Visual Autopsy Of An ATM Card Skimmer

Bert64 writes "A chap at work was recently the victim of an ATM card skimmer which took his card details, cloned them and allowed the fraudster to take 550 pounds out of his account. Having tried to explain how the fraudsters can hide a camera and card reader around the ATM, he decided it would be easier to show one of them after a few drinks down the pub. He was a little surprised to find that the machine he chose had a card reader and camera in place. These were removed and analysed, we believe we have reclaimed about 800 pounds worth of kit. Result: Pictures."

Mirror in case of /.

[mixy1plik]

This is a bit creepy. I always wonder when I hit those run-down ATMs in the corner of convenience stores if I might have my card nabbed.
I've stopped using some of the sketchier ATMs because of this.

MIRROR HERE IN CASE OF A /.'ING [sr20.net]

This is how Skimmer works

[maliabu]

in case you're wondering:

To accomplish this task, the thief places an electronic "skimmer" -- a card swipe device that reads the information on the card's magnetic strip -- on the ATM machine. Attached to the device, or placed discreetly elsewhere, is a small camera that captures the customer's PIN number when they enter it. The information is either collected by the device, or transmitted to a remote receiver. The thief then takes the codes and creates a counterfeit ATM card in order to empty the victim's bank account. Some skimmers can even capture the information and send it to the ATM at the same time. Since the machine works normally, the victim is unaware that they have just given a thief the key to their account. copied from here [state.fl.us].

Re:Makes you wonder

[mattjb0010]

Is there any way to get your money back, or is it gone forever?

In the terms of my credit/debit card it says if I notify the bank within a reasonable time period of unauthorized transactions I get the money back. I suspect most banks have a similar deal.

Another interesting link:

[amarodeeps]

Saw this recently on memepool.com:

http://www.utexas.edu/admin/utpd/atm.html [utexas.edu]

Re:Makes you wonder

[big_groo]

This happened to my friends - luckily they were both out of town at the time, and *used* each of their bank cards. The bank gave them an automatic, free overdraft for the amount taken, but it took them about a week to get the money back. (TD Canada Trust, in case you were wondering)

Banks are insured, y'know...but I have to wonder, if they weren't out of town (and able to prove it) would they have been so forthcoming?

Conversion into European mainland's monetary unit

[tepples]

calculator say: [x-rates.com] 550 GBP = 1027 USD = 817 EUR

Re:Here is what I do

[Abcd1234]

Actually, correct me if I'm wrong, but with credit cards, my understanding is that you get nailed for interest the *second* you pull the cash out, unlike purchases, where the interest is calculated at the end of the month.

Re:This only works with poorly designed ATMs

[Giddeon]

If you look at the site amarodeeps linked to in his comment [slashdot.org], a cardstealer like the one shown would be able to steal swipes without too much difficulty. If you haven't seen the ATM before and don't know what it is supposed to look like, it will look quite natural. Most folks don't use the same ATM often enough to remember that the card guides on the sides weren't there last time.

Re:Mirror in case of /.

[Anonymous Coward]

The real mirror:

http://pbx.mine.nu/mirror/atm.ev6.net/ [pbx.mine.nu]

(The site does feel kinda slow)

Re:Easy as Ebay

[rot26]

Not brain surgery but more sophisticated than a tape head connected to a serial port. Since the speed of the card over the head is expected to have a wide speed range, the reader has to have its own adaptive clock circuitry in it to decode the card, and THEN it's converted to rs-232 or CMOS level signals.

Re:Does anyone remember the 80s cable movie...

[nfotxn]

You don't mean Sneakers [imdb.com], do you?

This happened at a Mall near my house in CT in '93

[phpsocialclub]

At
the Buckland Hills Mall, in Manchester CT, in 1993, some scam artists
installed a fake ATM machine. They had negotiated with the Mall officers,
pretending to be Bank officials, and had gotten permission. Apparently, they
even got the phone company to come in and lay down some lines. Then, they
installed an ATM machine they had stolen.

It was programmed to read off the account numbers, remember the PIN as it was
typed, then claim some kind of error and refuse to give out money. They left
the machine in the mall for a WEEK, collecting PINs, then they came back, took
it machine back to "repair", and have since printed up new cards, and have been using the PINs to siphon off money.....

