EUROPEAN COMMISSION Brussels, 13.9.2017 SWD(2017) 298 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Directive of the European Parliament and the Council on combating fraud and counterfeiting of non-cash means of payment and replacing Council Framework Decision 2001/413/JHA

{COM(2017) 489 final}

{SWD(2017) 299 final}



The current EU legislation that provides common minimum rules to criminalise non-cash payment fraud is the Council Framework Decision 2001/413/JHA on combating fraud and counterfeiting of non-cash means of payment. The Framework Decision was part of the first EU Fraud Prevention Action Plan 2001, which aimed to improve the prevention of fraud and counterfeiting of non-cash payments, especially by extending the cooperation and exchange of information for investigation and prosecution between the competent authorities of the Member States and by boosting the fraud prevention measures. The main components of the Framework Decision are: ·Definition of "payment instrument" as any physical (“corporeal”) payment instrument which can be used to transfer money or monetary value and is protected against imitation or fraudulent use. ·Identification of different forms of behaviours requiring criminalisation in relation to fraud and counterfeiting of non-cash means of payments: offences related to payment instruments (e.g. theft, counterfeiting, falsification, receiving or selling fraudulent use stolen or counterfeited payment instruments, use of a stolen or counterfeited payment instrument); offences related to computers (i.e. performing or causing a transfer of money by introducing, altering, deleting or suppressing computer data or by interfering with the functioning of a computer programme or system); offences related to specifically adapted devices (e.g. fraudulent making, receiving, obtaining, sale or transfer to another person or possession of instruments, articles, computer programmes and any other means peculiarly adapted for the commission of counterfeiting or falsification of a payment instrument). ·Rules on liability and sanctions for legal persons, provisions on establishing jurisdiction on offences relating to non-cash payment fraud, on extradition and prosecution and rules to facilitate cross-border cooperation and exchange of information. EU policy and legislative context The policy and legislative context has significantly changed since the Framework Decision was adopted. Various legislative acts at EU level have been adopted since 2001, both in criminal and civil law, which: 1.provide pan-European cooperation mechanisms in criminal matters that facilitate coordination of investigation and prosecution (procedural criminal law). These include: oCouncil Framework Decision 2002/584/JHA on the European Arrest Warrant and the surrender procedures between Member States (EAW), which sets conditions for compulsory extradition for offences covered by the Framework Decision (e.g. “fraud, including that affecting the financial interests of the European Communities”, “forgery of means of payment”, “computer-related crime”, “participation in a criminal organisation”) when they are punished by a certain level of penalties. Member States can no longer refuse to extradite to another Member State citizens on the sole grounds of nationality, in case the offences committed are punishable by a custodial sentence or a detention order for a maximum period of at least three years. The European Arrest Warrant may apply for offences punishable by imprisonment or a detention order for a maximum period of at least 1 year or where a final custodial sentence has been passed or a detention order has been made, for sentences of at least 4 months. oConvention on Mutual Assistance in Criminal Matters between the Member States of the European Union , which sets up the conditions when the mutual assistance shall be afforded. oDirective 2014/41/EU regarding the European Investigation Order in criminal matters , which updates the legal framework applicable to the gathering and transfer of evidence between Member States, based on mutual recognition of judicial decisions. It allows an authority in one Member State (the "issuing authority") to request specific criminal investigative measures be carried out by an authority in another Member State (the "executing authority"). oCouncil Framework Decision 2005/214/JHA on the application of the principle of mutual recognition to financial penalties, which facilitates the enforcement of financial penalties in cross-border cases, wherever in the EU they may have been imposed. It abolishes dual criminality checks in relation to 39 listed offences, which include fraud as well as counterfeiting of currency. oCouncil Framework Decision 2009/948/JHA on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings, which aims to improve judicial cooperation between Member States so as to prevent unnecessary parallel criminal proceedings concerning the same facts and the same person. It lays out the procedure whereby competent national authorities contact each other when they have reasonable grounds to believe that parallel proceedings are being conducted in another EU country. It also establishes the framework for these authorities to enter into direct consultations when parallel proceedings exist, in order to find a solution to avoid the negative consequences arising from these proceedings. oCouncil Framework Decision 2009/315/JHA on the organisation and content of the exchange of information extracted from the criminal record between Member States, which sets out the general principles for the functioning of the exchange of criminal records between EU countries, alongside Council Decision 2009/316/JHA on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA, which establishes ECRIS. They seek to prevent criminals from escaping their past by moving to a different EU country from that in which they were convicted. They do this by ensuring that information on all their convictions is available when needed, irrespective of the EU country in which they were convicted. They set an obligation for an EU country convicting a national of another EU country to transmit information on such conviction to the country of his nationality and define the obligations of the EU country of which the person is a national to store the received information on convictions as well as the procedures which that EU country is to follow when replying to requests for information about its nationals. oDirective 2012/29/EU establishing minimum standards on the rights, support and protection of victims of crime , which provides minimum standards on the rights, support and protection of victims of crime, ensuring that they receive appropriate information, support and protection and may participate in criminal proceedings wherever the damage occurred in the EU. These victims must have the right to, e.g., recover stolen property, have their expenses reimbursed, receive legal aid and have their case heard in court. oCouncil conclusions on improving criminal justice in cyberspace, in which the Council called on the Commission to take concrete actions based on a common EU approach to improve cooperation with service providers, make mutual legal assistance more efficient and to propose solutions to the problems of determining and enforcing jurisdiction in cyberspace. In response to these conclusions, The Commission conducted an expert consultation process and summarized its results in a non-paper, presented to the Council on June 8 2017, which may result in a legislative initiative. oRegulation (EU) 2016/794 on Europol, which sets up the rules for Europol, in particular its: §objectives, including mutual cooperation amongst EU countries in preventing and combating terrorism, serious crime affecting two or more EU countries and forms of crime which affect a common interest covered by EU policy; §tasks, including collecting, storing, processing, analysing and exchanging information including criminal intelligence, as well as coordinating, organising and implementing investigative and operational actions to support Member States and supporting EU countries in combating crime enabled, promoted or committed using the internet), and

§scrutiny, including monitoring of Europol’s processing of personal data. oCouncil Decision 2002/187/JHA setting up Eurojust, which facilitates cross-border judicial cooperation in criminal matters. 2.criminalise conduct related to fraud and counterfeiting of non-cash means of payment (substantive criminal law). These include: oDirective 2013/40/EU on attacks against information systems , which establishes minimum rules concerning the definition of criminal offences and the relevant sanctions, and to improve cooperation between competent authorities. oDirective 2014/62/EU on the protection of the euro and other currencies against counterfeiting by criminal law , which establishes minimum rules concerning the definition of criminal offences and sanctions, and introduces provisions to strengthen investigation of offences and cooperation against counterfeiting. oDirective 2017/541/EU on combating terrorism, which criminalises providing or collecting funds with the intention or the knowledge that they are to be used to commit terrorist offences and offences related to terrorist groups or terrorist activities. oThe Proposal for a Directive on countering money laundering by criminal law , which establishes minimum rules on the definition of offences and sanctions related to money laundering. At present, there are differences in the definition of money laundering offences and sanctions applied across the EU. These differences negatively affect cross-border police and judicial cooperation and may lead to “forum shopping” by offenders choosing to commit their crimes in the jurisdictions providing for lower sanctions. Non-cash payment fraud and cybercrime are included in the list of “predicate offences” (the underlying criminal activities generating the proceeds which are then laundered). 3.regulate the payment process, in particular to facilitate secure payments across the EU. These include: oRevised Payment Services Directive (PSD2) , which defines a comprehensive framework for the provision of payment services in the European Economic Area by, among others: §setting higher security standards for payments and better protecting consumers against current threats; §defining key terms such as “payment instrument”; §specifying the conditions for the liability of the services provider and the payer; §providing for mandatory reporting to the competent authority of major operational or security incident relating to the account information service provider or the payment initiation service provider. §requiring Member States to ensure that payment service providers provide, at law enforcement on an annual basis, statistical data on fraud relating to different means of payment. oDirective 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, (the fourth Anti-Money Laundering Directive), which aims at better identifying suspicious transfers (including those resulting from non-cash payment fraud) and communicating them through suspicious transaction reports to national Financial Intelligence Units (FIUs). The extension of the scope of the fourth Anti-Money Laundering Directive to virtual currencies exchange platforms and custodian wallet providers is currently under discussion. It aims to ensure a clearer regulatory framework and more transparency (due diligence) for exchanges between virtual and fiat currency. oRegulation (EU) 2015/847 on information accompanying transfers of funds, which sets out rules on the information on payers and payees, accompanying transfers of funds, in order to help prevent, detect and investigate money laundering and terrorist financing. oRegulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market (Electronic Identification and Trust Services (eIDAS) Regulation), which aims to improve trust in EU-wide electronic transactions and to increase the effectiveness of public and private online services and e-commerce by, e.g. removing existing barriers to the use of eID in the EU. oRegulation (EU) 2012/260 establishing technical and business requirements for credit transfers and direct debits in euro, which created the Single Euro Payments Area (SEPA) and supported the integration of the euro payments market by developing harmonised payment schemes, frameworks for electronic euro payments and mobile and online payments. oDirective (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive), which aims at enhancing the overall level of cybersecurity in the EU. It provides Member States with a coordination mechanism to support a swift and good operational cooperation on specific cybersecurity incidents and the sharing of information about risks.

