ATM skimming: Cash machine paranoia justified

[Renew Deal]

One in five people have fallen prey to ATM skimming. Here's how to avoid getting robbed

Ever since I heard a rumor of an ATM that had been set up in a hotel lobby to steal card numbers, I've been a paranoid user of cash machines. As the story went, the machine didn't dispense cash or even account balances. All it delivered was an error message, but only after customers had swiped their cards and entered their PIN.

The story seemed so plausible -- I'm a fan of crime fiction, after all -- that ever since I heard it, I've preferred to get cash at my own bank's machine. Sure, I could be paranoid, allowing my behavior to be strongly influenced by what might have been just an urban legend, but today an alert came across my desk from the Better Business Bureau that made me feel justified. Not only is the fake ATM a real crime, it's a common one, though a modification to an existing ATM usually does the trick.

In this scheme, criminals retrofit ATMs with a card reader that stores the magnetic information of customer cards. They then put that data onto a blank card to make transactions -- or cash withdrawals. For withdrawals, they also install a small camera to capture the customer typing in the PIN. Thus, with a small investment of time and equipment, they have everything they need to grab cash from the bank accounts of unsuspecting ATM users.

According to the BBB alert, "ATM skimmers are close to reaping $1 billion annually from unsuspecting consumers. Javelin Strategy & Research estimates that one in five people have become victims."
<snip>

http://www.infoworld.com/d/adventures-in-it/atm-skimming-cash-machine-paranoia-justified-086

[fishwax]

1. not just ATMs, but also other card machines (such as at the gas pump)

Of course, they can't get your pin at the gas pump, but then again there are plenty of places where they don't need your pin to make a transaction (such as other gas stations).

[muriel_volestrangler]

5. Do American gas stations not require a PIN when using a card at the pump, then?

Gosh, after the non-checking of signatures, the USA invents another way to make your credit card insecure ... :banghead:

[fishwax]

6. some, but not most -- with credit cards they may ask for your zip code

especially if you're traveling. But for the most part, it's swipe and go.

[muriel_volestrangler]

10. Why the hell would providing your zip code be any good to them?

They'd still have to provide a keypad; you'd actually have to press one more key. Sometimes I think American credit card companies are taking the piss.

[sudopod]

2. Some fools tried that at DEFCON last year.

You can imagine how long it took them to catch the guys who left the rigged machine, lol.

[Old Codger]

3. really easy

Nothing to it really


http://www.bargaineering.com/articles/done-stealing-rfid-credit-card-data-is-easy.html

[Initech]

4. Rule of thumb: don't use any unmarked ATMs.

[MrScorpio]

7. Some stores upload data through comm nodes that can be gleaned by people with laptops

The links are unsecure as accessible at the time of the transaction.

Some people have mini card readers as well. These are unscrupulous clerks who swipe your card while you're not looking.

The scammers are out there In force.

[jmm]

8. Normally I avoid ATM's but...

a couple of summers ago while out with friends I needed some cash so I went to an outdoor ATM. When I completed the transaction my cash didn't come out. A guy walked up to us acting really sympathetic and went on about broken machines. As he was telling me it was hopeless to try playing with it I was able to reach in and pull out a debit card that was blocking my cash from coming out. I looked at him and said I'd let the card holder's bank know what happened.

There are some pretty low tech ATM scams out there too.

[rucky]

9. If an ATM skimming operation pays $400 to the BBB...

can they get an "A" rating?