Slashdot Mirror
Visual Autopsy Of An ATM Card Skimmer
Bert64 writes "A chap at work was recently the victim of an ATM card skimmer which took his card details, cloned them and allowed the fraudster to take 550 pounds out of his account.
Having tried to explain how the fraudsters can hide a camera and card reader around the ATM, he decided it would be easier to show one of them after a few drinks down the pub.
He was a little surprised to find that the machine he chose had a card reader and camera in place. These were removed and analysed, we believe we have reclaimed about 800 pounds worth of kit. Result:
Pictures."
I've stopped using some of the sketchier ATMs because of this.
MIRROR HERE IN CASE OF A
in case you're wondering:
To accomplish this task, the thief places an electronic "skimmer" -- a card swipe device that reads the information on the card's magnetic strip -- on the ATM machine. Attached to the device, or placed discreetly elsewhere, is a small camera that captures the customer's PIN number when they enter it. The information is either collected by the device, or transmitted to a remote receiver. The thief then takes the codes and creates a counterfeit ATM card in order to empty the victim's bank account. Some skimmers can even capture the information and send it to the ATM at the same time. Since the machine works normally, the victim is unaware that they have just given a thief the key to their account. copied from here.
Is there any way to get your money back, or is it gone forever?
In the terms of my credit/debit card it says if I notify the bank within a reasonable time period of unauthorized transactions I get the money back. I suspect most banks have a similar deal.
Saw this recently on memepool.com:
http://www.utexas.edu/admin/utpd/atm.html
Banks are insured, y'know...but I have to wonder, if they weren't out of town (and able to prove it) would they have been so forthcoming?
Actually, correct me if I'm wrong, but with credit cards, my understanding is that you get nailed for interest the *second* you pull the cash out, unlike purchases, where the interest is calculated at the end of the month.
If you look at the site amarodeeps linked to in his comment, a cardstealer like the one shown would be able to steal swipes without too much difficulty. If you haven't seen the ATM before and don't know what it is supposed to look like, it will look quite natural. Most folks don't use the same ATM often enough to remember that the card guides on the sides weren't there last time.
Not brain surgery but more sophisticated than a tape head connected to a serial port. Since the speed of the card over the head is expected to have a wide speed range, the reader has to have its own adaptive clock circuitry in it to decode the card, and THEN it's converted to rs-232 or CMOS level signals.
To ensure perfect aim, shoot first and call whatever you hit the target
1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.
You then end up paying a debit fee instead. Admittedly, it's lower than a 3rd party ATM fee, but it's still more expensive than going to an ATM owned by your home bank. Further, a lot of stores don't want to do this, because:
a) In one small pissant purchase, you've cleared out the register of cash, which makes it difficult to give change to the next customer.
b) The store has to pay a debit fee with each transaction. Whoopie, you've bought an 80cent pack of gum (on which only 20 cents profit at most), and are asking the guy to incur 50cents to 75cents worth of debit fees on his end. This is why some stores have a minimum purchase requirement to use debit.
Also, your definition of "no risk" may not be the same as mine. There have been instances in Canada where some of these scammers have set up shop in a real shop. This is how it's done. The first time they swipe your card through, they swipe it through a slot near the real one, and claim the card was rejected or didn't read right. The second time, the card is swiped through the real one and a the real transaction happens. All the while, the "clerk" is watching you enter your PIN, and he's got a copy of your card now. Perhaps this is why the store doesn't have a problem with giving you a cash advance and being hit by the vendor debit fees on such a small item.
I'm not saying that every instance where your card gets rejected is a scam, since it does happen that a card will be unreadable or rejected. I'm just saying there's still some risk involved.
2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.
What, do you work for a credit card company? Unlike credit card purchases which hit you with interest only if you pay late, cash advances put interest on what you owe the instant you get the cash. You've already mentioned the high interest rate. Even if you pay quickly and on time, a credit card advance will have a nasty surprise attached.
These skimming devices were commonly detected in Canada (Ontario) during the last year or so.
...etc)
They are becoming more and more sophisticated, and the police busted several people for it, and issued precautions for the public:
- Try to use machines in the bank branch you deal with
- Try to avoid machines in public places (malls, convenience stores,
- Report anything that looks suspicious on a machine
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
That's the thing. The ATM's don't read it. The ATM says, 'Hey, bucko. Encrypt this with your private key.' The card does so, the ATM decrypts it with the public key, and when the result is the same, you know it's the right card, without anybody except the card knowing its key.
Crime Information : Skimming Device Installed in ATM (TW RN04000499)
Location : Two ATMs outside Hang Seng Bank, Tai Ho Road.
Facts: On 2004.01.05, ATM maintenance worker of Hang Seng Bank conducted a routine check and confirmed that 2 metal covers (of same design) were being 'fitted' onto the top ledges of two of the ATM machines.
The Skimming Device:-
Because the Americans with Disabilities Act forces even drive-thru ATMs to have braille. Never mind the fact that the on screen displays aren't standardized and the prompts point to different buttons at different banks. Any system you come up with that requires a sighted person to operate will not work.
1) Some merchants charge fees. Many don't as it's cheaper than credit.
2) Some merchants offer cashback as an _incentive_ to get your business.
3) If you clean out the register at a medium to large shop (small shops can be different), you've saved them the trouble. That's that much less cash for them to send out to be converted electronically. Also, it's less cash to send out on armored cars (depending on the size of the merchant).
4) For the places that eat the $0.20 fedwire (Automated Clearing House) fees, it's typically less than the cost of a credit card, and they often don't have to pay a percentage. Buying nothing more than a pack of gum means they lose money, but they run that risk with a Credit Card too.
Contact Me (got tired of viruses emailing me).
In some countries (or maybe only Norway), whenever your ATM card is used in an ATM machine, the machine writes a new unique code to the magnet strip. The next time you use the card, it must contain that specific code, or it is swallowed.
Sadly, the terminals used in stores cannot do this, so you have to use your card in an ATM every now and then, to make sure nobody has a copy of it (quite the opposite of the problem mentioned in this article).
The world will end in 5 minutes. Please log out.
...almost.
Went to take some money out late one night. There were about three (eastern european) guys huddled around the machine fiddling. Went to get money out, and the machine held out to my card - you could see the card in the slot, but couldn't get it out. Guys reappear and tell me something like "Oh. I've seen this before. Press blah, blah, blah and enter your PIN" while standing over me. Hmm, I don't think so...
So, I step back call my bank, wait on hold for an age, and as soon as they hear me confirm to the bank I want to cancel my card, I get my card thrown back at me by said guys, and they scarper into a car that has subsequently double parked.
I reported it to the local police station, and they said it happens all the time, but it wasn't actually a crime until they withdrew money (!!!).
It's called a "Lebanese Loop". More info here:
http://hoaxinfo.com/atmscam.htm
I see plenty of machines in London with glue residue around the card slot. This must happen all the time...