What You Should Know About ATM Card Skimming

How many times have you heard someone say “I never buy anything online?  There’s too much identity theft on the Internet.”? Well, next time someone says that to you, you might want to tell him that he should be safe if he is doing business on a secure website, one whose URL begins with https If there is that s on the end he can be pretty comfortable that he is giving his credit card information to a secure site. 

Then ask him how comfortable he is swiping his debit card at the ATM. If he says "very”, tell him that according to the Secret Service, there were 350,000 cases of ATM fraud in 2008.That sounds like a lot, doesn't it? But wait, I left out two important words – a day. That’s right 350,000 cases a day and, 66% of the instances involved a practice known as card skimming.

Card Skimming

Card skimming is the process where the account information stored on the magnetic stripe of an ATM debit card is illegally copied while the rightful owner is using an ATM machine. The PIN number is obtained at the same time. The account information is then copied to a blank card and the cloned card is used along with the stolen PIN to withdraw money from the victim’s account and/or make unauthorized purchases. Creative skimmers devised a scheme to upload the information onto blank gift cards so as to avoid merchant suspicion.

The cost of card skimming is not confined to cardholders. The Secret Service, in another report estimates banks lose over $1 billion dollars annually to ATM skimming. And the problem is growing; the number of cases banks reported to the Secret Service from 2008 to 2010 grew by 10% a year. And if you combine ATM skimming with the skimming of credit cards at points of purchase, the Secret Service estimates that card fraud costs individuals and businesses over $8 billion annually.

At the ATM

In preparation, a skimming criminal needs to install two pieces of equipment at the ATM site:

·         a card skimmer

·         a pinhole camera

Card Skimmer

Card skimmers are sophisticated scanners that contain a magnetic stripe reader to extract the information stored on the stripe each time an unsuspecting cardholder swipes his card.  Some skimmers can hold as many as 2,000 swipes.

By the very nature of the beast, a skimmer must blend in with the legitimate card scanner. Most are made of molded plastic or metal manufactured to the same texture and color as the sponsoring bank’s decor, and placed over the bank’s equipment at the mouth of the card slot. There is a whole international Internet community devoted to counterfeit equipment bearing the logo of major ATM manufacturers like Diebold and NCR.

Most skimmers incorporate flash memory to store the stolen data. And here’s where the criminals get even more inventive. Rather than risk coming back to retrieve the memory, some have installed a 3G transmitter to relay the information over a cellular network in batches  Others send an SMS text to the criminal’s cellphone to notify him each time a card is swiped.  Keeping up with technology, some crooks are using blue-tooth- enabled skimmers to download the account info in real-time. And in order to avoid a worst case scenario, some have gone as far as equipping their skimmers with an alarm that can alert them if the device is removed so they can download the information immediately.

PIN-Purloining Pinhole Cameras

Account information without a personal identification number (PIN) is of no use to skimming criminals since there would be no way to access the account.  So they have installed covert cameras to hover over the ATM’s  keypad to capture the PIN as the cardholder enters it.

Since the key here is to make the cameras invisible, the smallest of pinhole cameras are the instruments of choice. Some are embedded in false overlays made to blend in with the ATM’s structure. If there is a brochure rack or deposit slips adjacent to the ATM, all the better as it makes for a convenient hiding spot. Sophisticated crooks use cameras attached to the skimmer allowing it to be activated each time a card is swiped.

Keypad Overlay

Another method of stealing a PIN is to attach a keypad overlay. The overlay itself is very thin and similar in feel to the keys and fits inside a dummy metal frame custom made for the ATM model. When a cardholder types in her PIN, the fake key depresses the real key and the ATM responds as usual. The only difference is that each key press has been stored on a local memory chip along with a time stamp.

$$$ - Bank Theft vs Card Skimmers

Although the general public is accustomed to hearing of bank robberies on the news or watching movies centered around them, card-skimming is relatively unknown.  Yet it dwarfs robbery in loss. The American Bankers Association puts the average amount yielded to a bank robber at $5,000, in what is usually a one-time occurrence.
Card-skimming, on the other hand is clandestine and accumulative.  Once installed, a skimmer will stay in place until it is physically detected or until a bank traces customers reports of criminal activity and traces it back to a particular ATM.  According to the same ABA spokesman, one skimmer can net a criminal an average of $50,000.

Surveillance Measures:  IP Cameras vs. Analog

So what can banks do? Faced with the fact that a skilled criminal can attach a skimmer in the time that it takes to make a withdrawal, banks are installing surveillance cameras in their lobbies and standalone ATM kiosks in hopes of catching him in the act. However if a bank installs analog cameras, the resolution of the resulting video can lack sufficient clarity for positive identification .

Using a high resolution IP camera would definitely improve the chances of a positive identification that would hold up in court.

Forensic analysis can be slow, difficult and costly when the camera is analog since the recorded video is stored on site to a local DVR. Remember – analog cameras are shackled by coaxial cable so a trip to remote locations must be made to retrieve needed footage.

But switch to an IP camera and the stored video is  easily accessible and can ready to share due to its being network attached.

Now that we know about card-skimming, our next post will explore an IP camera solution that can attack the growing problem.

Personal Precautions

Meanwhile, here are some tips to keep you from becoming a victim of skimming.

•         Do not use an ATM if there is any extraneous equipment nearby or it somehow looks different.
•          Before fully inserting your ATM card, wiggle the entry point to see if it’s been tampered with.
•          Cover your hand and the keypad when entering your PIN.
•          Immediately eject your card if the keys are not concave or feel stiff.
•          Do not use if people are hanging around.
•          Monitor your account online daily and your bank statements monthly

And to sum it all up - Be Suspicious.

If you'd like more information about IP cameras, you can visit http://www.kintronics.com/neteye/neteye.html  or call Kintronics at 914-944-3425 to speak to a sales engineer. Or if you prefer,just fill out an information request form.