Government recognitions and production deployments of passwordless authentication technologies have increased across the Asia-Pacific region, The FIDO Alliance says in an update of progress since the July Asia-Pacific Marketing Forum (AMF).

Taiwan’s government has followed up the introduction of FIDO standards in official industry body documents with adopting the protocol for a tax service that supports more than 200,000 users. India has made FIDO2 authentication an accepted alternative to SMS OTP, and users are being authenticated to public services in Malysia through a FIDO-certified service from SecureMetric. Advancements of passwordless authentication with FIDO standards in Hong Kong, Vietnam and Japan are also reviewed.

There are more than 150 million people using passwordless sign-ins with Microsoft each month, the company announced in November, a 50 percent increase from a year earlier.

– Biometric Update –

The US National ATM Council is warning cash machine operators of an emerging scam in which criminals re-programme the terminal to dispense notes even when a transaction is denied.

The scam, which has hit ATMs in California, is accomplished by criminals’ opening the upper ATM housing and installing a “rigged” device that alters the transaction response message coming back from the card issuer to the terminal. This effectively turns a “denial” into an “approval” message – thereby tricking the terminal into dispensing the cash. 

“This scam appears to be taking advantage of an unencrypted communications link vulnerability somewhere between the wireless modem and the ATM terminal,” says NAC. “To protect against this scam, sources are advising operators to program their ATMs to implement SSL encryption whether the terminal is using a hard-wired or wireless data connection as its communications modality.”

Operators are also advised to check their upper housings for signs of tampering and to make sure they are not using standard default lock and key settings.

States the NAC: “Although this scam has been reported thus far as only occurring in California, we know how trends such as this can and do spread across the nation…and so, vigilance is in order.”

– Finextra –

And now for something completely different – losses due to card fraud at EU payment terminals have fallen to the lowest level since 2005.

Figures released by the European Association for Secure Transactions (East) show total losses of €107 million for the first six months of 2018 – a 43% drop – primarily as a result of a 19% dip in card skimming scams (down from €118 million to €104 million).

East executive director Lachlan Gunn says: “The significant drop in card skimming incidents and losses reflects the continued effectiveness of EMV, as well as the work that has been put in by payment terminal deployers and card issuers with regard to counter-measures such as geo-blocking, fraud monitoring capabilities and fraud detection.”

Logical attacks against ATMs were also down 46%, while cash machine jackpotting attempts pulled in a miserly €0.25 million, compared to €1.51 million in the equivalent period last year.

Instead, criminals appear to be resorting to brute force tactics, with ram raids and explosive attacks all ticking up. Losses due to ATM related physical attacks were €15.1 million, a 24% increase from the €12.2 million reported during the same period in 2017.

– Finextra –

The Secret Service has notified U.S. financial institutions about a recent increase in “eavesdropping” attacks on ATMs.

The agency said it has received communications from several FIs about recent incidents, according to a report by Krebs on Security.

In this type of ATM skimming, criminals cut a hole in the ATM cabinet in order to insert an endscope, which allows them to see inside the machine as they place a skimming device on the card reader.

Commenters on the Krebs site pointed out that this skimming method is not a new kind of threat, but a new application of a well-known type of data theft at ATMs — skimming — that can be detected by existing ATM protection technologies.

– atmmarketplace.com –

Criminals stole more than £500 million from UK bank account holders in the first half of 2018, according to industry figures.

Bank trade group UK Finance says that £145 million of the losses were down to authorised push payment (APP) scams, where crooks trick victims into sending money to another account.

The remaining £358 million was lost in unauthorised fraud, where fraudulent transactions are made without the bank account holder’s knowledge. UK Finance says that despite the losses, the industry managed to prevent over £700 million in unauthorised fraud.

Customers who experience unauthorised fraud are usually refunded by their banks. However, APP victims generally do not.

Mobile banking concept

In June the Financial Conduct Authority proposed updating its complaint handling rules to help victims of APP scams after an initial review of the way banks handle them found procedures were inconsistent, that their existing fraud detection systems could not easily detect APP fraud, and they didn’t collect enough data.

Katy Worobec, MD, economic crime, UK Finance, says: “The finance industry is committed to fighting back, investing millions in security systems and cyber defences to protect customers.

“We have brought in new standards to ensure scam victims get the help they need from their payments provider; we are supporting law enforcement in disrupting the criminals and freezing stolen money; and we are assisting the government in improving intelligence sharing to extinguish the threat.”

– Source: finextra.com –