The Scoop: Credit Card Skimmers

Note:  This article has been updated to inform the public about a new type of skimmer. The updated information can be found at the bottom of the article.

In searching through articles, I’ve seen quite a few recently that involve credit card skimmers. Skimmers are small devices that thieves insert into the card slot on an ATM, gas station credit card terminals or any other payment terminals. It’s very easy for thieves to slip the devices on terminals that are out in the open. So when you swipe your card, it saves the data, thieves later remove the device and use your pilfered data to perpetrate card fraud.

How prevalent are skimmers? Well, in June in Florida the Florida Department of Agriculture and Consumer Services discovered 103 credit card skimmers attached to pumps at 7,571 gas stations. In July in Wichita, Kansas, skimmers were used at bank ATM’s. One was recovered by police when a customer noticed his card wasn’t being read properly. Later, at another bank in the same area, customers began noticing unauthorized withdrawals on their bank statements, but by the time police were informed, the fraudsters had removed the skimmers.

Another story tells of several people whose credit cards were skimmed, the cards duplicated, and then used at a Sam’s Club in Tallahassee. This past Tuesday three people were arrested for credit card skimming in Franklin, Virginia. Management at a gas station discovered the skimming device and police arrested the suspects when they came to retrieve it.

“Criminals merely need to pull a car up in front of a pump to surreptitiously install or retrieve a skimmer within a matter of minutes,” said Geoff Sanders, CEO of LaunchKey, a Las Vegas-based decentralized mobile authentication and authorization platform (via Daily Finance)

Credit card skimmer fraud is going on all over the nation. Some skimming has been done at restaurants, including McDonald’s, and Redbox. However, ATMs and gas pumps are the biggest targets. Thieves can easily buy skimmers on the internet, slip them into ATM/payment terminals with double stick tape, and then when you put your card in the machine credit card numbers are captured, fake cards are made, and the thieves sell them or go on a spending spree. Along with the skimmers, they usually also install small cameras to capture the PIN number.

Older skimmers are easier to spot than newer ones. Here is a picture of the skimmer recovered by the police in Wichita:

Here’s a picture of the newest, ultra thin skimmer, described in detail on Gizmodo:

Some tips to avoid having your credit card information stolen by thieves with a skimmer are:

• Check any payment terminal carefully. Look for anything that looks out of place or is unusual. Sometimes they stick out further or look newer than the machine. They can also be looser. It could be a false slot attached to the original card slot, like the one recovered by the police in the photo above. Tug on it to make sure it’s the real deal. Google “ATM skimmer” and it will show you a ton of different false slots that go with any kind of ATM terminal. Same with “gas skimmer”. Unfortunately, the newer ones are more difficult to spot.
• Pay attention to your bank accounts. Check the transactions in your bank or credit card account regularly. Report any suspicious transactions immediately.
• Cover the keys. Use your hand to shield your PIN from view. Don’t let the camera, or the person standing behind you, capture the PIN number.
• Examine the keypad. Sometimes the thieves add an overlay to the keypad. So if the keypad appears thick or different than usual, don’t use it.
• Use a credit card at gas stations. Credit cards have better fraud protections than a debit card. If you use a debit card, run it as a credit card so you don’t use your PIN. If they get your PIN they can get direct access to your bank account. You can also use gas pumps closer to the store. Thieves are less likely to tamper with those because of the chance of getting caught. Or, you can just pay for your gas with cash.

“The bottom line is…the security and safety of the cardholders. The EMV card, combined with the new terminals, will dramatically reduce skimming fraud,” said Laura Hilton, manager of the VISA Department with America First Credit Union. (via Herald Extra)

The bad news is that there is an increase in skimmers being used all over the country. The good news is that financial institutions are releasing more secure credit cards, called by its acronym EMV, which stands for Europay, MasterCard and Visa. These new cards are embedded with a computer chip that adds a unique code to each transaction. This makes all in-person transactions more secure. Hackers won’t so easily be able to use the card number by itself because each transaction will be unique. These EMV or chip cards are being sent out right now by financial institutions and everyone should have one of these new cards by the end of 2016.

Along with consumers getting new cards, merchants need to update their payment terminals as well. For a secure transaction the EMV cards need to be put partway into a slot, or “dipped” in. These terminals can also read the magnetic strip on the cards by “swiping”, which is what we currently do. Merchants are not required to use the new payment terminals, but after Oct 1, 2015, if fraud happens and the card was “swiped” and not “dipped”, the merchant eats the loss, not the banks. Assuming, of course, that the bank has replaced your card with the EMV one.

The increase in credit card skimmers is probably related to the more secure credit cards being issued. Thieves are trying to scam as much as they can before it gets harder! Be alert, be aware, and check your account transactions regularly to avoid losing your hard-earned money to thieves because of credit card skimmers.

UPDATE (9/16/15): A security expert was asked to check out ATM skimming in Cancun. He discovered that the compromised ATM’s use ultra-sophisticated Bluetooth ATM skimmers. You cannot tell they are compromised by checking for fake keypads or inserts in the machine. These are wired directly into the circuit boards. The thieves bribe the ATM technicians for access to the machines, paying them as much as 100x their monthly salary. After installing the devices they return later, access the ATMs through Bluetooth, then download data of the cards used at those ATMs.

One way you can tell if the ATM has been compromised is to check for bluetooth signals near the ATMs. In this case, every compromised ATM emitted a Bluetooth signal called “Free2Move”.

So this US-based security expert flew to Cancun and drove all over Cancun looking for ATMs emitting the Bluetooth signals. And he found them everywhere, even at the airport and at high-priced hotels. Luckily, he did find some that were not compromised.

Click here for Part 1 of his series on tracking the Bluetooth skimmers in Cancun. Click here for Part 2.

This same security expert has written extensively about credit card skimmers. Here is one of his posts about the ultra-thin, inserted skimmers I mention in my original article.