Slashdot Mirror
Visual Autopsy Of An ATM Card Skimmer
Bert64 writes "A chap at work was recently the victim of an ATM card skimmer which took his card details, cloned them and allowed the fraudster to take 550 pounds out of his account.
Having tried to explain how the fraudsters can hide a camera and card reader around the ATM, he decided it would be easier to show one of them after a few drinks down the pub.
He was a little surprised to find that the machine he chose had a card reader and camera in place. These were removed and analysed, we believe we have reclaimed about 800 pounds worth of kit. Result:
Pictures."
This is a growing trend. Along with other questionably legal items, you can find a card reader from Ebay for a fraction of what you can scam.
What ever happened to "Stick 'em up??"
...don't question it!!!
This is the sort of thing that makes one wary about the convenience ATMs available in many cities; you'll save more than a surcharge by sticking to your own banking company's systems.
On a side note, this is probably the most clever fraud I've seen in a long while. Great that these folks ripped out the innards of the scam device.
"A group of words expressing something other than their literal intention. Now that... is... irony!" - Bender
How hard would it be for someone to design an ATM machine that would make it more dificulty to conceal a card reader... or better yet one that made it impossible to insert your card if anything is attached... it would seem that with some common sense a designer good create some pretty good safe guards... or am I just missing something?
Could this be the death of the PIN? What's next - biometrics? Will this last only as long as it also cannot be spoofed?
ATM bug-detection should be a profitable area of research for the next few years.
There are a myrid of legal uses for stripe readers, including computer and home security, and making really cool copies of your bank cards*
I have a friend who has a reader who does this.. he takes a plastic generic card with a cool photo on it, with a blank stripe, and copies your ATM stripe onto it. Fully functional, totally customized ATM card.
You should see the looks he gets using his "superman" debit card.
Still, very interesting to see. I'm quite suprised at the digital camera half of it. Of course something like using fingerprints or some other kind of biometric would make things much harder for the thief.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
You are correct, cash advances on a credit card start accruing interest from the moment they are taken.
It used to be that cash and purchases were treated the same, with basically a month interest-free loan as long as you paid your bill in full, but people could just pay one card with a cash advance from another, and be able to borrow money interest-free for as long as they stayed under the credit limit.
Recursive: Adj. See Recursive.
The bank ate the loss and gave us back our cash, but what kind of justice is it when scammers get to go free with the cash they stole?
Condemnant quod non intellegunt.
As an addition to the first point, if you're going to do it at a store choose one that let's you swipe the card yourself. If they have to swipe don't let your eyes off the card. If the card reader is out of view it's in your best interest to go somewhere else.
Toronto police busted 70 people working at convenience stores for double swiping a few years ago. (Between 98 and 2001, as I lived there at the time). A second reader located beside the primary was used to collect card info. I don't know if cameras were used to collect the pins or not.
Since the story at the time indicated that it was mostly employees that had been approached by people not involved with the store, I'm guessing the machines were portable so they could be brough t in and out with the boss none the wiser.
PIN numbers and the way they are entered have terrible security implications.
Why can't you, say, have a 5 digit number and the ATM machine would ask you something like "What is your first, third and last number?" or "What is your first number plus your fifth number?"?
Or how about you have to look through a keyhole to see the ATM monitor so nobody else can see it. Then, before it asks you to enter your details, it shows you the mapping of the keys on the keypad. So, if you have a 9 digit keypad, it would shuffle the numbers around you look into the keyhole and see:
167
482
539
Then you'd press the button that is in the right position for each number.
The biggest thing seems to have been the size...Once they ripped it out of it's housing, the camera wasn't much bigger than the batteries.
At $1000 per setup, thay'd only have to catch 2 cards to get their money back. After that, the rest is profit.
Free Software: Like love, it grows best when given away.
This was modded funny, but Vigilante anti ATM-scammers may be a good idea. Freelance geeks who get cool toys in return for making the world safer. Win-Win situation.
When life gives you crap, Make Crapade.
Sluggy Freelance.
Two farthings = One Ha'penny. Two ha'pennies = One Penny. Three pennies = A Thrupenny Bit. Two Thrupences = A Sixpence. Two Sixpences = One Shilling, or Bob. Two Bob = A Florin. One Florin and one Sixpence = Half a Crown. Four Half Crowns = Ten Bob Note. Two Ten Bob Notes = One Pound (or 240 pennies). One Pound and One Shilling = One Guinea.
The British resisted decimalized currency for a long time because they thought it was too complicated.
I always do this, although my method is a slight variation. I like it better, but people are free to try anything that works for them.
It's quite easy to do, and if you take the time to practice it each time you enter a PIN for a short while, it becomes second nature and you don't even need to think about it (leaving you free to scope out the area, the people around you, and yes, even look for cameras, as you should do at any ATM). I almost never have received a dialog about an incorrect PIN. Maybe it happened once (I've done this for years), but I can't remember any incidents of bad entries.
What I do is place more-or-less my whole hand on the keypad, with pretty much every finger and my thumb touching a key; and press the relevant numbers with different digits (fingers/thumb).
