Read an explanation of ATM skimming from one of the North Carolina State Employees Credit Union’s security officers here.
A form of bank fraud that can victimize hundreds within hours is growing in sophistication and increasingly targeting the Raleigh area.
The Raleigh Police Department arrested four suspects in 2009 as a result of multiple investigations into cases of “skimming,” where thieves use electronic devices to steal financial information. Although the arrests stem from only three cases in 2008 and 2009, the crimes can impact a large number of people.
“If you looked at the victims, there are hundreds,” said Raleigh Police Sgt. Al O’Connell, who worked on the cases. “It’s crazy.”
The skimming devices can be attached to ATMs or gas pumps and are difficult to detect.
“Their goal is to collect personal information while still allowing the transaction to continue,” Karen Daeke, head of security administration for the State Employees Credit Union, said.
The technique
On ATMs, the card readers have a plastic covering painted to match the color of the ATM and are usually attached to the machine with glue or tape. Some criminals are only interested in collecting numbers stored on a debit or credit card’s magnetic strip. If they’re after cash, they’ll employ a pinhole camera hidden inside a mirror or a brochure holder. The camera will record PIN numbers and allow criminals to match them with the stolen card numbers.
Data from the card reader and the camera is captured using two different techniques. With Bluetooth, a wireless technology often used in cell phones, someone in a nearby car can download the information as people perform their transaction. Data can also be transmitted through a wireless router to a hidden laptop, which stores the information until the criminal can come back to retrieve it.
That option represents an increased level of sophistication for criminals.
“It used to be that the bad guy was sitting in the parking lot,” O’Connell said.
After retrieving the skimmers, cameras and other equipment, criminals can sell the card numbers online. They can also load the card numbers onto blank gift cards, which Daeke said can be purchased or stolen, and steal cash or make in-store purchases using the PIN.
Gas pump skimmers, which are hidden inside and undetectable to customers, are even more technical. O’Connell said criminals use a “readily available” key to open the gas pump panel and attach what is essentially a small computer.
“It was programmed in such a manner that it knows the sequence of numbers on the keypad and knows which ones to capture,” he said.
After an install that can take less than 30 seconds, the device can capture card numbers and PINs for hours before it’s later recovered.
“There’s no way of knowing until the money is gone,” O’Connell said.
Whether the device is on an ATM or a gas pump, Crimes often aren’t reported until victims notice fraudulent activity on their bank records. O’Connell said it’s rare for authorities to actually recover the skimming device itself.
“The big challenge is that we are a step behind,” O’Connell said. “At that point, the suspects are gone. They’re not even in our area.”
But Raleigh police have managed to get their hands on several devices in two cases. Investigators found one skimmer this year on a State Employees Credit Union ATM on Six Forks Road. Another case netted 10 to 12 gas pump skimmers at locations across the area, which O’Connell says were manufactured by two brothers from Cary.
In that case, investigators say the men intended to expand their operation by selling skimmers in other states. For the most part however, O’Connell said criminals involved in ATM skimming are from countries like Russia or Bulgaria who move around quickly to capture as much data as possible.
“If there was a common denominator, it would be that the suspects are from outside the United States,” O’Connell said.
And although the devices are technical, they can be manufactured with a little search engine savvy and parts from an electronic store.
“They both have done a lot of research,” O’Connell said. “But 10 minutes on the Internet, you can learn how to make a device.”
Undoing the damage
Despite few cases of ATM skimming, it can be difficult for financial institutions to clean up the mess – especially since it takes time for victims to report the activity.
“If you can pinpoint when the skimmer was installed and removed, whoever owns the device should be able to provide a list of users,” she said.
From there, the incident is reported to the financial institutions, who in turn notify cardholders. Although banks may be insured or claim restitution from those convicted, how they get their money back depends on the type of fraudulent transaction.
“If we can seek reimbursement, we would do so,” Daeke said.
Solving the problem can also be complicated because people use ATMs from multiple institutions.
“If another financial institution found an ATM to be compromised, our member might have used it,” Daeke said. “Our member could have been a victim even if it didn’t happen at the credit union.”
And with more than 1,000 ATMs across the state, preventing ATM skimming can be a difficult task for SECU.
“It’s up at the very top [of our priorities] because it’s the up-and-coming crime,” she said. “We can’t let our guard down [on other crimes], now we just have skimming to add to the list.”
Daeke said the sheer volume of victims is one of the reasons why the crime has evolved from cases of handheld scanners at restaurants and retailers.
“It’s like anything else. The bad guys get more efficient and effective by targeting the activity that’s most profitable,” Daeke said. “The thieves just migrated to the ATM.”
Daeke said the average ATM transaction occurs in less than a minute. A few hours after the skimmer is installed, criminals have the potential to steal hundreds of numbers.
“It goes to efficiency of scale,” Daeke said. “They get more bang for their buck because you can do ATM transactions in under a minute.”
It’s also attractive to criminals because of its relative simplicity.
“I wouldn’t say it’s harder to get caught, but [the crime] is easier,” O’Connell said. “You can start at home doing fraud on the Internet and cover your tracks.”
Fighting back
To combat theft from ATM skimmers, the credit union has worked to inform members about what to look for when banking at an ATM.
“The State Employees Credit Union has taken on a strong education initiative,” she said. “We feel like we’ve done a good job getting the word out on the street.”
She said that effort appears to be working, since credit union officials have received more calls reporting suspicious ATMs, which they can quickly shut down and investigate.
Financial institutions have also worked closely with local law enforcement and the Secret Service to fight skimming. Raleigh police even meet monthly with banks and other agencies to share information.
But Daeke said there’s no substitute for awareness on the public’s part.
“Be aware. Know your surroundings in the areas you do business,” she said.
O’Connell said it’s important to regularly review bank records and financial statements. Visiting familiar ATMs and looking for out-of-place objects can also help.
“Most ATMs have a flat panel where you insert your card,” O’Connell said. “If there’s anything protruding, you need to look at that carefully.”
When in doubt, O’Connell said he’d rather consumers contact authorities, even if it turns out to be a false alarm.
“If you call us, we’ll be happy to look at it,” he said.
