A sharp-eyed customer making a transaction at an ATM outside a Boca Raton, Fla., Bank of America branch noticed a gap behind the metal faceplate of the ATM. A closer look revealed double-sided tape was all that kept the faceplate in place. Thinking it looked a tad suspicious, the customer gave a yank and the faceplate came off in his hands.
What the man had discovered was an ATM skimming device. Slide your ATM card into a skimmer and it will read all the account information stored electronically on the magnetic stripe, plus, depending on the sophistication, record your personal identification number, or PIN, as you punch it in on the ATM keypad.
Next thing you know, your checking account is notably lighter.
ATM skimming devices come in two flavors: ones that interfere with the ATM operation and ones that don’t.
The skimmers that interfere with the ATM operation are a bit easier to detect because even though customers insert or swipe their cards, it’s not the ATM’s card reader so the ATM isn’t actually being used and the customer isn’t getting any money.
That was the set up in the Boca Raton incident.
“They probably cased several ATMs at different banks, looking for an ATM face that they could build,” says Detective Pedro Palenzuela of the Palm Beach County Sheriff’s Office.
“They used a grayish, fabricated metal container that looked like the same material. It was shaped to fit on the ATM but inside was a small laptop computer. It prompted the customer with a touch-screen instead of a keypad. The ATM had a card reader next to it.
“There was also a sign that said the ATM instructions had changed. The customer would swipe their card and would be prompted — ‘Welcome to Bank of America.’ It had all the instructions Bank of America would have. The customer would slide their card and the computer captured the information, saving it to the hard drive and storing the PIN.
“Then the customer would see a screen that says, ‘Thank you for using Bank of America. There has been a malfunction.’
“It was a pretty good scam,” says Palenzuela.
In other skimming cases, the thieves don’t interfere with the normal operation of the ATM. The skimmer is placed over the card reader but doesn’t block off the reader, and the customer gets money when making a withdrawal.
The bad guys are efficient and competent, says Rob Evans, marketing director at NCR, an ATM manufacturer.
“They’re not idiots or drug-addled junkies trying to get $20. They’re consummate businessmen. They adjust for the last countermeasure that we put in place. We build the wall higher, but they keep coming back with taller ladders.”
It’s hard to pin down numbers on just how pervasive skimming is becoming. It’s been happening since the late ’90s but has become more popular with the criminal element with the advent of smaller computing devices.
It can happen not just at ATMs, but also at cash registers when you make a purchase. Pay your restaurant tab with a credit card and you have no idea what the waiter might be doing with the card when it’s out of your sight.
But skimming at ATMs can be much more damaging because of the number of accounts and the amount of money that can be quickly accessed.
Kurt Helwig, executive director of the Electronic Funds Transfer Association, which is spearheading a task force to tackle the problem, says criminals are willing to invest some time and money in skimming frauds because of the potential bounty.
“Twenty years ago, we defined ATM crime as someone getting hit over the head and having their money stolen. Then it was shoulder-surfing, watching someone punch in their PIN and leaving their receipt behind. This is the next step. It’s not just a one-on-one robbery. There’s a lot of money involved.”
Experts say crime rings sometimes skim ATMs, and the damage can be extensive. A New York ring installed more than 20 modified ATMs and compromised more than 26,000 transactions and thousands of cards from 1,400 issuers. Losses were pegged at $3.5 million before the case was cracked.
There are approximately 360,000 ATMs nationwide. About half of them belong to banks, and the rest are so-called “nonbank” ATMs in convenience stores, malls, hotel lobbies, airports, etc.
ATMs that have swipe readers (you swipe your card through a raised slot) are the easiest to skim. Swipe readers are more likely to be found at nonbank ATMs.
“Most ATM manufacturers are aggressively moving away from swipe to a dip or manual insert reader that has less accessible external parts because the reader head is buried in the machine,” say Jim Merrell of Ohio-based ATM manufacturer Diebold.
But that doesn’t mean you should avoid ATMs that have swipe readers.
“There are tens of thousands of them. Just beware of something that doesn’t look quite right,” says Merrell.
More ATMs, more victims
The fact that there are so many ATMs contributes to the skimming problem. In a way, we’ve become victims of the convenience we demand.
“The notion of 24-hour access,” says Evans. “It used to be that the ATM was through the wall of the bank branch. They’d monitor it and know if anything was wrong. Now there are ATMs everywhere in unattended locations. Bad guys have options they didn’t used to have.”
The ATM skimming task force that Kurt Helwig’s organization, the EFTA, is leading is bringing together all segments of the ATM industry — manufacturers, processors and financial institutions, as well as the U.S. Secret Service, which is involved in ATM skimming investigations.
“We want to stay ahead of this as an industry,” says Helwig. “We’re looking at where the system is vulnerable. Our goal is an industry-wide solution.”
The task force will be looking at a number of ways to combat skimming, including the design of ATMs and magnetic stripe technology.
Evans says a technology called Jitter is one way to beat skimming.
“A skimming device needs a nice, smooth card reader. Jitter varies the speed and reverses the direction of the card intermittently and in a random fashion when the card is entered.”
Jitter is being deployed mainly on newer, motorized card readers.
Implementing technology changes will be a massive job, but task force members say the situation will be much worse if consumers lose faith in the system.
“Card-based purchases — online, debit and credit — are so convenient for the consumer and are the lion’s share of commerce in the developed world,” says Evans.
“We can’t take this lightly. The industry has to make sure that cards are well protected and that consumers don’t hesitate to use them. If there’s any hesitation at all — this store doesn’t look right or this ATM doesn’t look right — then there’s a very real risk that card usage will decline dramatically.”
If you are a skimming victim, your bank should refund all of the money that was lost.
“We regret any inconvenience to our customers who become victims of fraudulent activity in their accounts,” says Bank of America spokeswoman Lisa Gagnon.
“Bank of America protects its customers against fraud in many ways, which includes our commitment to assume 100-percent responsibility for the cost of the fraud for customers who have unauthorized activity on their ATM or check card,”
Here are some tips to help you avoid becoming a skimming victim:
Keep your PIN safe. Don’t give it to anyone.
Watch out for people who try to “help” you at an ATM.
Look at the ATM before using it. If it doesn’t look right, don’t use it.
If an ATM has any unusual signage, don’t use it. No bank would hang a sign that says, “Swipe your ATM here before inserting it in the card reader” or something to that effect.
If your card is not returned after the transaction or after pressing cancel, immediately contact the institution that issued it.
Check your statements to be sure there are no unusual withdrawals.