In addition to the above legislative acts, the legislation resulting from the data protection reform is of critical importance in the context of combatting non-cash payment fraud: ·Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). ·Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data. Last but not least, the fight against non-cash payment fraud needs to be seen in the context of three important EU policies: ·the European Agenda on Security , which sets out the principles for EU action to respond effectively to security threats and the main steps planned by the European Commission to implement these, and identifies the 3 priorities for immediate action, by both national governments and the EU institutions, which share responsibility for EU security: 1) preventing terrorism and countering radicalisation; 2) fighting organised crime; 3) fighting cybercrime. ·the EU Cybersecurity Strategy, which aimed at creating the world’s most secure online environment in the EU, by providing for partnerships with the private sector and non-governmental organisations or interest groups, and concrete action to protect and promote citizens’ rights. The current 2013 version is being revised and an updated strategy is expected by the end of 2017. ·The Digital Single Market Strategy, which sets out 16 targeted actions based on 3 pillars: 1) Better access for consumers to digital goods and services across Europe, 2) Creating the right conditions and a level playing field for digital networks and innovative services to flourish and 3) Maximising the growth potential of the digital economy. The Framework Decision today The Framework Decision contributes to the above EU policy context by covering with criminal law a specific set of offences related to the payment process, i.e. those involving fraud and counterfeiting of non-cash means of payment. That said, the European Agenda on Security acknowledges that the Framework Decision no longer reflects today’s realities and insufficiently addresses new challenges and technological developments such as virtual currencies and mobile payments. While a full evaluation according to the Commission's Evaluation Guidelines was still to be conducted, by the publication of the European Agenda of Security in 2015 other exercises had provided information about the state of implementation and the strengths and weaknesses of the current legal framework. Two implementation reports were completed in 2004 and 2006. In addition, relevant national provisions on non-cash payment fraud had recently been analysed under a Commission study on criminal sanction legislation and practice in representative Member States. Furthermore, operational action under the EU policy cycle to tackle organized and serious international crime had provided additional evidence as to the effectiveness of the existing rules. Consequently, the Commission committed in the European Agenda of Security to review the existing legislation on combatting fraud and counterfeiting of non-cash means of payments. President Juncker reiterated that commitment by including improved rules on fraud in non-cash payments in his September 2015 Letter of Intent, initially planned for delivery in 2016: "Priority 7: An Area of Justice and Fundamental Rights Based on Mutual Trust -Follow up to the European Agenda on Security, including a proposal reviewing the framework decision on terrorism, improved rules on firearms and fraud of non-cash payments, and corresponding operational measures" Stakeholders and citizens had the opportunity to express their views in an open public consultation through an online questionnaire that was accessible from 1/3 to 24/5/2017. The Commission organized as well targeted consultations with stakeholders from the public and private sector and civil society organisations. An external contractor also organized targeted consultations through interviews and an online survey, within a study on the evaluation of the current policy and legislative framework and impact assessment. In general, stakeholders expressed doubts about the relevance, effectiveness and added value of the Framework Decision, and indicated the need to improve cooperation between national authorities and between public authorities and the private sector. 1.2.Definition and magnitude of the problem 1.2.1. Payments

There are 3 main parties in any payment: the one who pays (payer), the one who gets paid (payee) and the one who executes the payment (enabler). The payer shares with the enabler the necessary information to authorize it to give the funds to the payee, who in return provides products or services to the payer. Figure 1: main parties and exchanges in a payment Source: European Commission For example, when someone (payer) buys a book in an online shop (payee), he shares with his bank and credit card company (enablers) the necessary information to trigger the execution of the payment and give the online shop the money in exchange for the book. As the example above illustrates, there are three types of enablers: 1.Financial institutions (e.g. a bank): provide the monetary value. 2.Payment instruments (e.g. a credit card): provide the vehicle to convey the monetary value. 3.Providers of other services related to the execution of the payment (e.g. enablers of a credit card transaction). In cash payments, a central bank provides the monetary value, which is conveyed in bills and coins (payment instruments). In non-cash payments there is a wider variety of payment instruments. 1.2.2. Non-cash payments Taxonomy The most common non-cash payment instruments are payment cards (credit and debit), credit transfers, direct debits, cheques, e-money, virtual currencies, mobile money, vouchers (e.g. tickets restaurant), coupons and fidelity cards. Magnitude of the problem The total value of non-cash payment transactions with cards, credit transfers, direct debits, cheques and e-money has been increasing in Europe in the last years:

Figure 2: value of transactions in key non-cash payment instruments in the EU Source: European Central Bank, Payment Statistics , September 2016 The decrease in the value of transactions with cheques and direct debit has been compensated by the significant increase in the value of transactions with the other payment instruments, in particular credit transfers, which account for more than 90% of the total. The total number of non-cash payment transactions with cards, credit transfers, direct debits, cheques and e-money has also been increasing in Europe in the last years: Figure 3: number of transactions in key non-cash payment instruments in the EU Source: European Central Bank, Payment Statistics , September 2016 The decrease in the number of transactions with cheques has been more than compensated by the significant increase in the number of transactions with the other payment instruments. Payments with virtual currencies have also dramatically increased in the last years globally, both in value and number: Figure 4: value and number of transactions with bitcoin globally Source: blockchain.info/stats, accessed on June 2017 Although the data on mobile payments is limited, a 2016 study indicated that 54% of European consumers regularly use their mobile device to make payments, three times as many as in 2015. For vouchers, coupons and fidelity cards no data about market size and number of transactions could be located, although these payment instruments are likely to represent a very small fraction of the total number of transactions and value of non-cash payments. 1.2.3. Fraud in non-cash payments Taxonomy Fraud can affect each of the 3 main parties/stages in a payment described in figure 1. In non-cash payments, fraud takes the following forms in each of the stages: 1)Trigger the execution of payments by using payer information fraudulently.

The fraudster gets hold of the information required to trigger the execution of a payment and uses it for his own benefit, against the will of the legitimate owner of the funds. There are multiple methods to collect that information: phishing, skimming, pharming … or simply acquiring it from someone else. Once the fraudster has acquired the necessary information, he can use payment instruments (in particular non-corporeal such as card credentials, credit transfers, direct debit and virtual currencies) to trigger the execution of a payment. 2)Execute payments by tampering with or stealing the payment instrument. ·Tampering with payment instruments: oCounterfeiting: e.g. of cards (credit/debit, fuel, loyalty) out of stolen card credentials to pay in stores or withdraw cash in ATMs; counterfeiting of cheques, vouchers or coupons, etc. oHacking of information systems to process payments: e.g. tampering with points of sale for card transactions; unlawfully increase the credit card limit to allow excess expenses go undetected, etc. ·Stealing payment instruments. 3)Fail to provide the product/service after receiving the payment. This type of payment fraud covers the various forms of scams, from failing to deliver the product/service as initially agreed, to tricking the payer to trigger the payment (e.g. CEO fraud, in which the attacker pretends to be the CEO of a company and tricks an employee at the organisation into wiring funds to the fraudster). This third category is out of the scope of this impact assessment. Magnitude of the problem Fraud data exists only for card fraud which, as shown in figure 3, is the most important non-cash payment instrument in terms of number of transactions. There are two kinds of card fraud: oThe card is present, e.g. using a counterfeit card to withdraw cash from an ATM or to pay in a point of sale in a shop. oThe card is not present, e.g. when using stolen card credentials to buy goods online. The total value of card fraud using cards issued in the Single European Payment Area (SEPA) amounted to €1.44 billion in 2013 (most recent data available), of which 66% (€950 million) corresponded to card-not-present fraud and 34% (€490 million) to card-present fraud (of which 20% to point-of-sale (POS) and 14% to ATM fraud). This represented 0.039% of the total value of card transactions: Figure 5: evolution of the total value of card fraud using cards issued within SEPA

Source: European Central Bank, Fourth Report on Card Fraud , 2015 The total number of fraudulent transactions using cards issued in SEPA amounted to 11.29 million in 2013, of which 71% corresponded to card-not-present fraud and 29% to card-present fraud (of which 20% to POS and 9% to ATM fraud). This represented 0.020% of the total number of card transactions: Figure 6: evolution of the total volume of card fraud using cards issued within SEPA Source: European Central Bank, Fourth Report on Card Fraud , 2015 As figures 5 and 6 indicate, card-not-present fraud not only constitutes the largest share of card fraud but also a share that has increased in the last years, both in value and in number of transactions. Moreover, the increase in the total amounts of card fraud in the last years (both in value and in number of transactions) has been mainly driven by the increase in card-not-present fraud. Card-present fraud (i.e. ATMs and POS terminals) decreased in 2013, due to: ·Near completion of migration to the EMV standard (cards with chip) within SEPA. ·Wider use of blocking overseas transactions using EU-issued cards unless they have been activated in advance. ·Increased physical security measures at the terminal (e.g. lids to protect PIN entry, skimming device detectors, etc…). ·Deactivation of the option to fall back to magnetic stripe usage for cards. Card-present fraud is roughly equally divided in value into counterfeiting (45%) and fraud using lost or stolen cards 43% (2013). 1.2.4. Why is it a problem Box 1 puts into perspective the magnitude of the problem described above: Box 1: the magnitude of the problem put into perspective ·Average loss per fraudulent card transaction: around EUR 130 (result of dividing the value of card fraud, EUR 1440 million, by the number of card transactions, 11.3 million, in 2013). ·The average monthly salary in the EU is around EUR 1500 (EUR 1489 in 2014). Losing around 10% of the monthly salary due to fraud (a conservative estimate since there is only card fraud data available) is a significant amount which becomes much more relevant for the citizens earning below the average EU salary (for example, these fraud losses would have represented more than two thirds of the minimum wage in Bulgaria of EUR 173 in 2014). ·The probability of a card transaction being fraudulent was 0.002% in 2013, as indicated in figure 6, or 1 in 5000. This was about 4 times more likely than dying on a road traffic accident in the same year, all vehicles combined, and including pedestrians. The most problematic aspect of non-cash payment fraud is that it represents a threat to security. In addition, it is an obstacle to the digital single market.

