With advances in technology and years of practice, criminals have gotten incredibly good at skimming information off customer cards.
Last week, an alleged thief was caught on camera at a Miami Beach gas station placing a skimming overlay to capture both PIN and magnetic stripe information from unwitting customers. The man appears to have been working with accomplices who distracted the clerk so that he wouldn't be seen placing the device, but he barely needs it. Look how quickly he installs the device:
You can watch the full video, captured by a surveillance camera, here:
Sophisticated skimming operations like this have become more common in recent years, says Darren Hayes, an assistant professor at Pace University who specializes in cybersecurity.
"It's big business," says Hayes. "For the organized criminal gangs that have traditionally been involved in burglary, car theft, sometimes even human trafficking or narcotics, skimming is one part of their portfolio of criminal activities."
Overlays make skimming easy
Part of the reason the man in the video is able to install the skimming device so quickly is that it's likely custom-made to fit that terminal, says Hayes.
"They can create them very easily," Hayes says. "Sometimes what they'll do is go to a machine that they want to target -- say it's a particular type of ATM -- they'll hack off the card reader and they'll make a mold of them."
Some thieves go so far as to use paint swatches to match the paint color exactly, he says.
The advent of 3-D printing has made the process of overlay manufacturing even easier, Hayes says. And those without the skills to manufacture the devices can also easily find them for sale online.
However they get them, a high-quality overlay on a debit-card point-of-sale terminal can be almost impossible for a victim to spot, he says.
To see one up close, check out this video from security blogger Brian Krebs:
EMV chip cards haven't stopped skimming
You may have thought that when you got that bright, shiny new debit card with the chip in it that you wouldn't have to worry about skimmers anymore. But while chip cards are harder to counterfeit and steal information from than old magnetic-stripe cards, "a lot of machines across the United States are still vulnerable to skimmer fraud," says Darren Hayes, a professor at Pace University.
The biggest issues is that, even among merchants who have installed the machines, many customers are asked to swipe rather than do a chip-enabled "dipping" transaction. When that happens, chip cards are no more secure than a regular card -- magnetic skimmers can still easily pull information off a card that can be used to make copies.
While those copies won't have the hard-to-counterfeit EMV chips, that's not usually a big obstacle. Chip terminals are easy to evade, either by making purchases at businesses that don't have them yet, or by going online, Hayes says.
In fact, it's so easy to use stolen debit card information to make purchases here that the U.S. is becoming a haven for foreign criminals, who steal debit card information in Europe and send it to accomplices here, Hayes says.
"A lot of different organized criminal gangs across Europe are skimming European cards and still cashing them out here in the U.S.," he says.
Thieves typically make fraudulent purchases of products that can be quickly resold, such as Apple iPhones, Hayes says.
What do you think? Could you spot a skimmer? Do you think you've ever been a victim?
Follow me on Twitter: @ClaesBell