Security

The next time you pull up to an ATM, take a closer look at the machine. Does it look a little clunkier than usual?
Look too at what##s around you: Are there mirrors? Is there a brochure holder over your shoulder? Does it look like there might be a false panel or an extra light bar attached to the machine?
If something looks or feels amiss, walk away. You might save yourself from perpetuating a consumer fraud called ATM skimming. That##s when thieves attach devices onto ATM machines in order to copy a credit- or debit-card number, the information on the magnetic strip and even your personal identification number.
“Many consumers may not be aware that an ATM has been tampered with because they##re not educated about this,” says Robert Vamosi, a security, risk and fraud research analyst at Javelin Strategy & Research.
Consider this your lesson.
Sophisticated skimming devices placed right over a card-reader slot allow scammers to capture the information embedded on the magnetic strip of a debit or credit card.
They might also have what##s called a pinhole camera mounted over your shoulder — say, in a plastic holder for brochures or a false panel — that records your fingers tapping in your PIN. Or there could be an overlay on the keypad that does so.
Within seconds, they have all they need to duplicate your card.
“They##re not just stealing your credit-card number and information like the expiration date, but also the information encoded on the back of the magnetic strip,” says Brian Krebs, who has written extensively about ATM skimmers on his blog, KrebsOnSecurity.com. “All they need to do is encode the information on another magnetic strip and they##ve re-created your card. …It##s a wholesale re-creation of your card and you still have it in your wallet.”
And it##s a lucrative business. Theft from ATM skimming is approaching $1 billion annually, according to Bankrate.com. Javelin estimates that one in five people have been hit by an ATM skimmer.
While a traditional bank heist will net the thief an average of $5,000, ATM pinching yields an average of $50,000, according to Doug Johnson, vice president of risk-management policy for the American Bankers Association.
“We have seen a higher level of sophistication associated with devices,” Mr. Johnson says, “which can tend to make losses larger than in the past when more easily detectable skimming devices were used.”
The attacks tend to be in high-traffic areas, such as big cities or popular malls. But stand-alone machines anywhere also are targets.
Here are some tips to keep in mind next time you go to withdraw cash:
Trust your instincts. If something doesn##t look right or feel right, move on to the next ATM. “Victims have said that they had a feeling when they were using the machines that something wasn##t right,” says Javelin##s Mr. Vamosi.
As you key in your PIN, cover the keyboard with the other hand to block anyone or a camera from seeing.
Don##t use ATMs with unusual signage or instructions, such as a command to enter your PIN twice to complete a transaction.
Be picky about what ATMs you use. “Don##t go up to an ATM in a dark place,” Mr. Krebs says. “Find one that##s in a well-lit area, publicly visible and not tucked away somewhere.”
Use ATMs that you##re familiar with. If you travel, stick to ATMs at a bank branch. “Using a stand-alone ATM is like playing Russian roulette, especially in major metropolitan cities,” says Robert Siciliano, a McAfee consultant and founder of IDTheftSecurity.com.
So how can you tell if an ATM has been altered with a skimming device or camera?
A lot of skimming devices are “stuck onto the machine or nearby with Velcro or two-sided tape,” Mr. Siciliano says.
Keypads that aren##t concave, for example, could have overlays that flatten or pull the surface of the keys out. A card-reader slot might have a perfectly molded attachment over it that pops off. Some skimmers are custom-made with matching molding and a color that corresponds to a targeted ATM.
“Consumers should stay away from ATMs that appear to have been altered,” says Malcolm Wiley, a spokesman for the U.S. Secret Service. “If anything on the front of the machine looks crooked, loose or damaged, it could be a sign that someone has attached a skimming device or a camera.”
Be careful, too, of bank-card skimmers attached to the pumps at gasoline stations.
Last summer, law-enforcement officials in Denver, Los Angeles, Dallas and Florida arrested suspects who allegedly stole debit- and credit-card information by placing small Bluetooth-enabled electronic devices inside the pump handles, which are locked.
Thieves then didn##t have to return to the scene of the crime to unload the information. It was all available to them on their laptops or through text messages — at least until the batteries on the devices wore out.
“These new skimming devices are better and getting harder and harder to detect,” Mr. Siciliano says.
____________________________________________________________
Robert Siciliano is the founder of IDTheftSecurity.com. The Wall Street Journal.

Comments

comments