Criminals are increasingly trying to trap debit and other payment cards within cash machines for later retrieval, according to a new report.
The number of trapping incidents rose 209 percent in 2009 from 2008, to 2,166, according to the European ATM Security Team (EAST), which collects data on close to 370,000 cash machines in 23 European countries.
The rise in card trapping incidents could be as a result of increased deployment of chip-and-PIN (Personal Identification Number) cards throughout Europe, also known as EMV (Europay, MasterCard, Visa) cards.
About 94 percent of the cash machines in Europe are capable of verifying the presence of a microchip that verifies the card's four-digit PIN, which has proven effective against cloning. But it's a different story if the criminal actually obtains the card.
"If the PIN has been compromised, trapped EMV cards can be used by criminals to illegally withdraw cash from EMV compliant ATMs until blocked by the card issuer," according to EAST's report, which covers the full year 2009.
Other countries, such as the U.S., do not use chip-and-PIN. Criminals have had much success installing so-called "skimming" devices, which copy the magnetic stripe on the back of the card, on the front of the cash machine. If the criminal can also obtain the PIN, it's possible to clone the card.
It's possible to trap cards in cash machines and then use tweezers to pull them out. Another method is to put a device on the machine that uses tape, wire or thread in order to hold a card in. The PIN can be obtained through observation or by putting an overlay on the keypad that can record PINs.
Overall, skimmings incident fell slightly -- by 1 percent -- for the first time since EAST began collecting statistics in 2004. Three countries that have significant ATM deployments reported decreases, but 11 countries reported increases, the report said.
Scammers in Europe will often use skimming devices to get the details from chip-and-PIN cards. They will create cloned cards but then use them in countries where the cash machines do not verify the presence of a PIN.
Total reported losses for ATM fraud fell 36 percent compared to 2008, to about €312 million (US$416 million).
"The overall drop in losses indicates the benefits of the EMV deployment and also that fraud counter measures, fraud-monitoring capabilities and fraud detection continue to improve," the report said.
The countries surveyed were Austria, Belgium, Cyprus, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Liechtenstein, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, Switzerland and the U.K.