A threat to security Non-cash payment fraud provides income for organized crime and therefore enables other criminal activities such as terrorism, drug trafficking and trafficking in human beings. In particular, according to Europol, non-cash payment fraud income is used to finance: ·Travel: oFlights: the experience gained from conducting the Global Airline Action Day operations from 2014 to 2016 indicates a clear link between non-cash payment fraud, airline ticketing fraud and other serious and organised crimes, including terrorism. Some of the people travelling on fraudulently obtained tickets were known or suspected to be involved in other offences. oOther travel fraud (i.e. selling and travelling on tickets that have been obtained fraudulently). The main way to purchase illegal tickets was through the use of compromised credit cards. Other methods included, e.g. the use of compromised loyalty point accounts, phishing travel agencies and voucher fraud. In addition to offenders, those travelling on fraudulently obtained tickets included victims of trafficking and people acting as ‘money mules’. ·Accommodation: law enforcement also reports that non-cash payment fraud is also used to facilitate other crimes that require temporary accommodation such as trafficking in human beings, illegal immigration or drug trafficking. Europol also reported that the criminal market for payment card fraud in the EU is dominated by well-structured and globally active organised crime groups. Whereas 0.0039% of the value of all card transactions being lost to fraud may seem a small percentage, this represents a total amount of at least EUR 1,44 billion per year going to fund organized crime groups. This amount is likely to increase, as described later in section 1.6 (“How would the problem evolve”), mainly fuelled by the increasing digitalisation of the economy and the emergence of new payment instruments (technological innovation). An obstacle to the digital single market Non-cash payment fraud hinders the development of the digital single market in two ways: ·It causes important direct economic losses. Section 1.2.3 quantified non-cash payment fraud in Europe in terms of the amount of direct fraud losses for which there is data available (card fraud). For example, the airlines lose around USD 1 billion per year globally in card fraud. ·It reduces consumers' trust, which may result in reduced economic activity and limited engagement in the digital single market. According to the most recent Eurobarometer on Cyber Security, the vast majority of Internet users (85%) feel that the risk of becoming a victim of cybercrime is increasing. Whereas the probability of 0.002% (1 in 5000) of a card transaction being fraudulent may seem small, the perception of insecurity has 42% of users are worried about the security of online payments. Because of security concerns, 12% are less likely to engage in digital transactions such as online banking. 1.3.Problem drivers To analyse in detail the problem of non-cash payment fraud and identify its drivers, the Commission conducted an evaluation of the Framework Decision (see annex 5). The evaluation also analysed other EU legislative instruments put in place since the adoption of the Framework Decision, which are relevant to tackling non-cash payment fraud, and incorporated the input from the public consultation and expert meetings organized by the European Commission. The evaluation detected three problem drivers: 1.Some crimes cannot be effectively investigated and prosecuted under the current legal framework. 2.Some crimes cannot be effectively investigated and prosecuted due to operational obstacles. 3.Criminals take advantage of gaps in prevention to commit fraud.

The problem drivers indicate that the issue at hand is mostly a regulatory failure, where the current EU legislative framework (the Framework Decision) has become partially obsolete, due mainly to technological developments. The evaluation indicated that this regulatory gap has not been sufficiently covered by more recent legislation, as the analysis of the problem drivers below will also highlight. The drivers are divided into the following sub-drivers: Table 1: drivers and sub-drivers Drivers Sub-drivers 1.Some crimes cannot be effectively investigated and prosecuted under the current legal framework. a.Certain crimes cannot be prosecuted effectively because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised. b.Preparatory acts for non-cash payment fraud cannot be prosecuted effectively because they are criminalised differently in Member States or not criminalised. c.Cross-border investigations can be hampered because the same offences are sanctioned with different levels of penalties across Member States. d.Deficiencies in allocating jurisdiction can hinder effective cross-border investigation and prosecution. 2.Some crimes cannot be effectively investigated and prosecuted due to operational obstacles. a.It can take too much time to provide information in cross-border cooperation requests, hampering investigation and prosecution. b.Under-reporting to law enforcement due to constraints in public-private cooperation hampers effective investigations and prosecutions. 3.Criminals take advantage of gaps in prevention to commit fraud. a.Information sharing gaps in public-private cooperation hamper prevention. b.Criminals exploit the lack of awareness of victims. 1.3.1. Some crimes cannot be effectively investigated and prosecuted under the current legal framework a.Certain crimes cannot be prosecuted effectively because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised. The Framework Decision contains a definition of payment instrument (Art. 1(a)) that technological developments have rendered obsolete. The definition does not explicitly include non-corporeal payment instruments such as virtual currencies, e-money and mobile money, which are growing in importance as previously described and as stakeholders highlighted in the consultation. It could be understood that non-corporeal instruments are implicitly included in Art. 3 on offences related to computers, which requires Member States to sanction fraudulent forms of conduct relating to the use of computer data and computer programmes or systems. However, the Framework Decision does not include any definition of “computer data” or “computer programme/system”, and therefore it is not possible to clearly identify the types of payment instruments that are covered. For example, does “computer” include mobile devices? Does computer data relate only to data stored in computers or is data stored in ‘the cloud’ also covered? The lack of a definition of “computer data” or “computer programme/system” creates a grey area in a criminal law instrument, not properly covering behaviours that are gaining more and more importance through the increasing dematerialisation of payment instruments and the opportunities that Internet offers for payment transactions. Also, without a technology neutral definition, not only the payment instruments currently explicitly mentioned risk becoming obsolete (e.g. as eurocheques and eurocheque cards have already become) but also, if new payment instruments emerge in the future, it is unclear whether the Framework Decision would be able to cover them.

The Payment Services Directive (PSD2) contains a broader definition of payment instrument: “Payment instrument shall mean any personalised device(s) and/or set of procedures agreed between the payment service user and the payment service provider and used by the payment service user in order to initiate a payment order.” The formulation “set of procedures” covers non-corporeal payment instruments and in particular e-money. This definition includes most of the main non-cash means of payment, i.e. those covered by the Framework Decision plus e-money, mobile money, virtual cards, electronic ticket restaurants, virtual coupons and electronic wire transfers and direct debits. Since the Payment Services Directive is not a criminal law instrument, the fact that the definition in it covers a number of non-corporeal payment instruments does not imply that offences involving these instruments are criminalised. In addition, this definition is not entirely technology neutral as it does not cover those that do not initiate a payment order (e.g. fidelity/loyalty cards) and those that are not personalised (e.g. virtual currencies or some types of coupons). The Attacks Against Information Systems Directive (AAIS) is a criminal law directive which contains definitions of information system (a broader term than “computer”) and computer data: “(a) ‘information system’ means a device or group of inter-connected or related devices, one or more of which, pursuant to a programme, automatically processes computer data, as well as computer data stored, processed, retrieved or transmitted by that device or group of devices for the purposes of its or their operation, use, protection and maintenance; (b) ‘computer data’ means a representation of facts, information or concepts in a form suitable for processing in an information system, including a programme suitable for causing an information system to perform a function;” These definitions are general enough to encompass non-corporeal payment instruments. That said, this Directive focuses on criminalizing attacks against information systems, which is not necessarily the same as non-cash payment fraud, as we will see in more detail in the offences section below. For example, it criminalises the illegal access to information systems but only when a security measure has been infringed. A fraudster using legitimate (but stolen) credit card credentials to shop online would not necessarily infringe any security measures. The expert meetings and the consultation confirmed a gap in the current definitions as some payment instruments are not covered, considering it one of the most important obstacles to investigation and prosecution. In general, the lack of a technology neutral legal framework is a key factor behind the current regulatory failure that a potential initiative would need to address. b.Preparatory acts for non-cash payment fraud cannot be prosecuted effectively because they are criminalised differently in Member States or not criminalised. Using the taxonomy of non-cash payment fraud in section 1.2.3, based on figure 1, the stage of triggering the execution of payments by using payer information fraudulently includes two sets of behaviours: (i) preparatory acts, i.e. the collection (e.g. phishing, skimming), trade (e.g. carding websites), making available (e.g. dumping) and possession of payer information; (ii) the actual use of the payer information. The Framework Decision covers the use of the payer information to trigger the execution of the payment in Art. 3 (“… without right introducing, altering, deleting or suppressing computer data, in particular identification data”). However, the use of unlawfully appropriated computer data covered by Art. 3, is criminalised only when offences intentionally result in a transfer of monetary value. This means that preparatory acts that precede fraud without being directly linked to it are excluded from Art. 3. Moreover, Art. 4 covers the “fraudulent making, receiving, obtaining, sale or transfer to another person or the possession of computer programmes the purpose of which is the commission of any of the offences described under Art. 3.” This article also raises the issue of a lack of definition of a computer (programme). In addition, the use of these computer programmes is not explicitly mentioned and in some cases it may not be necessary to possess them to be able to use them (e.g. they might be used from the cloud). Art. 5 covers “attempt” but since it does not contain a definition of “attempt”, it is not possible to determine whether preparatory acts would be included. Experts from the Member States confirmed the need for a criminalisation at EU level of preparatory acts (in particular phishing), during the expert meetings. The Attacks Against Information Systems Directive criminalises the “intentional production, sale, procurement for use, import, distribution or otherwise making available… of… a computer password, access code, or similar data by which the whole or any part of an information system is capable of being accessed.”, with the intention to gain illegal access to information systems by infringing a security measure. As discussed earlier, a fraudster using legitimate (but stolen) credit card credentials to shop online would not necessarily infringe any security measures.

