European terminal fraud attacks double. Total losses of €71 million were reported, down 59% from the €173 million reported in 2023.

The European Association for Secure Transactions (EAST) published a European Payment Terminal Crime Report covering 2024 which highlights a doubling of terminal related fraud attacks. This increase was due to rises in card trapping, cash trapping, transaction reversal fraud (TRF), and relay attacks at ATMs.

Card trapping attacks increased by 66% (from 1,630 to 2,704 incidents), cash trapping attacks increased by 105% (from 4,795 to 9,811 incidents), TRF attacks increased by 367% (from 338 to 1,577 incidents), and relay attacks increased by 505% (from 63 to 381 incidents).

Total losses of €71 million were reported, down 59% from the €173 million reported in 2023. Most losses remain international issuer losses due to card skimming, which were €67 million. Given the low levels of card skimming attacks, from 2025 onwards it is likely that EAST will stop reporting on them.

EAST Executive Director Lachlan Gunn said, „Card Skimming and ATM Malware and Logical attacks have been largely replaced in Europe by the exploitation of genuine transactions at ATMs and other terminals, such as ATM card and cash trapping, TRF at ATMs, and relay attacks that affect various types of terminals. Two of our Expert Groups, EAST EGAF and EAST EPTF, continue to monitor and analyse these attacks, with close cooperation between industry partners and law enforcement in the affected countries.”

ATM malware and logical attacks were down 57% (from 7 to 3) and all the reported attacks were black box attacks. A black box attack is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to ‘cash-out’ or ‘jackpot’ the ATM. No losses were reported.

Europol, supported by EAST EGAF, has published guidelines to help the industry and law enforcement counter the ATM Logical Attack threat. It is believed that the adoption by the industry of the recommendations has helped to drive down attacks. Given the low levels of such attacks, from 2025 onwards it is likely that EAST will stop reporting on them.

ATM related physical attacks were up 28% (from 4,637 to 5,953 incidents). Within this total, ATM explosive attacks (including explosive gas and solid explosive attacks) were down 16% (from 714 to 602 incidents) and attacks due to ATM Theft (Rip-out)/ATM burglary (In-situ) were up 17% (from 506 to 592 incidents).

Losses due to ATM related physical attacks were €12 million, a 33% increase from the €9 million reported during 2023. Seventy-one percent of these losses were due to explosive attacks, which were up 60% from €5.36 million to €8.56 million. While on average around 40% of such attacks do not result in cash loss, the loss figures shown do not take into account collateral damage to equipment or buildings, which can be significant and often exceeds the value of the cash lost in successful attacks.

A summary of the report statistics under the main headings is in the table below. The full report, with breakdowns for each crime category, is available to EAST members.

___________

EUROPEAN PAYMENT TERMINAL CRIME REPORT – Period: January to December 2024
The above release is based on a report prepared twice-yearly by EAST to provide an overview of the European payment terminal crime situation for law enforcement officers and EAST members, using statistics provided from 19 European states. The following countries, with an estimated total installed base of 295,674 ATMs, 303,263 UPTs, and 16,773,501 POS terminals, supplied full or partial information for this report: Austria; Belgium; Denmark; Finland; France; Germany; Greece; Ireland; Italy; Liechtenstein; Luxembourg; Netherlands; Portugal; Romania; Slovakia, Spain; Sweden; Switzerland; United Kingdom.