EPC214-17 Version 1.0 4 December 2017 [x] Public – [] Internal Use – [] Confidential – [ ] Strictest Confidence Distribution: 2017 PAYMENT THREATS AND FRAUD TRENDS REPORT This new edition of the threats trends report reflects the Abstract recent development concerning security threats and fraud in the payments landscape over the past year. Document EPC214-17 Reference Issue Version 1.0 Date of Issue 4 December 2017 European Payments Council. Cours Saint-Michel 30A, B-1040 Brussels. This document is public and may be copied or otherwise distributed provided attribution is made and the text is not used directly as a source of profit. Conseil Européen des Paiements AISBL– Cours Saint-Michel 30A, B-1040 Brussels Tel: +32 2 733 35 33 Fax: +32 2 736 49 88 Enterprise N° 0873.268.927 www.epc-cep.eu [email protected] Table of Contents 1 Document information .................................................................................. 7 1.1 Structure of the document ....................................................................... 7 1.2 References ............................................................................................. 7 1.3 Definitions ............................................................................................. 8 1.4 Abbreviations ....................................................................................... 11 2 General .................................................................................................... 13 2.1 About the EPC ...................................................................................... 13 2.2 Vision .................................................................................................. 13 2.3 Scope and objectives ............................................................................ 13 2.4 Audience ............................................................................................. 13 3 Main threats today ..................................................................................... 15 3.1 Denial of Service .................................................................................. 15 3.1.1 Definition ....................................................................................... 15 3.1.2 Fraud Description ............................................................................ 15 3.1.3 Impact & Context ............................................................................ 16 3.1.4 Suggested Controls and Mitigation ..................................................... 17 3.1.5 Final Considerations/Conclusions ....................................................... 19 3.2 Social Engineering ................................................................................ 19 3.2.1 Definition ....................................................................................... 19 3.2.2 Fraud Description ............................................................................ 20 3.2.3 Impact & Context ............................................................................ 22 3.2.4 Suggested Controls and Mitigation ..................................................... 24 3.2.5 Final Considerations/Conclusions ....................................................... 25 3.3 Malware ............................................................................................... 25 3.3.1 Definition ....................................................................................... 25 3.3.2 Fraud Description ............................................................................ 27 3.3.3 Impact & Context ............................................................................ 27 3.3.4 Suggested Controls and Mitigation ..................................................... 28 3.3.5 Final Considerations/Conclusions ....................................................... 29 3.4 Advanced Persistent Threats (APTs) ........................................................ 30 3.4.1 Definition ....................................................................................... 30 3.4.2 Fraud description ............................................................................ 30 3.4.3 Impact & context ............................................................................ 30 3.4.4 Suggested Controls and Mitigation ..................................................... 32 3.4.5 Final Considerations/Conclusions ....................................................... 34 3.5 Mobile device related attacks.................................................................. 34 3.5.1 Attacks Targeting the Mobile Device .................................................. 36 3.5.2 SIM swapping ................................................................................. 40 3.5.3 Final Considerations/Conclusions ....................................................... 42 3.6 Botnets ............................................................................................... 42 EPC214-17v1.0 2017 Payment Threats and Fraud Trends Report Page 2 of 74 3.6.1 Definition ....................................................................................... 42 3.6.2 Fraud Description ............................................................................ 43 3.6.3 Impact & Context ............................................................................ 44 3.6.4 Suggested Controls and Mitigation ..................................................... 47 3.6.5 Final Considerations ........................................................................ 49 3.7 Cloud Services and Big Data .................................................................. 49 3.7.1 Definitions ...................................................................................... 49 3.7.2 Fraud Description ............................................................................ 50 3.7.3 Impact & Context ............................................................................ 50 3.7.4 Suggested Controls and Mitigation ..................................................... 51 3.7.5 Final Considerations/Conclusions ....................................................... 52 3.8 Internet of Things (IoT) ......................................................................... 53 3.8.1 Definition ....................................................................................... 53 3.8.2 Fraud Description ............................................................................ 53 3.8.3 Impact & Context ............................................................................ 54 3.8.4 Suggested Controls and Mitigation ..................................................... 54 3.8.5 Final Considerations/Conclusions ....................................................... 54 3.9 Multi-vector attacks .............................................................................. 55 4 Early warnings ........................................................................................... 56 4.1 Virtual currencies .................................................................................. 56 4.1.1 Introduction ................................................................................... 56 4.1.2 Types of Fraud ................................................................................ 57 4.1.3 Impact and context ......................................................................... 58 4.1.4 Suggested controls and mitigations ................................................... 58 4.1.5 Conclusions and final considerations .................................................. 58 5 Payment fraud ........................................................................................... 59 5.1 Card related fraud ................................................................................. 59 5.1.1 Definition ....................................................................................... 59 5.1.2 Card Fraud Scenarios ....................................................................... 59 5.1.3 Current and New Payment Card Fraud Trends ..................................... 60 5.1.4 Suggested Controls and Mitigation ..................................................... 61 5.1.5 Final Considerations/Conclusions ....................................................... 62 5.2 ATM Fraud ........................................................................................... 63 5.2.1 Definition ....................................................................................... 63 5.2.2 Fraud description ............................................................................ 63 5.2.3 Current and new ATM fraud trends .................................................... 64 5.2.4 Suggested Controls and Mitigation ..................................................... 64 5.2.5 Final Considerations/Conclusions ....................................................... 65 5.3 SEPA Credit Transfer and Direct Debit fraud ............................................. 65 6 Conclusions ............................................................................................... 67 Annex I – SEPA Payment Instruments ................................................................ 70 Annex II – Summary Threats versus Controls and Mitigations ................................ 72 EPC214-17v1.0 2017 Payment Threats and Fraud Trends Report Page 3 of 74 List of Tables Table 1: Bibliography ....................................................................................