c.Cross-border investigations can be hampered because the same offences are sanctioned with different levels of penalties across Member States. The Framework Decision requires Member States to set up criminal penalties that are effective, proportionate and dissuasive, without specifying minimum levels. As a consequence, Member States have adopted different levels of penalties. Whereas all Member States include, at least for serious cases, penalties of imprisonment, these vary significantly. For example, figure 7 shows the variation in the level of maximum number of years of imprisonment for counterfeiting or falsification of payment instruments (Art. 2(b)): Figure 7: maximum penalties across Member States for Art. 2(b) offences Source: EY The Attacks Against Information Systems Directive determines maximum level of penalties of at least 2 years for the offences it contemplates (illegal access to information systems, illegal system interference, illegal data interference, illegal interception, offences related to tools for committing offences and inciting, aiding, abetting and attempt). It also determines maximum level of penalties for aggravating circumstances from at least 3 years to at least 5 years, depending on the situation. Directive 2015/849/EU on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (fourth Anti-Money Laundering Directive) defines a range of administrative sanctions and measures which can be imposed to obliged entities that do not comply with the preventative framework put in place by this Directive. There were different views expressed at the expert meetings concerning the need to have a certain level of penalties specified in EU legislation. Some experts saw value in having similar level of offences across the EU, to facilitate cross-border cooperation and ensure a minimum level of deterrence. Other experts questioned the deterrence effect of penalties versus other factors such as the likelihood of being arrested. They also questioned the “forum-shopping” effect, where criminals would tend to operate in countries with lower levels of penalties, by arguing that, if it were true, it would be happening already, but there is no evidence of that. They expressed preference for determining the sanctions based on the gravity of the crime, rather than to facilitate investigations (some investigative tools are only available to crimes that have a certain level of penalties, see the section on cross-border cooperation below). That said, there was a certain consensus of having a level of penalties set at EU level coherent with other EU instruments (e.g. Attacks Against Information Systems Directive, European Arrest Warrant…), as long as it was limited to serious offences. d.Deficiencies in allocating jurisdiction can hinder effective cross-border investigation and prosecution. The Framework Decision specified a limited set of situations in which a Member State could claim jurisdiction: when the offence was either committed in its territory, or abroad by one of its nationals (on condition of double criminality, i.e. provided that it was also an offence abroad) or for the benefit of a legal person stablished in its territory. The last two situations could be optional based on whether the Member State extradited its nationals, a possibility that the European Arrest Warrant has rendered partially obsolete (see extradition section below). The biggest challenge concerning jurisdiction in non-cash payments is the cross-border nature of the crime combined with the access to digital evidence, as non-cash payment fraud increasingly has a digital component. To give an idea of the complexity of the issue, please consider the case of Hans, a German national working and living in Poland, where he has his bank account. Unfortunately, while on vacation in Romania, his credit card details were stolen via skimming when he paid a taxi that was cooperating with an organized crime group. This group sold his credit card details to a carding website hosted in the Netherlands, where a Portuguese national bought his card details for just €20. He later used them from his apartment in Italy (or at least from an IP address that pointed to Italy but he might very well have used a VPN to connect from his summer house in the Portuguese Algarve), to buy goods online in a website hosted in France (but belonging to a multinational company based in Ireland) to be shipped from Spain to his cousin in Luxembourg. While this is a fictional case, representatives from law enforcement, the judiciary and the private sector described in the expert meetings similar situations, involving as many jurisdictions, to illustrate the challenges they face while investigating non-cash payment fraud. The main risk is that crimes might not be investigated because no country claims jurisdiction or that the lack of judicial cooperation makes the cross-border investigation process impossible in practice. The Framework Decision provides limited tools to address these challenges. For example, coming back to Hans, when he sees the illegal activity in his credit card and informs the Polish authorities, they would not be able to claim jurisdiction on the basis of the Framework Decision only (offence neither committed in its territory nor by one of its nationals not for the benefit of a legal person established in Poland). Overall, a majority of Member States (22) have extended their jurisdiction beyond the requirements of the Framework Decision in a variety of ways. As pointed out in the expert meetings, these differences in the implementation increase the complexity of the attribution of jurisdiction of cross-border offences, which may result in longer prosecution times and, in some cases, no prosecution at all. The Attacks Against Information Systems Directive includes broader jurisdiction rules than the Framework Decision, by, for example, eliminating the condition of double criminality and including situations in which the offender is physically present in the Member State, regardless of whether the information system attacked is in the same Member State, and vice versa, when the information system is in the Member State, regardless of where the offender is located. The Commission committed in 2016 to addressing the challenges for investigations in cyber-enabled crimes in its Communication on Delivering on the European Agenda on Security, aiming to propose solutions by the summer of 2017. In its Conclusions on improving criminal justice in cyberspace, adopted on 9 June 2016, the Council supported the Commission´s commitment and called on the Commission to take concrete actions based on a common EU approach to improve cooperation with service providers, make mutual legal assistance more efficient and to propose solutions to the problems of determining and enforcing jurisdiction in cyberspace.

The Commission conducted an expert consultation process and summarized its results in a non-paper, presented to the Council on June 8 2017, which may result in a legislative initiative. 1.3.2. Some crimes cannot be effectively investigated and prosecuted due to operational obstacles a.It can take too much time to provide information in cross-border cooperation requests, hampering investigation and prosecution. Stakeholders pointed out during the evaluation and consultation the fact that it takes a long time to receive the information requested from another Member State, when that information is received at all: 1)First, it takes time to set up the procedure to exchange the information between the Member States, in particular when this requires the authorisation of multiple authorities. 2)Second, it takes time for the Member State asking to understand what can be requested, and for the Member State asked what is being requested (including the urgency of the request), given the significant differences that still exist in their legislative frameworks, such as those concerning: ·Prescription periods, both in terms of duration and of the moment the period starts to count (e.g. when the offence is completed or when the victim discovers the fraud). The duration is usually linked to the severity of the maximum penalties, which, as discussed, vary significantly across Member States. ·Data retention rules, following the 2014 sentence of the Court of Justice of the European Union declaring invalid the Data Retention Directive, as well as data protection rules (to be harmonized with the new General Data Protection Regulation, which enters into force in May 2018, and the directive regulating the processing of personal data by authorities, which Member States have until May 2018 to transpose). ·Confiscation rules: while some Member States follow a “follow-the-money” approach and prioritise the asset recovery, other focus on tracking and retaining the perpetrator. 3)Last but not least, it takes time to produce the information requested: ·The information may not be ready available. When the information needs to be collected in the Member State, there can be coordination issues at the national level between law enforcement and judicial authorities for the exchange of information. If an investigation needs to be open to collect the information, a new set of issues appears, such as: §Lack of adequate investigative tools, in particular to investigate fraud with a cybercrime component (e.g. IT forensics, decryption, attribution). §Lack of skills in law enforcement and the judiciary to deal with non-cash payment fraud cases of certain technological sophistication. §Limited capacity of law enforcement, which causes other criminal offences to be prioritized over non-cash payment fraud (compared to other criminal offences, non-cash payment fraud is underreported, frequently involves a high volume of small financial losses, and has a relatively low level of penalties). Also, the lack of public-private sector cooperation can hinder the ability to collect information promptly. ·When the information involves non-EU countries, as is often the case in e.g. skimming and counterfeiting of credit cards, a new level of complication and delays is added. Stakeholders emphasized multiple times the important role that Europol plays in helping overcome each of these obstacles, setting up communication channels, helping understand the requests and supporting Member States with its analytical capabilities and technical expertise. The Framework Decision contains two articles focused on cross-border cooperation: Art. 11 (mutual assistance) and Art. 12 (exchange of information). Art. 12 requires Member States to designate operational contact points for the exchange of information. It does not specify who those contact points should be or how the network should work (e.g. service hours or maximum time to respond to requests).

