Annual cash machine losses in Europe approach EUR 500 million: ENISA provides advice for consumers

With the annual cost of ATM crime in Europe approaching half a billion Euros, ENISA, the European Network and Information Security Agency, is urging consumers to be more aware of the risks and take precautions to avoid personal loss. The rapid growth in the number of ATMs, combined with more sophisticated attacks and fraud has resulted in an alarming 149% rise in ATM attacks in 2008.

These worrying findings, along with information and case studies highlighting the different ATM crimes and recommendations to help detect and prevent them, are published this week in a paper by ENISA entitled ‘ATM Crime: Overview of the European situation and golden rules on how to avoid it’.

The number of ATMs in Europe increased 6% last year to almost 400,000, with many now found in remote site locations such as convenience stores, airports and petrol stations. Seventy-two percent of European ATMs are located in just five countries: UK, Spain, Germany, France and Italy.

Cash taken illegally from ATMs is still the preferred method for criminals who obtain pin numbers using a wide range of techniques from ‘shoulder surfing’ to complex skimming techniques. This can involve the usage of a small spy camera, a false PIN overlay and even fake machines; while increasingly Blue Tooth wireless technology is used to transmit card and PIN details to a nearby laptop computer. During 2008 alone, a total of 10,302 skimming incidents were reported in Europe.

Other methods used to extract money include trapping and then retrieving users’ cards, stopping withdrawals in the middle of a transaction only to complete them when the victim has left and even trapping cash in the machine. Organised criminal gangs are also using sophisticated phishing techniques and hacking into bank computer systems and web sites to obtain PIN and account information.
ATM burglaries and physical attacks have also seen an increase by 32% over the last 12 months from ram raids and explosions to the use of rotary saws, thermal lances and diamond drills.

“ATMs are attractive to criminals because they contain bank notes, while the bank cards themselves give thieves access to customers’ bank accounts,” said Mr. Andrea Pirotti, Executive Director at ENISA. “Looking ahead, ATM crime is likely to become even more attractive as the latest generation of ATMs is designed to dispense other services and products such as phone top ups and stamps. The first line of defence against ATM crime is increasing awareness of the risks so that users can take simple precautions such as shielding their PIN when entering it and by keeping alert to any signs of tampering or suspicious activity at an ATM.”

The paper published this week by ENISA recommends that further information and advice are provided nationally in EU Member States by banks, financial institutions, payment schemes and law enforcement agencies. As part of this process ENISA has drawn up its list of Golden Rules to offer maximum protection with minimum effort.

ENISA Golden Rules

Choosing an ATM Machine

1. Don’t use ATMs with extra signage or warnings
2. Try to use ATMs inside banks
3. Don’t use freestanding ATMs

Physical surroundings

4. Use an ATM which is in clear view and well lit
5. Be cautious of strangers and check they are at a reasonable distance away

Making Operations

6. Pay careful attention to the front of the machine for tampering
7. Pay attention to the card reader for signs of additional devices
8. Look carefully for differences or unusual characteristics of the ATM’s PIN pad
9. Look out for extra cameras
10. Protect your PIN by standing close to the ATM and shielding the key pad
11. Report confiscated cards immediately
12. Beware of ATMs that don’t dispense cash and non-bank ATMs that don’t charge fees

Statement Reviews

13. Frequently review your account statements
14. Report any suspicious activity immediately

“Information security has, for too long, been focusing on technical solutions to maximise protection,” continued Pirotti. “Most ATM crime is focused on exploiting the human element and card holders must be more aware of the risks they are exposed to and how to prevent fraud occurring. We hope this latest report will be the start of an on-going process to increase awareness and reduce the growing cost of ATM crime.”

About ENISA

ENISA is the European Network and Information Security Agency, a centre of expertise set up to provide advice and recommendations to EU Member States and EU Institutions on issues of network and information security. The Agency's mission is to achieve a high level of network and information security within the European Union for the benefit of citizens, consumers, business and public sector organisations using technologies such as broadband, online and ATM banking, ecommerce, and mobile phones.
For further information visit:
The full report is available at:
http://www.enisa.europa.eu/doc/pdf/publications/ATM_crime.pdf
For further details contact:
Allie Andrews, PRPR, Tel: + 44 1442 245030, email: allie@prpr.co.uk; Sarah Capogrossi, Press and Communications Assistant, ENISA, Mob: +30 6948 460124, email: sarah.capogrossi@enisa.europa.eu