Why ATM Fraud Losses Will SurgeEven Nations With EMV to Experience Uptick
For months, experts have warned about upticks in global card fraud as U.S. banking institutions gear up for rollout of EMV chip cards. That's a key step toward the eventual worldwide elimination of the easy-to-compromise magnetic stripes on cards.
And it seems the predictions of a fraud surge have come true, as attackers focus more effort toward capitalizing on current magnetic-stripe vulnerabilities while they can.
More fraud will be pushed to the U.S. It's the fraudsters' last market, and the crime world's most profitable.
Skimming at ATMs was reported by 20 European countries in the third quarter, with attacks increasing from the previous quarter in eight of them, according to the European ATM Security Team, a not-for-profit group that collects security and fraud information about ATMs, networks and payment terminals.
Experts expect skimming schemes to increase worldwide over the next 18 to 24 months as the United States' migration toward enhanced payments technology that complies with the Europay, MasterCard, Visa standard for chip cards ramps up, moving the world a step closer to the elimination of magnetic stripes (see ATM Skimming Arrests: Sign of the Times?).
In the meantime, banking institutions should brace for more financial losses related to skimming and take steps now to shore up their cross-channel fraud detection strategies (see How to Fight Cross-Border ATM Fraud).
"The U.S. will continue to see skimming until the majority of ATMs and POS devices in this country are protected [by EMV]," says Jerry Silva, who oversees the global retail banking practice at the advisory firm International Data Corp.
Julie Conroy, a fraud expert and analyst for the consultancy Aite, tells me that the strikes against U.S. banks will be the most damaging in the next several months.
"When I did the research for my EMV report earlier this year, most of the large issuers I spoke with told me that they are seeing 30 percent to 50 percent year-over-year increases in counterfeit [card] fraud, thanks to the fact that we are still mag-stripe dependent," she says.
In November, the European ATM Security Team noted that skimming attacks and fraud losses linked to skimmed card data continue to plague European banks. But some European banks are taking action to reduce their losses by blocking mag-stripe transactions - the only types of transactions that can be conducted at ATMs with counterfeited mag-stripe cards.
Why? Because fraudulent withdrawals linked to skimmed card data have continued to adversely impact European cardholders, even in markets where EMV technology is now the standard. Attackers have continued to drain those accounts by using counterfeit cards at ATMs in non-EMV compliant countries, such as the U.S.
Card transactions that conform to EMV rely on a micro-processing chip, not a mag-stripe. Data saved to that chip cannot be skimmed.
Until worldwide conformance with the EMV standard for chip cards is complete, card readers on ATMs and POS devices have to continue to accept mag-stripe transactions, and EMV cards also have to retain mag-stripes. And any card with a mag-stripe runs the risk of having data skimmed.
Lingering mag-stripe technology is why European card data can still be skimmed and copied, and it's becoming an increasingly touchy subject for European banks. It's also why more and more banks in European nations are fully blocking mag-stripe transactions.
EAST reports that the U.S. holds the leading position for ATM-related skimming losses, followed by Thailand, Colombia and India. In European markets, more attention is being paid to counter-measures such as geo-blocking (not accepting cards from non-EMV compliant markets) and enhancements to fraud monitoring and detection, EAST states.
It's safe to assume that in the near future, few European banks will accept U.S. mag-stripe transactions. Until the world is fully EMV compliant, it's the best option these markets can pursue to ensure fraud loss reduction.
But what about the U.S.? Well, as more EMV countries implement geo-blocking, more fraud will be pushed here. It's the fraudsters' last market, and the crime world's most profitable.
Until the U.S. fully implements EMV, U.S. institutions need to invest in cross-channel fraud detection now, to ensure they are detecting ATM schemes.