The Attacks Against Information Systems Directive also contains provisions on exchange of information through a network of contact points, with additional requirements on service hours and maximum time to answer urgent requests of assistance. b.Under-reporting to law enforcement due to constraints in public-private cooperation hampers effective investigations and prosecutions. The Framework Decision does not include any provisions on public-private cooperation. Stakeholders that contributed to the consultation widely considered public-private cooperation an enabler to tackle non-cash payment fraud across all levers, from investigation and prosecution and assistance to victims to prevention, given that information concerning non-cash payment fraud is spread across multiple private sector actors. The evaluation and stakeholder consultation found that the main obstacles that prevent public-private cooperation from reaching its full potential relate to information sharing, both domestically and cross-border: ·Lack of clarity on the requirements on private sector to collect information (e.g. data protection and data retention rules), which may affect the admissibility of evidence in court. ·Limited implementation by payment service providers of systems to monitor, handle and follow up on general security incidents (e.g. data breaches) and security-related customer compliance, and to notify the competent authorities (e.g. law enforcement). However, it shall be taken into account that the new data protection legislation contains rules on personal data breaches. A specific case of information sharing is mandatory reporting to law enforcement, which contributes to gain a better understanding of the fraud case and therefore enables a better response and prevention: ·Reporting obligations for payment services providers exist in the Payment Services Directive (PSD2), in cases of major operational or security incidents, and in the fourth Anti Money Laundering Directive, for “obliged entities” (which include financial institutions), in case suspicious transactions are detected. ·A majority of Member States (16) make it mandatory to report to law enforcement whenever there are suspicions raised with regard to the commission of an offence relating to payment instruments, computers and/or specifically adapted devices. Under-reporting is common in non-cash payment fraud, due to: ·Poor information available to victims on the reporting systems in place, and the role of actors involved in their protection, which often differ from one Member State to another. ·The long-tail nature of non-cash payment fraud, a crime that typically affects a relatively large number of victims but each crime involves the loss of a relatively low value, which may discourage reporting (this allows fraudsters to draw less attention from users and payment service providers, which in turn encourages future fraud). ·Reputational concerns of businesses, for example to expose publicly that they have been victim of data breaches. ·The compensation to companies and individuals received by banks, which may cause that the victims abandon the proceedings as soon as the reimbursement has been received. ·Victims of fraud may blame themselves and/or fear that others will blame them for stupidity or even culpability. ·Limitations in current reporting systems (e.g. lack of reporting mechanisms for internet crimes, lack of feedback to victims that report, lack of reporting categories). 1.3.3. Criminals take advantage of gaps in prevention to commit fraud

a.Information sharing gaps in public-private cooperation hamper prevention. The information sharing gaps described above also affect public-private cooperation efforts on prevention. For example, stakeholders pointed out that limited information sharing between the private sector and public authorities prevents the early identification of new threats, which is critical to ensure effective prevention. b.Criminals exploit the lack of awareness of victims. Representatives from victims’ associations and other stakeholders pointed out that the lack of awareness of victims is a fundamental issue that drives non-cash payment fraud. All types of stakeholders (payers, enablers and payees) could benefit from awareness raising campaigns to avoid falling victim of non-cash payment fraud. Cybercrime in general seems to be less known than the “regular” crimes and in some cases, taken less seriously, which increases the chances of becoming a victim of it. To illustrate this, box 2 below describes how the lack of awareness of victims sustains the business model of phishing, a preparatory act for non-cash payment fraud: Box 2: the economies of phishing According to a study by Cisco, approximately eight people out of a million fall victim of phishing, with an average loss of $2,000 per victim. Fully automated phishing kits to send phishing messages to 500,000 e-mail addresses can be bought online for just $65. So, for only $130, criminals can generate $16,000, a 12,000% return on investment. This explains why as many as 36 billion phishing messages are sent annually. With more awareness from potential victims, the rate of people that would fall in the phishing trap would likely decrease. This driver focuses on prevention, which all types of stakeholders highlighted as an important area to be strengthened. Public-private cooperation can contribute to improving not only investigation and prosecution but also prevention. Therefore, the constraints to effective public-private cooperation appear in both drivers 2 and 3. As specified in annex 5 (evaluation), most of the problems identified above (all except the long time needed to provide information in cross-border cooperation requests) can be attributed to shortcomings in the current EU legal framework rather than to a lack of implementation of existing EU rules. The following problem tree summarizes the links between the drivers and the consequences of concern for the problem of non-cash payment fraud: Figure 8: problem tree for non-cash payment fraud

1.4.Who is affected and how To guide the mapping of the stakeholders affected by non-cash payment fraud we can use the overview of the basic parties involved in a payment described in section 1.2.1. and shown in figure 1: those who pay (payers), those who get paid (payees) and those who execute the payments (enablers). Payers The payer shares with the enabler the necessary information to authorize it to give the funds to the payee, who in return provides products or services to the payer. This information is therefore very valuable for criminals. When the payer is a natural person, this information contains personal data (e.g. name, date of birth, identity card number), as well as other information necessary to trigger the payment (e.g. PIN and other bank and security details for operating online services such as login name and password). Criminals steal this information in a variety of ways (e.g. skimming, shimming, phishing, data breaches). Payers are affected in two ways when criminals use this information to: 1)trigger fraudulent payments that entrain a financial loss for the payer, or 2)impersonate the victim and cause damage in multiple other forms, ranging from psychological and social distress to the various consequences of reputational damage (e.g. tangible ones like negative impact in credit rating history, criminal record or inclusion in defaulter lists, and intangible ones like damaged relationships). Enablers There are basically three types of enablers:

1.Financial institutions (e.g. a bank), which provide the monetary value. 2.Payment instruments (e.g. a credit card), which provide the vehicle to convey the monetary value. 3.Providers of other services related to the execution of the payment (e.g. enablers of a credit card transaction). The enablers are referred to as “payment service providers” in the Payment Services Directive (PSD2). Enablers suffer the consequences of fraud in two ways: through the loss of business opportunities due to lack of trust of the payers and through the direct losses caused by the fraud: 1)As described in the previous section, non-cash payment fraud reduces the trust of consumers, which may result in the unwillingness to use some payment services, in particular the digital ones. This results in lost business opportunities for the enablers offering those services. 2)When non-cash payment fraud occurs, there are direct economic costs. The PSD2 determines who bears these costs (i.e. the liability of the different actors), which, in most cases, is the enabler. In general, payment service providers bear the financial consequences which occur after the notification of lost, stolen or misappropriated payment instruments. Pursuant to article 70 of the PSD2, the payment service provider must ensure that appropriate means are available at all times, allowing the payment service user to notify the loss, theft or misappropriation of payment instruments. Card issuers are some of the enablers most affected by fraud. For example, when fraud takes place on less protected terminals in non-EU countries, most of the losses generated are on the card issuers’ side due to a lack of specific settlements and regulations on the refund of losses caused by less safe terminals. Credit card schemes (e.g. Visa, MasterCard) are also affected by fraud since they have to handle chargeback processes following fraudulent card transactions. PSD2 also requires that payment service providers refund the totality of the economic losses to the payer, as long as the payer did not act with negligence or fraudulently. Payees The payees, who get paid in exchange for a product or service, also suffer the consequences of non-cash payment fraud in two ways: through the loss of business opportunities due to lack of trust of the payers and through the direct losses caused by the fraud: 1)The payees (e.g. merchants) lose business opportunities when consumers are not willing to acquire their products and services due to lack of trust in the payment services. 2)Direct costs as a result of the fraud, e.g., when a service – such as a flight or train ticket – is provided against payment by credit card which is later blocked due to having been performed with stolen credentials. As indicated earlier, in the airline industry for example these costs are estimated at around USD 1 billion per year as a result of airline tickets purchased using compromised card data. Other industries affected include accommodation and other travel services (e.g. car rental), as discussed in section 1.4. In terms of liability rules set by the PSD2, the payee is held liable when it fails to accept strong customer authentication. Otherwise the payment service provider is the one liable. It is difficult to determine which of the groups of stakeholders above is most affected by non-cash payment fraud. Whereas the payment service providers (i.e. the enablers) bear most of the liability according to the PSD2, the payers such a Bulgarian citizen who loses more than two thirds of his monthly wage, or the payees such as the airline industry which loses more than USD 1 billion per year due to card fraud, are also significantly affected.

