Card 'skimmers' becoming more sophisticated in stealing account information
An image provided by the U.S. Secret Service shows a "skimmer" (circled portion) placed over a card reader in an ATM.
An image provided by the U.S. Secret Service shows an untampered ATM card reader.
Share with others:
In nature, skimmers are graceful seabirds that fly close to the water, skimming the surface with their open bills to ambush their prey.
In the financial world, skimmers are devices that thieves attach to card readers at ATMs or gas pumps to steal account numbers from debit and credit cards.
While not as lethal as the seabirds, they are just as stealthy.
"In almost all cases, your transaction will go through," said Eric Zahren, special agent in charge at the Pittsburgh field office for the U.S. Secret Service. "Everything will seem fine, but that doesn't mean your data wasn't stolen."
Criminals use the data from the magnetic stripe, along with personal identification numbers captured by tiny hidden cameras, to make counterfeit cards and drain people's accounts or run up big credit card bills.
It's a growing problem aided by increasingly sophisticated equipment that thieves place over legitimate card readers making it hard for customers to detect any tampering.
"It's a crime that's on the upswing nationally, and we've seen our share here in the Pittsburgh region," Mr. Zahren said.
Big payoffs are the main attraction. While bank heists net an average of $3,000 to $4,000, a single card skimmer averages 10 times that amount, or some $30,000 to $40,000, said Doug Johnson, vice president of risk management policy at the American Bankers Association in Washington, D.C.
The pirated card data are stored on the skimmers, which thieves later retrieve, or it's transmitted wirelessly to another location.
The devices are custom made to match individual machines so they are virtually undetectable.
"They look like they are part of the machine," Mr. Johnson said.
Automated teller machines and gas pumps are favorite spots for card skimmers because of the high volume of transactions and because thieves using glue or tape can attach the devices unnoticed.
Other targets include self-checkout aisles at supermarkets and other stores. At restaurants, servers may use handheld skimmers in back rooms after customers hand over their cards to pay the bill.
Neither the Secret Service nor the bankers association were able to provide dollar estimates of total losses attributed to card skimming, but both said it was a growing and increasingly sophisticated crime.
"There are some very smart people involved in these criminal enterprises," Mr. Zahren said. "Some of the techniques involved are very advanced."
Banks generally don't like to talk about the problem for fear of scaring away customers or compromising their security measures. A spokesman for PNC Bank, the Pittsburgh region's biggest bank, declined comment for this story.
The bankers association is working on a database that would alert banks to skimming activity in their area, Mr. Johnson said. The system is expected to go live sometime in the first half of this year, he said.
Several years ago, the Secret Service in Pittsburgh along with the FBI, other law enforcement groups and bank investigators shut down a major skimming operation here with international ties.
Perpetrators were arrested as they returned to the ATMs to retrieve their skimming devices, Mr. Zahren said.
As a result of that case, new techniques were developed for tracking and identifying skimming activity based on anomalies at the machine, he said.
Debit and credit cards that have embedded microchips instead of magnetic stripes provide better protection against skimmers because the information on chips is encrypted. But the so-called chip and PIN technology, which is the norm in Europe, has been slow to catch on in the U.S., mainly because of the expense of upgrading card readers at ATMs and checkout registers.
For consumers, the biggest concern of being hit by a skimmer is the hassle factor, especially if it involves a debit card.
Nearly all credit and debit card issuers have zero liability fraud policies so customers aren't on the hook for unauthorized transactions.
The difference with a debit card is that customers are out the money until their account is replenished. While many big banks provide provisional credit within a day or two for some or all of the funds while they investigate, at some banks it could take a couple of weeks or more to get a refund.
Experts recommend consumers check their accounts frequently online to spot suspicious charges or withdrawals and report them promptly.
"You shouldn't wait patiently for your monthly statement in the mail" to do the review, Mr. Johnson said.
To help protect their cards from skimmers, consumers should get to know the ATMs they frequent so they recognize when something looks unusual, he said.
Say a box with brochures that was never attached to the machine before appears one day. Take notice and ask the bank about it, Mr. Johnson said. There could be a hidden camera inside.
Before swiping a credit or debit card, give the card reader a jiggle. If it's loose, it could be a sign that a thief has tampered with it.
"Some criminals are very adept at putting the [skimming] device over the card reader. Other criminals, not so much," Mr. Johnson said.
When entering a PIN, shield the keypad with the other hand, which may prevent a hidden camera or shoulder surfer from picking it up.
Also be wary of overly helpful strangers, Mr. Johnson said.
In the case of one type of skimming device that captures cards, someone might step up and pretend to offer help retrieving the card, he said. The person isn't any help, of course.
"When you leave, they take your card."
First Published February 17, 2013 12:00 am