| Written by Douglas Russell, DFR Risk Management |
| Card Trapping / Card Theft / Distraction / Card Swapping Lebanese Loops and other card trapping devices were reported in November, particularly in the UK. Distraction techniques also continued to be reported globally. Iincidents often included teams of two perpetrators with one pointing to a low-value bank note (£5 in UK incidents) on the ground and indicating to the victim that they had dropped it, the second perpetrator removing the card from the ATM while the victim was distracted,the PIN observed previously while being entered. In The Philippines, a P500 note was typically used and the card was swapped, as opposed to simply being stolen. ATM Skimming / Skimming / Data Compromise ATM skimming continued to be significant globally in November. Police in Nigeria arrested a group who claimed they purchased the skimming equipment from Malaysia. One of the suspects apparently boasted that their crime was intellectually superior to using firearms and merely robbing victims. Some of the more sophisticated skimming devices recovered in November included those which incorporated Bluetooth transmitters. An apparent payment terminal compromise at a car park in New Zealand was reported in November with an indication that there were around 100,000 potential victims - cards were blocked and re-issued in many cases following the discovery. Other incidents of significant card re-issuing included activity by Lebanese banks in November. Co-operation between law-enforcement organizations in the US and Europe included raids executed by Romanian police and the seizure of equipment used in card fraud and, in particular, ATM skimming. Charges in the USA were made against suspects in last year's sophisticated data compromise at the major US processing centre, RBS WorldPay. Transaction Reversal Fraud / Manipulation / Denomination Fraud / LTL Transaction Reversal Fraud (TRF) was detected in the UK during November. Various incidents of denomination fraud were detected globally, including one in which the perpetrator forgot to reset the value of currency in the ATM and honest consumers reported they were being charged only £1 for every £10 dispensed. Leaving Transaction Live (LTL) fraud was reported in India during November - the suspect targeted those who seemed unsure on how to use an ATM and tricked them into leaving the ATM while the transaction was still live and uncompleted. Vishing / Phishing / Smsishing / Advanced Fee / Funds Transfer Fraud Many incidents of Phishing related crime persisted during November. While vishing attacks continued, one potential victim in the USA decided, wisely, not to follow instructions to go to an ATM in the middle of the night, hanging up the phone instead. Cheque Fraud (Check Fraud) / Fake Deposit A teenager in IL (USA) was accused in November of opening accounts with false names, depositing cheques knowing they would not be honoured, and withdrawing funds via an ATM before the cheques could be fully cleared. Ram Raid Attacks / Theft of ATM / Smash-and-Grab Ram raid attacks were reported in many countries throughout November. A significant number failed for various reasons which included chains breaking, parts of the vehicle coming loose, and a general failure to overcome strong anchoring. Police in Eire and Northern Ireland increased co-operation following a number of attacks on both sides of the border. ATM thefts that succeeded included incidents where the ATM was removed manually, with little more effort than the use of a crowbar. Safe Cutting / Safe Breaking / Frontal Attacks / Theft from ATM Cutting tools were used to both open ATM security enclosures and facilitate the theft of complete ATMs in November. In India, an estimated Rs2.8 million was stolen after the ATM was cut from its anchoring using a blowtorch. In The Netherlands, British suspects were killed when their vehicle crashed. They were suspects in a cutting attack. In the UK,13 gang members were sentenced to a total of 78 years imprisonment following a large number of attacks which included the use of oxyacetylene cutting equipment. Explosive Attacks Explosive attacks were reported in The Netherlands, South Africa, Thailand and Australia in November. In Australia, arrests included that of a 15-year-old youth, along with a 43 year old man, accused of using explosive devices to attack ATMs. Legislation / Law New laws to be introduced in Queensland, Australia, will strengthen existing legislation that makes it an offence to skim card data and will criminalize the possession of various devices for the purpose of obtaining or dealing with identification information. In Canada, a successful prosecution against the owners and operators of a company supplying equipment that could be used to compromise cards was brought under criminal organization legislation. The above digest is provided by DFR Risk Management, who provide consultancy services advising ATM and self-service terminal deployers and manufacturers, as well as law-enforcement agencies, on how to manage ATM and self-service terminal fraud and security threats. |
