Laura Michaud works for the North Carolina State Employees Credit Union and is a graduate student at North Carolina State University. She wrote the following article for a graduate technology writing class at NC State.
At first glance, everything appears normal at the ATM. No one suspicious is lurking around. The area is filled with people. Then, you notice a piece of bulky plastic attached to the card slot. You examine it, but ultimately shrug and insert your card.
You are now $500 poorer and have just been victimized by a skimmer, and some of the newest identity theft technology to hit Raleigh. Here’s how it works:
Skimmers are electronic devices that are cleverly disguised to blend in with an ATM’s appearance. Their purpose is to record the information that is stored on the magnetic strips of debit and credit cards. “They sound complex, but they’re actually quite simple and can have devastating effects on their victims,” said Cory Mathes, a security officer at the North Carolina State Employees’ Credit Union (NCSECU).
A bulky plastic covering placed over an ATM card slot. Photo courtesy the North Carolina State Employees Credit Union.
Although you have been victimized by this technology, you are not alone. According to Raleigh police, four separate skimmer cases have been investigated since the beginning of 2009. Don’t let this small number fool you. It doesn’t include the many others who are in the process of reporting fraudulent activity on their accounts. If this frequency of fraud seems disturbing, wait until you see the lengths people go to in order to steal your account information.
ATM skimmers can have two different hardware parts: a card reader and a camera. The card reader is a plastic covering that is attached over the card slot using a sticky substance like glue or tape. This covering is usually bulky, but blends in because the color matches the ATM. “If the individuals involved want just the card numbers, they’ll stop there,” said Mathes. “If they want cash, they need cameras to record PIN numbers with.” The camera is hidden in a discrete object like a small mirror. “This object is attached further up on the ATM and has a pinhole at the bottom of it,” said Mathes. “The pinhole lets the camera view and record PIN numbers that are punched on the keypad below.”
A pinhole camera used to capture ATM users’ PIN numbers. Photo courtesy The North Carolina State Employees Credit Union.
Skimmer investigations started in Raleigh about three years ago, according to Detective G.R. Bowman at the Raleigh Police Department. “In the past two years, skimmers have really hit us hard,” said Bowman. “It’s difficult to detect them and to figure out who’s involved.” Over the past year, NCSECU has investigated 12 to 15 skimmer cases. “Three of these were in Fayetteville and four were in the Raleigh/Cary area,” said Jon Mallaber, another security officer with the credit union.
Although NCSECU has already had its fair share of headaches with skimmers, other financial institutions share this burden. BB&T has also had cases of skimmer fraud and, like NCSECU, has found the problem to extend beyond just ATMs. “A skimmer can affect any machine where a credit card is accepted,” said Lisa Snyder, who works with fraud at BB&T. “This includes gas pumps, retail stores, and restaurants. We’ve already seen cases of each of these.” Although Raleigh is new to the skimmer scene, according to police and credit union security officers, other states, and indeed, countries are not.
In June 2009, for instance, investigators in California discovered that a Russian mafia member performed some inside skimmer work at a gas station, according to LA Weekly. By acting as a model employee, he was promoted and finally had the opportunity to implant a skimmer. After he vanished from the job, thousands of bank accounts in Southern California were drained using the personal information that the skimmer stole.
In early November 2009, Romanian police arrested 19 additional mafia ring members that used skimmers in Switzerland, Italy, France, and the United States, according to Wired.com. The article says police watched this group for 9 months before intercepting a package of circuit boards used to operate the skimmers. Foreign-made skimmer parts like these are actually commonplace among the skimmer suspects within the United States, who usually get the parts from their home countries.
“Skimmer hardware parts come from both overseas and within the United States, but most of the suspects are from foreign countries like Russia,” said Sarah Thompson, who works at NCSECU. “We would see more people using skimmers here if they were readily available in the United States.”
So the question remains of how this technology actually steals information. There are two different types of wireless transmissions that take place. The first uses Bluetooth technology. Once the hardware is attached to the ATM, someone in a nearby car downloads the information instantly onto a laptop as people perform their transactions. “This information is immediately uploaded to the Internet and put up for sale, usually to hackers or scam artists overseas,” said the credit union’s Mathes. Hours later, someone removes the hardware attachments from the ATM and leaves.
The other type of wireless transmission is through a router. After attaching the hardware to the ATM, the individual places a laptop and router at the bottom of a nearby trashcan. The router transmits the information from each transaction to the laptop. After several hours, the individual returns to remove the hardware and the laptop. “The stolen information is uploaded onto stolen blank gift cards,” said Mathes. “These cards can now be used to make in-store purchases. If these cards are used at an ATM to make cash withdrawals, they will be accompanied by the stolen PIN numbers that were recorded with the pinhole camera.”
Parts used to capture debit card information. Photo courtesy The North Carolina State Employees Credit Union.
Although ATM skimmers often consist of visible bulky parts, gas pump skimmers aren’t this easy to identify. “They are harder to detect because they fit discretely into the gas pump’s card slot,” said Thompson. Even hand-held skimmers often fly under the radar. “These types of card swipers are generally the ones you should look out for at a restaurant or retail store,” said Thompson. “No one should be swiping your card using a hand-held piece of plastic.”
Since skimmers show no prejudice when it comes to their victims’ bank accounts, financial institutions and law enforcement must all work together to combat this technology. NCSECU already has a system in place for any type of fraud. “Because of our agreement with VISA, we send out a CAMS (Compromised Account Management System) alert whenever we’re notified of fraudulent activity,” said Thompson. “This alert is sent to all financial institutions notifying them of the incident.” NCSECU also has fraud alert meetings once a month. These meetings encourage networking among law enforcement and financial institutions to foster better collaboration and communication.
NCSECU also works directly with law enforcement. “We provide photos from every instance and set up additional cameras in various locations at our ATMs,” said Jon Mallaber. “We pretty much have a reactive stance, meaning that we have procedures in place where the police are immediately contacted, but there’s not much else we can do.”
Although financial institutions and law enforcement work hard to minimize damage caused by skimmers, there are limitations to what they can do on their own. This makes it even more important for people to take bigger measures in protecting their finances. “First of all, use ATMs you’re familiar with,” said Melodie Lewis, a senior security officer at NCSECU. “It’s easier to detect abnormalities that way.” You should also be up-to-date on your financial statements. “Frequently checking up on your accounts means that you’re more likely to catch something unusual before it does too much damage,” said Lewis. “NCSECU also has time restrictions on when we can no longer reimburse your money that was stolen.” Regardless of what ATM you use, it also helps to conceal your fingers as you type in your PIN number. “This will make it harder for skimmer cameras to capture your finger movements,” said Snyder.
Ultimately, awareness is the key when protecting yourself from this dangerous technology. “Don’t be overly cautious to the point of panicking,” said Lewis. “It’s okay to use ATMs, but be familiar with them.” If anything, we should bring this awareness with us wherever we go. Perhaps more attention should be paid to issues that help skimmer fraud advance as far as it does.”
