[ALERT] ATM Skimmer Scams On The Rise

How Does ATM Skimming Work?

ATM skimmers are a significant and growing threat in the world of financial fraud, targeting unsuspecting individuals who rely on ATMs for quick and convenient access to their money. It's estimated that ATM skimmers result in losses of over $2 billion each year. And the number of ATMs compromised by skimming increases 40% annually, according to the FICO Card Alert Service which monitors hundreds of thousands of ATMs for the nation’s banks.

Fraud investigators for a credit union in Taylorsville, Utah noticed an alarming number of members reporting ATM fraud. They notified police who found the suspects were using skimming devices they were putting on ATM machines at local 7-Eleven convenience stores. After reviewing video from the scenes, police arrested a 17-year-old and his parents, Florin Turtulea and Irina Donica. They found skimming devices and SD cards with financial transactions at their home.

But this small-town crime family is just one of many players in the skimming underground. In December, three men were arrested in connection with ATM skimming in Connecticut. And a month prior, six people were indicted for installing skimming devices on ATMs in the St. Louis area. Last summer, a credit union in Rhode Island was robbed of nearly $300,000 in a four-hour period, with an ATM skimming device. A quick search of news sites will turn up many other related stories.

ATM skimmers are small, hidden devices that criminals install at convenience stores, gas station pumps, and automated teller machines (ATMs). Skimmer devices have improved dramatically in recent years. A modern skimmer may be little thicker than a debit card, and slips invisibly into the same slot into which you slide your card. Some are installed as overlays on the card reader slot. Inside is a tiny computer, magnetic stripe reader, and storage device. When an unsuspecting victim uses the ATM, the skimmer reads the card’s critical data from the stripe.

After obtaining this information, the crooks may use it to make duplicate cards allowing them to drain customers' bank accounts, or use the information to conduct online transactions. Identity theft is a related concern. In addition to stealing money, thieves may apply for credit cards or loans in the victim's name using stolen card information to perpetrate identity theft. The victim's credit score and financial reputation may suffer long-term harm as a result of this, which may take months or even years to resolve.

Even if you have one of the newer cards with a chip built in, you could still be affected. Brian Krebs of Krebs on Security says "many chip-based cards issued by American and European banks alike still have cardholder data encoded on a magnetic stripe in addition to the chip." That article also gives details on the latest highly sophisticated super-thin skimming devices. Some are made specifically for hacking terminals at retail stores with self-checkout lanes.

Fortunately, consumers are rarely the ones who absorb skimming losses - directly, that is. Under the Electronic Funds Transfer Act (a 93-page PDF), consumers are generally not liable for funds stolen from their bank accounts via frauds such as skimming, as long as they report the losses within 60 days of their occurrence. Financial institutions take the hit directly -- but of course, they seek to recoup their losses from customers in other, legal ways. That estimated $2 billion in losses will result in higher fees and interest rates, which are passed along to consumers.

Capturing card data is only part of the fraud formula; the thief also needs your PIN. So tiny cameras are sometimes installed unobtrusively near the ATM’s keypad to record the buttons you press. Newer skimming devices incorporate infrared transmitters to send the captured data to the camera, so both your PIN and the card data can be captured. Some skimmer scammers even use overlays on the keypad, to capture your PIN.

Many ATMs now have plastic shields around their keypads, and banks urge you to cover the keypad with your hand while entering your PIN, even if no one is looking over your shoulder. I've always used the "two finger method" for entering my PIN number at the ATM. Point two fingers at the keypad, but only press with one. This makes it impossible for hidden cameras or anyone nearby to see what numbers you actually press.

How Are ATMs Protected?

Bank-owned ATMs are usually rigorously policed by the banks themselves. They send out inspectors to check ATMs for skimmers. But non-bank ATMs, such as the standalone machines found in convenience stores, are not so vigilantly policed. FICO reports that 60% of skimmer-compromised ATMs are non-bank machines. So you may want to avoid them to reduce your chance of being skimmed.

You should be especially careful when using non-bank ATM machines in tourist locations. Security researcher Brian Krebs wrote a fascinating article, Who’s Behind Bluetooth Skimming in Mexico? which details how ATMs in popular Mexican tourist destinations were being hacked. But the problem isn't limited to the withdrawal of cash at automated teller machines. Point of sale terminals at gas stations and other retail locations that aren't under constant surveillance can also be compromised. Any time you swipe your card, you should be wary.

So-called chipped cards are not invulnerable to skimming yet. Many U.S. merchants have not upgraded their card readers to use this enhanced security, so chipped cards still have the magnetic strips that skimmers can read. Banks can hardly wait for all card readers to be upgraded so that the magnetic strip can finally be eliminated. Many are offering merchants incentives and penalties to push them into this upgrade. Check your debit or credit card, you'll probably see it has a "mag strip" on the back.

Telltale signs that an ATM may harbor a skimmer include a card slot housing that seems loose or wiggly; glue around the housing; and unusual difficulty inserting your card. If you stick to using just a few bank ATMs, anything unusual that appears in them will be more readily apparent to you.

Sixty Days or Six Hundred Dollars?

With skimming skyrocketing, your best defense is to monitor your bank accounts for unusual activity regularly, and report any unauthorized transactions well within the 60-day time limit. Your bank may offer notifications for ATM transactions, which can alert you to unauthorized activity quickly.

Even though the law protects you against losses due to fraud, you may find yourself out some serious money for a few days or weeks while your bank processes your fraud claim. The average amount of money lost per skimmed card is $600, according to FICO. That’s not chump change for most of us.

Have you or someone you know been skimmed by the scum that schemes to scam, as you withdraw funds from an ATM? Your thoughts on this topic are welcome. Post your comment or question below...