You hand barely moves when you do it right, and all the fingers, including the unused ones, kind of move a bit when you enter a number; it's really impossible to know which keys were pressed in which order. Try it.
If someone could break into an ATM and install a camera and reader, why not just take the money inside instead of leaving all that gear around?
Aside from the fact that skimmers generally don't involve getting into the ATM at all, "getting into" the ATM is quite a bit different from getting into the cash safe inside. In fact, in any case where the ATM is serviced by an armored-car service, generally the owning bank can open the ATM but even they can't open the cash safe.
When I worked at the bank, we had someone take an ax to one of our brand-new ATMs. It was annoying all around because on his side, (1) it wasn't live yet, so there wasn't any money to steal, (2) he couldn't get into the safe anyway, (3) he cut himself trying; and on our side (1) the ATM itself was a loss, and worth more than the amount of money it could hold, (2) we'd *just* finished configuring and testing it and now had to start over, and (3) the video camera wasn't live yet so we didn't get to see the guy. (We did have some nice blood samples, and bloody fingerprints, but I never heard if anybody got caught/charged.)
Slashdot's token middle-aged housewife
I know a few people who have delved into the 3rd-party ATM business. Note to non-Canadians: by law the bank has to let authorized independents access the Interac system. You go through quite a bit of verification; it's no way to scam anyone.
The machines usually cost near $C 10K each, I suppose it's possible to buy one for half that used.
The hard parts are:
You need a bunch to really make it worthwhile; one machine is too much trouble for the piddly returns you get.
They don't hold much cash; you have to refill often and it's going to be out-of-order (read: out of money) a lot if it's in a high-demand location. Try the 7-11 or a local bar.
You have to somehow get a good location; usually this means giving a half-cut to the owner of the business you put it in. Indoors, locked at night, basically.
You have to have the cash to keep it full; you need a float of a couple grand a machine, minimum. More is better, saves trips to fill it up, but you can start with that and fill it twice a day if you have to, till you start making money.
After you piece off your retail partner (for the location) you can gross 75cents a transaction. If it's really competitive (as it seems to be where I am) you might end up giving the store a buck to keep the machine on their premises. At 100 transactions a day, that's 75 bucks or less. A hundred transactions requires a float near 10K per machine, or alternately thrice-a-day refills. Now you know why you need to have a dozen or so to start; one machine is just as much trouble as 10, so you may as well make a full-time job of it.
Most of your machines won't average that many transactions. A hundred a week is apparently more common (they're everywhere; and each new one siphons off some of your traffic).
The guys I know recently sold them off; the two of them had 8 altogether. Too competitive, the damn things are everywhere and many bar owners, gas stations and convenience stores just buy their own and keep the whole buck-and-a-half.
They didn't make a killing; but if you were really into it and got up to 20 machines the income would be enough to support a full-time person. Hardly lucrative, but an enterprising individual can do OK.
At the very least the cops, err... bobbies, might have been able to get a finger print or two, trace the purchase of the camera or the serial number on the SD card. Even if it doesn't lead to a direct capture, this sort of thing stays on record and can be used later when these scammers inevitably get nabbed for something else down the road.
Besides, what about the other victims? Now there's no evidence that they were scammed too. They might have to eat the loss themselves without some corroboration that they were scammed.
Also, the equipment may have cost the scammers more than this particular victim lost, but is this junk really worth much at all to the victim other than bragging rights?
Finally, aren't a lot of British cities brimming with cameras these days? If this stuff had been left in place it might have been possible to track the scammers when they picked the equipment up.
Signatures are a waste of bandwi (buffering...)
The U.T. Police Department Web site has an interesting article about skimmers in use in the Austin area. Check out where they put the camera!
Actually, there is one rather good argument for using "English" measurement, at least when one is evaluating length.
It is far, far easier to split measurements in the English scale into fourths and thirds. The math is much simpler to do in your head. Halves work just as well as in Metric (Decimal). Fifths work better under Metric, but English can do sixths.
This is a simple consequence of their prime factors: 2*5=10 as opposed to 2*2*3=4*3=2*6=12.
Feet to yards brings us to 2*2*3*3=36, which is strange but functional, and then we come to miles which is where it all falls apart. But we can't afford to replace all the signs with kilometers per hour. I'm not sure I'd trust American drivers to make the transition safely, either.
Metric is a perfectly valid scheme to nearly all your measuring in. It is superior in several ways to English measurements, but there are valid reasons for not switching to it.
I believe that most people don't want to swap our convoluted babylonian time system for decimal time, and I consider this an example differing in degree but not type from the English/Metric debate.
Much Love,
ArekRashan
It may sound like a troll, but why is the US so conservative in regard to their money: card with only a magnetic stripe that you can copy with a 80$ reader, money in 2 colors on plain paper that you can xerox (almost) easily...
Non-Linux Penguins ?
... they have some old ATM where the numbers are arranged in one loong row of large buttons ... completely impossible to hide what you're typing.
But then, their new generation of ATM's have a touch-screen LCD to display the number pad -- and the digits are randomly rearranged between uses. Now that's secure (but not so ergonomic).
"Good news, everyone!"