I think they got about $250,000 before the FBI got them

Re:Easy as Ebay

[Cramer]

That can be done on a single, tiny chip these days.

Re:This only works with poorly designed ATMs

[SmallFurryCreature]

I was thinking the same thing but this looks like it would just fit right over such a machine. It is basiclally a block with a slot in it to house the reader. but it wouldn't interfere with the atm at all.

As to how odd it looks. Well that is hard to say without seeing the original setup or even the machine to wich it was attached. Now it looks like an old movie prop. He should have taken a photo as it was in place.

Oh well, better be extra carefull.

For a related article...

[qw(name)]

Check out this advisory [utexas.edu] put out by the Univ of Texas, Austin.

Re:Here is what I do

[mcheu]

1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.

You then end up paying a debit fee instead. Admittedly, it's lower than a 3rd party ATM fee, but it's still more expensive than going to an ATM owned by your home bank. Further, a lot of stores don't want to do this, because:

a) In one small pissant purchase, you've cleared out the register of cash, which makes it difficult to give change to the next customer.

b) The store has to pay a debit fee with each transaction. Whoopie, you've bought an 80cent pack of gum (on which only 20 cents profit at most), and are asking the guy to incur 50cents to 75cents worth of debit fees on his end. This is why some stores have a minimum purchase requirement to use debit.

Also, your definition of "no risk" may not be the same as mine. There have been instances in Canada where some of these scammers have set up shop in a real shop. This is how it's done. The first time they swipe your card through, they swipe it through a slot near the real one, and claim the card was rejected or didn't read right. The second time, the card is swiped through the real one and a the real transaction happens. All the while, the "clerk" is watching you enter your PIN, and he's got a copy of your card now. Perhaps this is why the store doesn't have a problem with giving you a cash advance and being hit by the vendor debit fees on such a small item.

I'm not saying that every instance where your card gets rejected is a scam, since it does happen that a card will be unreadable or rejected. I'm just saying there's still some risk involved.

2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.

What, do you work for a credit card company? Unlike credit card purchases which hit you with interest only if you pay late, cash advances put interest on what you owe the instant you get the cash. You've already mentioned the high interest rate. Even if you pay quickly and on time, a credit card advance will have a nasty surprise attached.

Re:Easy as Ebay

[damien_kane]

If you're going to go to the trouble to tell people that POS is not an acronym for piece of shit, you could at least have mentioned that it does does stand for Point of Sale (in this case)
Otherwise, I agree wholeheartedly, mod parent up and all that jazz...

Re:Here is what I do

[vanillacoke]

The big banks charge no such fee for using ATM (wells fargo, BofA, ect..), unless its a people republic of california thing....

Recent spat in Canada

[kbahey]

These skimming devices were commonly detected in Canada (Ontario) during the last year or so.

They are becoming more and more sophisticated, and the police busted several people for it, and issued precautions for the public:

- Try to use machines in the bank branch you deal with
- Try to avoid machines in public places (malls, convenience stores, ...etc)
- Report anything that looks suspicious on a machine

Re:Mirror in case of /.

[Blymie]

In Canada, it doesn't matter whether or not the bank "wants to press charges". If a crime has been committed, the police can proceed without anyone pressing anything.

Why?

Well, a prime example is if the mob is threatening someone to "withdraw" his charge. In Canada, it doesn't matter _what_ the victim says, if it looks like a crime took place, charges will be laid and courts will be involved.

I imagine this "story" about an immigrant was one of those mouth to ear stories, that tends to get altered every time it is repeated.

Re:shouldn't ATM machines be designed better?

[odsign]

That's the thing. The ATM's don't read it. The ATM says, 'Hey, bucko. Encrypt this with your private key.' The card does so, the ATM decrypts it with the public key, and when the result is the same, you know it's the right card, without anybody except the card knowing its key.