1.5.What is the EU dimension of the problem Non-cash payment fraud has a significant cross-border dimension, both within the EU and beyond. For example, with regard to card fraud, whereas only a fraction of the transactions (<10% in value) are cross-border (within and outside SEPA), they account for half of the total fraud. The disproportion is particularly significant for transactions acquired from outside SEPA (2% in value), which account for 22% of all fraud. In a typical skimming case, the credentials of a credit card can be stolen in a Member State, the counterfeit card can be created in another Member State and the cashing out with the counterfeit card can occur in a country outside the EU without the same security standards (in particular EMV). Box 3 illustrates this point with a concrete example: Box 3: the cross-border nature of non-cash payment fraud In 2013, criminals from 27 countries around the world worked together to steal more than $45 Million in cash from ATMs, using counterfeit cards. Criminals from Eastern Europe broke into the network of credit card processors in India and the United Arab Emirates, stealing prepaid card numbers and removing their withdrawal limits. They then used criminal networks to have counterfeited cards made with the stolen credentials and distributed the cards to hundreds of criminal groups around the world, who agreed on a date and time to hit simultaneously as many ATMs as possible. During the 10 hours that the joint robbery last, criminals carried out 36,000 ATM operations in 27 countries, walking away with over $45 Million in cash. In general, non-cash payment fraud has an increasing digital/online component, which reinforces its cross-border dimension. See annex 5 (evaluation of the existing policy/legal framework) for a detailed analysis of the existing cross-border challenges to tackle these crimes. 1.6.How would the problem evolve, all things being equal This section presents a series of quantitative estimates and qualitative considerations that describe how non-cash payment fraud could evolve in the coming years, all things being equal. These estimates and considerations inform the baseline policy option of doing nothing, which will be discussed in sections 4, 5 and 6. Quantitative estimates Since fraud data exists only for card fraud (the most important non-cash payment instrument in terms of number of transactions, see figure 3), the quantitative estimates will focus on it. As indicated in section 1.2.3. when assessing the magnitude of fraud, by considering only the available data of card fraud, the size of the problem is being underestimated. In the same way, by using this data to quantitatively develop the baseline scenario, it is likely that the forecasts underestimate the magnitude of the problem. As seen in section 1.2.3, the compounded annual growth rate of card fraud was 11% in terms of value and 20% in terms of number of transactions, over the 2011-2013 period. All things being equal, we could assume that these annual growth rates would continue in the coming years. If so, the value of card fraud would double by 2020 compared to 2013, with almost four times as many fraudulent transactions: Figure 9: estimated evolution of card fraud (2013-2020) Qualitative considerations The evolution of non-cash payment fraud is linked to the following factors: 1.Digitalisation of the economy. The exponential nature of the digital age not only brings exponential possibilities for economic growth but also for cybercrime, including those within non-cash payment fraud. The value of monetary damage caused by reported cybercrime is 50 times higher now than it was in 2001, when the Framework Decision was adopted, and is likely to continue growing.

All things being equal, cybercrime will continue to generate important economic benefits for criminals, which justify the enormous amount of R&D hours required to produce malware, the main tool to carry out cybercrime (every day, more than 300,000 new malware samples are detected). By 2020 it is expected that 50 billion new devices (cars, homes, medical devices, buildings, mobile phones, dishwashers, toys…) will be connected to the Internet. This “Internet of Things” will generate massive amounts of information about its users, part of which could be sensitive enough to be exploited by criminals to commit non-cash payment fraud. 2.Emergence of new payment instruments. The burst of innovation in the current technology revolution will likely continue developing new payment instruments to make the payment experience more convenient for users. Unfortunately, new payment instruments can also generate new opportunities for criminals. Furthermore, law enforcement may not be prepared to tackle them effectively (e.g. due to loopholes in the legal system or a lack of skills to deal with them). For example, new payment instruments could make use of biometrics as a way to identify the payer. Biometrics (e.g. fingerprints, palm prints, iris…), unlike passwords or credit card credentials, are permanent identification markers, so the consequences of them being stolen and misused can be more problematic for the victims. Other areas that could bring important innovations are artificial intelligence and robotics. These technologies have the potential to revolutionize the way non-cash payments are done by introducing increasing automation, governed by complex algorithms that could potentially be manipulated for fraudulent purposes. 3.Nature of the crime. As more and more countries join the technology revolution and more people around the world get connected to the Internet, the cross-border nature of non-cash payment fraud becomes even more relevant. Furthermore, Internet not only can provide training materials to commit fraud but also the necessary tools through the crime-as-a-service model. Box 4: carding websites as an example of crime-as-a-service Carding websites and the actors operating behind them generally work through defined schemes. Once the cards data have been stolen (e.g. through POS/ATM skimming or e-commerce/payment processors websites hacking), they are sold to brokers/resellers who typically purchase them in bulk. These subjects, in turn, sell cards data to the so-called “carders”, using marketplaces in the dark web. Carders usually purchase them paying with bitcoins. Cards can be chosen according to their original zip codes so that criminals can reduce the risk of raising suspicions of the issuing bank when cashing them out. Many websites offer guarantees of the validity of the card and provide valid replacements in case the card is blocked before the carder manages to cash it out. Cards data are then either loaded in pre-paid cards in order to purchase in stores specific gift cards (e.g. Amazon gift cards) or they are used to manufacture counterfeit credit cards. More people connected unfortunately also means more potential fraudsters that could take advantage of those training materials and tools, likely at a low risk, due to the challenges to cross-border investigation and prosecution common to cybercrimes in general (e.g. attribution, access to digital evidence, jurisdiction).

Some existing EU instruments currently under transposition by Member States could contribute to reduce non-cash payment fraud to some extent: ·The PSD2 (to be transposed by January 2018) could reduce fraud thanks to its strong customer authentication requirements for remote transactions. At the same time, PSD2 also aims to facilitate the entry of new payment providers, which could lead to new forms of fraud. ·The Directive on the freezing and confiscation of instrumentalities and proceeds of crime seeks to attack the financial incentive which drives crime, but aims mainly to ensure a minimum level of protection from criminal infiltration in the legal economy through the acquisition of assets and to facilitate the mutual recognition of freezing and confiscation orders in other Member States. This instrument alone would, however, not be sufficiently deterrent, as confiscation in general only occurs after a successful freezing of illicit assets following a conviction. Moreover, its deterrent effect will be limited if criminals are able to better hide their assets outside of the EU, resulting in a net capital flow of criminal money out of the EU. These instruments, however, do not fully address the problem drivers identified specific to non-cash payment fraud, such as the lack of criminalisation of certain behaviours, obstacles to effective investigation and prosecution or prevention issues linked to information sharing gaps in public-private cooperation and lack of awareness of victims. The baseline scenario would fall short in addressing concerns expressed by stakeholders, who indicated a strong consensus that the Framework Decision is not comprehensive, and that there are emerging trends that should be better covered. Also, a number of stakeholders (particularly private companies and trade, business or professional associations) agreed that it is necessary to have a more coherent level of penalties for offences related to non-cash means of payment across the EU. Most of them considered that different levels of penalties may result in different prioritisation of cases at national level, hampering cross-border cooperation and possibly creating “safe havens” for criminals. Stakeholders from the private sector (such as merchants and financial institutions) expressed frustration about the lack of legal certainty with regard to information sharing, which hampers cooperation with law enforcement authorities. The baseline scenario would leave this unchanged. In summary, non-cash payment fraud is likely to increase in value, volume and complexity, all things equal. 1.7.Evaluation of the existing policy framework The evaluation of the existing policy framework indicates that the Framework Decision is only partially relevant to the needs of stakeholders in the area of non-cash payment fraud. Specifically, the scope of the Framework Decision is no longer fully relevant in view of recent technological developments, and provisions on cross-border cooperation and exchange of information do not seem to be aligned with the increasing international dimension of the crime, where multiple parties around the world may be involved, including both criminals and victims. The results of the evaluation were identified as the problem drivers for non-cash payment fraud, presented in section 1.3. Please see annex 5 for more details on the evaluation. 2.WHY SHOULD THE EU ACT Legal basis The legal basis for EU action is Article 83(1) of the Treaty on the Functioning of the European Union: “The European Parliament and the Council may, by means of directives adopted in accordance with the ordinary legislative procedure, establish minimum rules concerning the definition of criminal offences and sanctions in the areas of particularly serious crime with a cross-border dimension resulting from the nature or impact of such offences or from a special need to combat them on a common basis. Article 83(1) explicitly mentions counterfeiting of means of payment, computer crime and organised crime as areas of particularly serious crimes with a cross-border dimension. As discussed in the problem analysis in section 1, counterfeiting of means of payment is one type of non-cash payment fraud. Section 1 also explained how non-cash payment fraud has an increasing digital dimension which falls under computer crime. Furthermore, section 1 also described how non-cash payment fraud is part of organised crime. Subsidiarity

