EN Official Journal of the European Union CE 84/789

(2004/C 84 E/0886)

WRITTEN QUESTION E-0418/04

by Gerhard Schmid (PSE) to the Commission

(17 February 2004)

Subject: Security of EC cards

Fraud involving cash dispensers in the EU is on the increase. There have been a number of cases recently where data from EC cards has been transmitted from a cash dispenser set up specially for this purpose and copied onto new cards. Only German EC cards contain extra built-in security features preventing this kind of abuse. The replacement of magnetic strip cards with chip cards will take some time to complete.

Is the Commission planning to draw up measures to introduce such security features throughout the internal market?

Answer given by Mr Bolkestein on behalf of the Commission

(5 April 2004)

The Commission is aware of the various techniques used by criminals to collect card data from automated teller machines (ATMs) in the EU. These techniques include the setting up of fake ATMs or alterations to genuine ATMs with the specific purpose of copying data from the magnetic stripe of Community cards. After copying the magnetic stripe and capturing the PIN code, criminals generally transfer the data obtained onto blank cards (‘white plastic’), which are fraudulently used mostly in unattended ATMs or terminals.

According to the information received by the Commission, the security features described by the Honourable Member can prevent this kind of abuse and have been in place already for many years in Germany. They consist of a modification in the magnetic stripe of the card and an additional device to be installed in the ATM. To the Commission's knowledge, such a solution is, for the time being, used only on cards issued by German banks and only in order to perform cash withdrawals at ATMs located in Germany. Such security features cannot be detected by terminals (POS) located in German shops or other merchant terminals (e.g. petrol stations or vending machines).

The EU banking industry has analysed this technology in detail. Their conclusion was that it is technologically less advanced than the chip, and therefore was not retained as their preferred solution. Instead, the EU payment card schemes and banks committed to introducing chip cards in all Member States by 2005 in order to prevent fraud with counterfeit cards. When new POS terminals and ATMs capable of reading chip cards will be installed in all Member States, the criminal modus operandi described above will no longer be possible.

It is possible that in some countries the migration to chip cards will take more time to complete, given the current level of progress, the number of cards to be re-issued and the ATMs and POS terminals to be replaced or modified. However, even in this case, banks are reluctant to introduce throughout the Internal Market the security features existing on German cards and ATMs as an interim solution. In fact, such features would require yet another adaptation of ATMs and replacement of cards, which would add further costs to the migration to the chip and is likely to slow it down further.

For these reasons the Commission is not planning measures to introduce the security features used in Germany. Instead, the Commission's objective is to ensure that the deployment of chip cards and terminals in the EU takes place as soon as possible. In 2004 the Commission intends to issue a Report to the Parliament and the Council on the EU Fraud Prevention Action Plan 2001-2003. The Commission also supports projects on solutions using chip cards for authentication purposes under the Information Society Technologies (IST) Research Programme.

Rather than mandating detailed security features, the role of the Commission is to create strong incentives for payment providers to implement such features, if necessary by setting liability rules. Currently there is an increasing number of cases where cards are counterfeited and the PIN code is captured using electronic devices. The Commission will examine these issues in the context of its forthcoming proposal on a New Legal Framework for Payments in the Internal Market.