ATM skimmers work by collecting enough debit or credit card information for scammers to create a new credit or debit card and use it. Several components go into a traditional ATM skimmer. First is a piece that fits over the slot where the card is slipped into the reader. The second piece is a hidden camera that films keypad action. The skimmer reads the data on the card’s magnetic strip and the pinhole camera captures the personal identification number as the victim keys it in. More high tech skimmers are able to send the data to a cell phone.
ATM skimming is a lucrative crime that gives virtually untraceable access to unsuspecting victim’s bank accounts. In February, 7 individuals were arrested in Toronto. According to CBC news, the suspects were part of an international ring that had collected information from 1,500 cards and cost Canadian banks over $360,000. The card information had been used in fraudulent transactions in Bulgaria, the U.S., Chile, South Africa, the Dominican Republic and Mexico. As a result, the authorities dubbed the investigation “Project Holiday”.
In the past, ATM skimmer designers showed great skill in hand crafting the device components, often matching the skimmers to the exact style and color of the ATM machine.
The pinhole cameras and other components are often cannibalized from handheld electronic devices. In some cases, an old MP3 player can be broken down and the information is “heard” by the components. According to Krebs On Security,
“…the MP3 player “hears” the data stored on the card’s magnetic stripe, and records it as an audio file to a tiny embedded flash memory device.”
According to Techneer, a more advanced version of high tech ATM skimming involves using 3D printers to make perfectly detailed components that will fit a particular ATM machine. The printers create precisely detailed parts in a way that is difficult for anyone but an observant ATM technician to discover. 3D printing has been going on for years where printing devices build a three dimensional item with a set of design instructions and a mix of polymer and liquid. Since a 3D printer can go for up to $30,000, the ATM skimming operation has to be successful.
At an even more advanced level, skimmers are coming equipped with cell phone access where the skimmed information is converted to a text message that goes straight to the thieves cell phones. These are called GSM Cell Phone skimmers.
In some cases, the camera component is placed away from the ATM, concealed in a security mirror or brochure rack. If two ATMs are present, the scammers will place an “out of order” sign on the ATM that does not have the camera aimed at it.
The challenge for ATM skimming technicians lies in first, creating a convincing setup that will not be discovered by ATM technicians or merchants. Then the equipment has to be installed and removed before it is discovered. Custom made skimmers can cost $7,000 or more, but hundreds of cards can be read before the device is successfully removed for reuse at another location. In this way, an ATM skimming operation may only go on for a few hours and with personnel keeping an eye on the operation at all times.
Anti ATM skimming technology begins with pieces that protrude from the card acceptance slot in a way that makes it difficult to attach a skimmer device. But scammers simply manufacture skimmers that look like those attachments, so it looks like ATM skimming will continue to be a high tech scourge.
According to ZD Net, many other tactics are being developed, including better customer education, daily monitoring or regular checks by bank personnel, algorithms that identify potentially suspicious card use, and a device inside the ATM that can tell if a skimmer has been installed. Finally better chips can go into the debit or credit card to encrypt the card data. Better encryption would make it impossible for the scammers to decode and use the information.
ATM skimming is not going to go away, but with better ATM and card technology perhaps the skimming can be made more difficult.
The Consumerist has a video that will show how the traditional machine skimmer operation works from start to finish.
Krebs On Security has a comprehensive discussion of ATM skimmers and how they work.