Non-cash payment fraud has a very important cross-border dimension, both within the EU and beyond, as described in sections 1.3 (remember Hans’ case, where as many as 10 Member States could be involved) and 1.5 (remember the real 2013 case of counterfeiting cards affecting 27 countries). Also, increasingly, these crimes are moving entirely online. The objective of effectively combating such crimes therefore cannot be sufficiently achieved by Member States acting alone or in an uncoordinated way: ·As described in the previous section, these crimes create situations where the victim, the perpetrator and the evidence can all be under different national legal frameworks, within the EU and beyond. As a result, it can be very time consuming and challenging for single countries to effectively counter these criminal activities without common minimum rules. ·The need for EU action has already been acknowledged through the creation of the existing EU legislation on combating fraud and counterfeiting of non-cash means of payment (the Framework Decision). ·The need for EU intervention is also reflected in the current initiatives to coordinate Member States measures in this field at EU level, such as a dedicated Europol team working on payment fraud and the EMPACT Policy Cycle priority on operational cooperation against non-cash payment fraud. The added value of these initiatives in helping Member States combatting these crimes was acknowledged multiple times during the stakeholder consultation, in particular during the expert meetings. Another added value of EU action is to facilitate cooperation with non-EU countries, given that the international dimension of non-cash payment fraud frequently goes beyond EU borders. The existence of minimum common rules in the EU can also inspire effective legislative solutions in non-EU countries thereby facilitating cross-border cooperation globally. 3.WHAT SHOULD BE ACHIEVED This section identifies the general and strategic objectives for a possible EU intervention to address the gaps identified in section 1. 1.8.General policy objectives There are two general policy objectives, which describe the ultimately intended goals of a possible EU intervention (i.e. reducing the negative impact of the consequences of non-cash payment fraud identified in section 1.4): 1)Enhance security, the main general objective, by reducing the attractiveness (i.e. reduce gains, increase risk) for organized crime groups of non-cash payment fraud as a source of income and therefore as an enabler of other criminal activities, including terrorism. 2)Support the digital single market, by reducing the negative impact on economic activity that non-cash payment fraud causes to the different stakeholders (section 1.5). This includes both losses derived from the reduced trust of consumers and businesses in the payment processes as well as direct losses. These objectives are interrelated: ·Synergies: enhancing security would support the digital single market, as the economic losses caused by non-cash payment fraud would decrease. It would also reduce the risk of consumers and businesses of falling victim of fraud, increasing their trust and therefore economic activity. ·Trade-offs: enhancing security could entail additional costs and constraints to the digital single market. For example, the implementation of increased security in payment authentication systems could bring additional costs to businesses, which could have a negative impact in their operations, in particular for SMEs. In addition, consumers might actually be less willing to use payment services if they find the security measures too burdensome. 1.9.Specific policy objectives There are three specific policy objectives: 1)Ensure that a clear, robust and technology neutral policy/legal framework is in place. 2)Eliminate operational obstacles that hamper investigation and prosecution. 3)Enhance prevention. These objectives address the problem drivers identified in section 1.3:

Table 2: problem drivers, specific objectives and general objectives Problem drivers Specific objectives General objectives ðCertain crimes cannot be prosecuted effectively because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised 1)Ensure that a clear, robust and technology neutral policy/legal framework is in place 1)Enhance security 2)Support the digital single market ðPreparatory acts for non-cash payment fraud cannot be prosecuted effectively because they are criminalised differently in Member States or not criminalised ðCross-border investigations can be hampered because the same offences are sanctioned with different levels of penalties across Member States ðDeficiencies in allocating jurisdiction can hinder effective cross-border investigation and prosecution ðIt can take too much time to provide information in cross-border cooperation requests, hampering investigation and prosecution 2)Eliminate operational obstacles that hamper investigation and prosecution 3) ðUnder-reporting to law enforcement due to constraints in public-private cooperation hampers effective investigations and prosecutions 4) 5) ðInformation sharing gaps in public-private cooperation hamper prevention 6)Enhance prevention 7) ðCriminals exploit the lack of awareness of victims 8) 9) These objectives will be monitored through a series of indicators described in section 7, which also specifies possible data sources, whether the information is already being collected and the actors responsible for collecting it. 1.10.Consistency with other EU policies and objectives The general and specific objectives identified are consistent and complementary with those of other EU policies and legislation: The Treaties The previously mentioned objectives are consistent with: ·the Treaty on European Union, which, on Article 3.2, establishes that "the Union shall offer its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of people is ensured in conjunction with appropriate measures with respect to external border controls, asylum, immigration and the prevention and combating of crime." ·the Treaty on the Functioning of the European Union, which, on Article 67.3 establishes that the Union should "endeavour to ensure a high level of security through measures to prevent and combat crime, […], and through measures for coordination and cooperation between police and judicial authorities and other competent authorities, as well as through the mutual recognition of judgments in criminal matters and, if necessary, through the approximation of criminal laws". The Charter of Fundamental Rights of the European Union The objectives of a possible initiative would be consistent with the Charter of Fundamental Rights, in particular: ·Right to liberty and security (Article 6 of the Charter), as this would be the main objective of the initiative; ·Protection of personal data (Article 8), with which potential provisions on exchange of information, etc… should comply; ·Freedom to conduct a business (Article 16), since the initiative would aim to enhance protection of businesses bearing the consequences of fraud; ·Consumer protection (Article 38) and right to an effective remedy and to a fair trial (Article 47), since the initiative would aim to enhance protection of and assistance to consumers that become victims of fraud. Security and Digital Single Market strategies

The main general objective, enhancing security, is at the core of the EU Agenda on Security and the EU Cybersecurity Strategy: ·The EU Agenda on Security sets out the principles for EU action to respond effectively to security threats by 1) preventing terrorism and countering radicalisation; 2) fighting organised crime; 3) fighting cybercrime. One of the actions described for the period 2015-2020 is “reviewing and possibly extending legislation on combating non-cash fraud and counterfeiting by including new forms of crime against financial instruments". In the 6th progress report towards an effective and genuine Security Union , the European Commission confirms that, "concerning payment card fraud, it is necessary to widen existing law enforcement cooperation to a broader range of criminal activities which target non-cash means of payments." The 7th progress report highlights a number of legislative and non-legislative initiatives in the field of crime prevention, which could contribute to the objectives of a possible EU action, such as: oincreasing the role of Europol as an EU hub for information exchange on serious cross-border crime, in order to become more effective, efficient and accountable; obuilding Member States' capacities for cybercrime resilience and implementing the Network Information Security (NIS) Directive; oimproving the access to electronic evidence to investigators in cross-border cases. In March 2017, the Council decided to continue the EU Policy Cycle for organised and serious international crime for the period 2018-2021, based on the 2017 EU Serious and Organised Crime Threat Assessment "Crime in the Age of Technology" (SOCTA 2017) . The SOCTA 2017 provides an overview of the most important criminal threats in the EU, which should be tackled as priorities, and which include payment card fraud. ·The EU Cybersecurity Strategy aims at creating the world’s most secure online environment in the EU, including for online payment transactions, an aim which is fully aligned with the main general objective of enhancing security. ·The Digital Single Market Strategy identifies existing key challenges that need to be overcome to ensure better access to digital goods and services across Europe. These challenges include providing adequate protection to consumers and businesses’ assets and tackling cybercrime through the adoption and implementation of a strong and effective legislation. The general objective of supporting the digital single market is obviously aligned with this Strategy. EU legislative context As described in section 1.1. (policy context), various EU legislative acts have been adopted since the Framework Decision entered into force, both in criminal and civil law. The general and specific objectives of a possible new EU action on combatting non-cash payment fraud would be consistent with these legislative acts: 1.Pan-European cooperation mechanisms in criminal matters that facilitate coordination of investigation and prosecution (procedural criminal law): ·Council Framework Decision 2002/584/JHA on the European Arrest Warrant and the surrender procedures between Member States; ·Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union; ·Directive 2014/41/EU regarding the European Investigation Order in criminal matters; ·Council Framework Decision 2005/214/JHA on the application of the principle of mutual recognition to financial penalties;

·Council Framework Decision 2009/948/JHA on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings; ·Council Framework Decision 2009/315/JHA on the organisation and content of the exchange of information extracted from the criminal record between Member States; ·Directive 2012/29/EU establishing minimum standards on the rights, support and protection of victims of crime; ·Council conclusions on improving criminal justice in cyberspace; ·Regulation (EU) 2016/794 on Europol; ·Council Decision 2002/187/JHA setting up Eurojust. The general and specific objectives are fully aligned with those of these legislative acts. As a principle, the potential new intervention would not introduce provisions specific to non-cash payment fraud that would deviate from these horizontal instruments, to avoid fragmentation which could complicate the transposition and implementation by Member States. The only possible exception could be the support and protection of victims, which the proposed EU action could complement. Directive 2012/29/EU establishes minimum standards, which could be completed for the area of non-cash payment fraud, if needed. For example, this Directive only covers natural person, whereas legal persons can also become victims of non-cash payment fraud, as discussed in section 1.4 (who is affected and how). Also, this Directive focuses on providing assistance in the context of criminal proceedings. A new initiative would aim at providing assistance to victims outside the criminal proceeding (for instance as regards to consequences relating to identity theft). In the case of the European Arrest Warrant and the European Investigation Order, the new initiative would also be consistent with both, by setting up an appropriate level of minimum maximum sanctions that reflects the gravity of the crime and therefore ensures that the EAW and is applicable and the EIO can be recognised and executed for the defined offences. 2.Legal acts that criminalise conduct related to fraud and counterfeiting of non-cash means of payment (substantive criminal law): ·Directive 2013/40/EU on attacks against information systems: oA new initiative would be complementary to Directive 2013/40, by addressing a different aspect of cybercrime. The two instruments would correspond to different sets of provisions of the Council of Europe Budapest Convention on Cybercrime, which represents the international legal framework of reference for the EU. oThe initiative would also be consistent with Directive 2013/40, as it would be based on the same approach regarding specific issues (e.g. defining minimum maximum levels of penalties, jurisdiction). ·Directive 2014/62/EU on the protection of the euro and other currencies against counterfeiting by criminal law: oA new initiative would be complementary to Directive 2014/62/EU as it would cover counterfeiting of non-cash payment instruments, while Directive 2014/62/EU covers the counterfeiting of cash. oIt would also be consistent with Directive 2014/62/EU, as it would use the same approach on some provisions such as on investigative tools. ·Directive 2017/541/EU on combating terrorism: oA new initiative would be complementary to Directive 2017/541/EU, as it would aim to reduce the overall amount of funds derived from non-cash payment fraud, most of which go to organized crime groups to commit serious crimes, including terrorism. ·The Proposal for a Directive on countering money laundering by criminal law:

