks continued to occur with 63 cases reported during the year, down by 87% from the 502 such attacks reported in 2022. The successful attacks resulted in cash out at ATMs. Total losses of €173 million were reported, down 14% from the €200 million reported in 2022. Most losses remain international issuer losses due to card skimming, which were €146 million.