WRITTEN QUESTION E-1116/02 by Astrid Thors (ELDR) to the Commission. Credit card fraud in e-commerce in Europe.
Date: 2002-04-18
Institutions: European Parliament, Provisional data
Subjects: computer crime, data protection, electronic commerce, electronic money, fraud, statistics

6.3.2004

EN

Official Journal of the European Union

C 58 E/5

(2004/C 58 E/005)

WRITTEN QUESTION E-1116/02

by Astrid Thors (ELDR) to the Commission

(18 April 2002)

Subject: Credit card fraud in e-commerce in Europe

Credit card fraud reportedly caused losses in 2001 of over EUR 900 million in Internet trading in the USA,
i.e. the equivalent of 1,14 % of online shopping turnover. The methods of committing the fraud vary;
bogus services and shopping sites are set up, databases are hacked into and information on sales vouchers
exploited. The Nordea Bank’s warning to its customers not to use Mastercard for online purchases also
attracted much attention. One of the reasons for the warning is that hackers in the USA have gained access
to servers on which customers’ credit card data is stored.

Does the Commission have an idea of the amount of losses caused by credit card fraud in Europe? What
further measures does the Commission intend to take to increase security? Has Cybercrime Forum looked
into this matter?

Answer given by Mr Bolkestein on behalf of the Commission

(20 June 2002)

The Commission does not have precise statistics on the current level of credit card fraud on e-commerce
transactions in the Union.

The Commission Fraud Prevention Action Plan (1) states that the proceeds from all types of payment card
fraud were estimated at EUR 600 million in the Union in 2000 (which roughly corresponds to 0,07 % of
the payment cards turnover in the Union in that year). The main types of fraud were by far the use of
counterfeit, lost or stolen credit cards at shops or automated teller machine (ATMs). Credit card fraud on e-
commerce transactions only accounted for a little percentage of the above amount.

Credit card details may be obtained by criminals in many ways, including by hacking into databases.
The Commission does not have precise statistics on the overall scale of illegal access to information
systems. Because of limited awareness and experience among system administrators and users, many
intrusions are not detected. In addition, many companies are not willing to report cases of computer
abuse, to avoid bad publicity and exposure to future attacks. For this reason, the number of intrusions that
are detected and reported almost certainly under-represents the full extent of the problem. Many police
forces do not yet keep statistics on the use of computers and communication systems involved in these
crimes. However, these problems have diminished over the last two to three years, and the gathering of
statistics on illegal access to information systems is gradually improving.

The Commission is taking action to increase the security of payment transactions online. Improvements in
security are the main priority of the Fraud Prevention Action Plan which aims to facilitate the introduction
of the highest economically viable level of security for payment instruments and systems, especially online
payments. The Plan is based on a partnership among all stakeholders to prevent fraud and counterfeiting
of non-cash payments. It provides for five main areas (Security of payments; exchange of information;
cooperation, training and educational material; other specific fraud prevention measures; and cooperation
with third countries) and 11 main actions that the Commission and other parties should undertake,
including specific actions to improve the security of payment products and systems.

Discussions on security issues take place regularly at the meetings of the Union Fraud Prevention Experts
Group, the steering group for the implementation of the Fraud Prevention Action Plan. These discussions
also cover preventative measures such as minimum security requirements for online merchants accepting
payment cards.

C 58 E/6

Official Journal of the European Union

EN

6.3.2004

The Commission recently launched a study which aims to provide an objective assessment of the security
of remote electronic payments (eg fund transfers, remote payment by card and mobile payments) in the
Internal Market, with a view to possibly enhance consumer confidence in e-commerce. The call for tender
for this study was published in January 2002. The tender procedure has been completed and the study will
be committed soon. Final results are expected by the end of 2002.

Also, based on the results of the study, the Commission will organise early in 2003 a Conference on the
security of payments in the Internal Market, with a view to improve information on the security of
modern payment products and systems in the Internal Market.

In addition to the Framework Decision of 28 May 2001 combating fraud and counterfeiting of non-cash
means of payment (2), action to increase Internet security has also been undertaken. On 19 April 2002 the
Commission proposed a Framework Decision on attacks against information systems (3). This Framework
Decision addresses the new most significant
forms of criminal activity against information systems,
including illegal access to information systems. The Framework Decision encourages and promotes
information security, while ensuring that Europe’s law enforcement authorities can take action against this
new form of crime.

The Cybercrime Forum has not discussed issues specifically related to credit card fraud, but held extensive
discussions on the problem of illegal access to information systems, which resulted in the proposal for the
Framework Decision mentioned above.

(1) Communication from the Commission ‘Preventing fraud and counterfeiting of non-cash means of payment’,

COM(2001) 11 final, of 9.2.2001.

(2) OJ L 149, 2.6.2001.
(3) COM(2002) 173 final.

(2004/C 58 E/006)

WRITTEN QUESTION E-1220/02

by Daniela Raschhofer (NI) to the Commission

Subject: Management of the Erasmus and Socrates programmes

(29 April 2002)

Complaints about the management of the Erasmus/Socrates mobility programme have increased recently.
Particularly the local management of
the programmes gives rise to organisational problems, and
uncertainties over whether exams will be recognised are also common.

Are there detailed rules stipulating which exams can be taken abroad for each subject, and which exams
must be recognised by the home university?

Are decisions made in advance on which exams will be recognised? Who decides what is recognised, and
which criteria are used?

Which exams can for example be recognised when an Austrian law student participates in an Erasmus/
Socrates programme in Spain?

How does the European Union monitor the use of funding in this area, and is there a report on the
subject? If so, which criteria are monitored, and where is the report to be found?

Answer given by Mrs Reding on behalf of the Commission

(6 June 2002)

It is true that there have been recognition problems for students participating in Erasmus all the years that
Erasmus has existed, in spite of the fact that recognition of period of studies is a prerequisite for the
exchange. The European Credit Transfer System (ECTS) has helped a great deal but problems still remain.