oThe new initiative and the proposal for a Directive on countering money laundering by criminal law are complementary as the latter provides the necessary legal framework to counter the laundering of criminal proceeds generated by non-cash payment fraud ("money mules") as a predicate offence. 3.Legal acts that regulate the payment process, in particular to facilitate secure payments across the EU: ·Revised Payment Services Directive (PSD2): oA new initiative on non-cash payment fraud would be complementary to PSD2, as it would aim at reducing crime, while PSD2 enhances payments security. Also, it would enable public-private cooperation and enhance reporting to law enforcement authorities, which would complement statistical data provided under the PSD2. ·Directive 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, (the fourth Anti-Money Laundering Directive): oA new initiative would be complementary to Directive 2015/849, as it would address the situation where the non-cash payment instruments have been, for instance, unlawfully appropriated, counterfeited or falsified by the criminals, whereas Directive 2015/849 covers the situation where criminals abuse non-cash payment instruments with a view to concealing their activities. ·Proposal for a Directive amending Directive 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing: oA new initiative would be consistent with the proposal for a Directive amending Directive 2015/849 as it incorporates the same definition of virtual currencies. If this definition changes during the adoption process, the definition in the new initiative should be aligned accordingly. ·Regulation (EU) 2015/847 on information accompanying transfers of funds, regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market and Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive): oA new initiative on non-cash payment fraud would be complementary to these legislative acts, as it would aim at reducing crime, while these acts enhance payments security. In addition to the above legislative acts, the new initiative would be coherent with the General Data Protection Regulation and the Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data: ·The new data protection legislation modernises the already existing rules on security of personal data. In addition, the new legislation (GDPR) imposes an obligation of a notification of personal data breaches to the national data protection supervisory authorities and to the data subject in certain circumstances. Non-compliance with such rules will be subject to administrative fines. ·A new initiative on non-cash payment fraud would be in compliance with the GDPR and Directive (EU) 2016/680, as it would: opursue the objective of greater protection of personal data (credit card number shall be considered as personal data and, credit card also contains other personal data such as the name of a citizen). oleave to Member States to take the necessary measures to favour public-private cooperation, including exchange of information, while providing for these measures to be in compliance with the GDPR. 4.WHAT ARE THE VARIOUS OPTIONS TO ACHIEVE THE OBJECTIVES This section addresses the possible policy options for achieving the objectives defined in section 3 and tackling the problems identified in section 1. Each policy option is made of a group of policy measures. The following process was applied to determine the policy options: 1)mapping of policy measures,

2)analysis of policy measures: identify which policy measures to retain and which to discard, 3)formation of policy options: combine retained policy measures into groups to form the policy options. The options are cumulative (i.e. increasing level of EU legislative action), as it will be detailed in section 4.3. 1.1.Mapping of policy measures Three broad possibilities were considered in the analysis: do nothing, do not legislate (i.e. support through non-legislative tools) or legislate. Figure 10 maps the policy measures (1 to 14) for each of these possibilities and the policy options (A to D) in which the measures could be grouped: Options Measures Figure 10: mapping of policy measures and policy options B ✔ ✔ ✔ ✔ ✔ C ✔ ✔ ✔ ✔ ✔ ✔ D ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ 1.2.Analysis of policy measures 1.2.1.Policy measures retained The policies measures retained are those that provide the alternatives that are most feasible (legally, technically and politically), coherent with other EU instruments, effective, relevant and proportional to tackle the problem drivers detected in section 1: Table 3: problem drivers identified and corresponding policy measures retained Problem drivers Policy measures retained Certain crimes cannot be prosecuted effectively because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised. 1, 3 Preparatory acts for non-cash payment fraud cannot be prosecuted effectively because they are criminalised differently in Member States or not criminalised. 1, 5, 11 Cross-border investigations can be hampered because the same offences are sanctioned with different levels of penalties across Member States. 1, 5 Deficiencies in allocating jurisdiction can hinder effective cross-border investigation and prosecution. 1, 7, 8, 9 It can take too much time to provide information in cross-border cooperation requests, hampering investigation and prosecution and assistance to victims. 1, 12 Under-reporting to law enforcement due to information sharing gaps in public-private cooperation hampers investigations and assistance to victims. 2, 14 Criminals exploit the lack of awareness of victims. 1, 14 1.2.2.Policy measures discarded ·Possible solution to the problem of certain crimes not being effectively prosecuted because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised. Policy measure 4 considers adding detailed definitions with a comprehensive list of payment instruments and forms of crime. Compared to policy measure 3 (technology-neutral definitions), this measure would be less effective in covering non-cash payment instruments and crimes that could arise in the next years, with the risk of becoming outdated in a short time. Furthermore, it would create issues of consistency with the existing EU legal framework, especially with the definition of payment instruments included in the Payment Services Directive. This would also lead to significant administrative costs in transposing the specific definitions at national level, since most of the Member States have already adopted the definition in the Payment Services Directive. ·Possible solution to the problem of preparatory acts not being effectively prosecuted because they are criminalised differently in Member States or not criminalised. Policy measure 6 considers including preparatory acts as an aggravating circumstance to sanctions, and sets minimum level of maximum penalties for the criminalised offences.

Compared to measure 5 of criminalising preparatory acts, this measure could entail less administrative and financial costs for law enforcement, especially in Member States that apply the principle of legality, because preparatory or supportive activities would be investigated and taken into account as an aggravating circumstance to sanctions only if the fraud actually occurred. For the same reason, however, it would be much less effective in preventing and fighting the different forms of non-cash payment fraud, since law enforcement would act only after the actual fraud occurred. ·Possible solution to the problem of victims not always receiving adequate assistance. Policy measure 10 considers adding new provisions protecting natural persons from identity theft, in coherence with the Victims' Directive. Compared to measure 11 of adding new provisions protecting natural and legal persons, this measure only covers a limited group of victims. In particular, it leaves out SME’s, which, by lacking the resources of larger companies, are more vulnerable to fraud and its negative consequences. Although this option would entail less administrative and financial costs for law enforcement and Member States, these costs would likely be outweighed by the negative impact on consumption and trade flows that lower trust in non-cash payment transactions brings if an important group of victims remains not properly covered. ·Possible solution to the problem of under-reporting to law enforcement. Policy measure 13 considers including provisions on mandatory reporting to law-enforcement. Compared to measure 14 on encouraging reporting, mandatory reporting could be more effective in increasing the chances of detecting, prosecuting and sanctioning perpetrators, since a much higher number of cases would be reported to law enforcement and more information would be available for investigations. However, these benefits are likely to be outweighed by the dramatic increase of the administrative and financial costs borne by law enforcement agencies to be able to deal with the dramatic increase in the volume of information (not all of which would be useful), especially in those Member States applying the principle of legality. The private sector would also incur in important administrative costs to put in place the mechanisms for systematic reporting. Encouraging reporting is likely to be a proportionate measure that could generate more positive results in practice. In addition to these measures discarded during the analysis, some other alternatives were early discarded: ·Full harmonisation of level of penalties (minimum and maximum levels). This alternative is not feasible in EU criminal law, which can only introduce minimum rules on sanctions. ·Creating an EU database on fraud data. This idea seemed attractive in theory as a possible way for private sector to cooperate with law enforcement and facilitate investigations. However, there would be many different technical and legal challenges for the creation of such database (e.g. data protection/retention issues, etc). 1.3.Policy options The retained policy measures were grouped in different ways to form the policy options. The basic criterion to form a policy option was that it should tackle all the problems detected in the evaluation. After trying multiple combinations of the retained measures, with alternative policy approaches and alternative policy instruments (e.g. self-regulation, non-regulation, regulation), and taking into account the input from stakeholders (e.g. with regard to the importance of jurisdiction), four policy options were selected for further analysis. The options are cumulative, i.e. with an increasing level of EU legislative action. Given that the issue at hand is basically a regulatory failure, it is important to lay out the full range of regulatory tools to determine the most proportionate EU response. The table below shows the intervention by summarizing how each of the policy options tackle all the problems detected and help achieve the specific objectives:

Table 4: problem drivers, specific objectives and options (intervention logic) Problem drivers Specific objectives Options A B C D ðCertain crimes cannot be prosecuted effectively because offences committed with certain payment instruments (in particular non-corporeal) are criminalised differently in Member States or not criminalised. 1)Ensure that a clear, robust and technology neutral policy/legal framework is in