Re:metaphotos, thumbprint readers

[Anonymous Coward]

Read about the method of replicating someone else's fingerprint here: http://www.schneier.com/crypto-gram-0205.html [schneier.com]

For any biometric, once there is a way to trick it, you are screwed. You can't change your fingerprint like you can get a new password, and the massive infrastructure investment in the biometric system pretty much guarantees the bureaucracy will just try to pretend it isn't happening.

Re:Why use a camera?

[Dnigh]

The scammers don't have full access to the atm...

They can only add hardware in front of the card reader. So they need the camera to read the PIN as it is typed in, they cannot modify the hardware/software inside of the atm.

Personally I would be more worried about the fact that a large number of ATMs in the world still use single DES.

Dusting for Fingerprints

[Zapdos]

Is out of the question now. It is against the law to destroy a crime scene, or tamper with evidence. Regardless of police involvement, the person taking this device knew what it was, he therefore committed the crime of destroying evidence. The person who stole the card info just got away, but how about the people who just destroyed this evidence?

Re:IR LEDs

[gordguide]

Just a guess here, but if they really were red/infared spectrum LEDs its more likely they are used to illuminate your face to be recorded by an infared camera. Most newer security cameras can switch from daylight to IR as light levels change.

True infared-only lamps appear totally black to humans, by the way, as does the filter over the camera lens. But it's also common to use near-infared systems that will glow/look red to us (they're cheaper).

Skimmer with Radio Transmitter

[csk_1975]

The ones in Hong Kong use radio transmitters instead of flash cards. Here is a picture of one [imagedeposit.com] installed on an ATM. Pretty hard to see, huh? Also here is the police report:-

Crime Information : Skimming Device Installed in ATM (TW RN04000499)

Location : Two ATMs outside Hang Seng Bank, Tai Ho Road.

Facts: On 2004.01.05, ATM maintenance worker of Hang Seng Bank conducted a routine check and confirmed that 2 metal covers (of same design) were being 'fitted' onto the top ledges of two of the ATM machines.

The Skimming Device:-

• i) the metal covers, 60cm x 4cm x 2cm in size, painted in the same colour as the ATM, were installed perfectly onto the top ledge of the ATM panel;

• ii) a pinhole camera lens was installed inside the metal cover facing the screen panel with a view to reading the pin number. This was connected to a transmitter which has an emitting range of about 200M and could work for 9-12 hours with three 9-watt batteries, and

• iii) a false card reader was believed to have been fixed to the card slot of the ATM but had been removed prior to being discovered.

• iv) This is the first time that a device of this nature was placed in such a busy location. The device was first reported by a bank customer on 2004.01.04 but no action was taken by the bank until 2004.01.05. CCB will follow-up on this issue.

Re:An idea

[glorf]

Because the Americans with Disabilities Act forces even drive-thru ATMs to have braille. Never mind the fact that the on screen displays aren't standardized and the prompts point to different buttons at different banks. Any system you come up with that requires a sighted person to operate will not work.

Re:Here is what I do

[cyt0plas]

1) Some merchants charge fees. Many don't as it's cheaper than credit.

2) Some merchants offer cashback as an _incentive_ to get your business.

3) If you clean out the register at a medium to large shop (small shops can be different), you've saved them the trouble. That's that much less cash for them to send out to be converted electronically. Also, it's less cash to send out on armored cars (depending on the size of the merchant).

4) For the places that eat the $0.20 fedwire (Automated Clearing House) fees, it's typically less than the cost of a credit card, and they often don't have to pay a percentage. Buying nothing more than a pack of gum means they lose money, but they run that risk with a Credit Card too.

Re:prevention ...

[morcheeba]

good idea, but I'll bet most cameras will record some sort of rudimentary audio, so the loud beeps will inidicate the correct presses. To verify this claim, I just researched the U50 and found it doesn't record sound... but I know eventually the small cameras will. Even the chip in the $11 Ritz Dakota disposable records sound (but it's not bonded out on the package they use).

Re:This only works with poorly designed ATMs

[don.g]

This is only the case if you have many dissimilar ATMs. In a small country (New Zealand) with only a handful of major banks and no such thing as a "private ATM" (EFTPOS is hugely popular, though) most people use their own bank's ATMs because they're cheaper... and they're all the same. It'd be harder to put cards in one with a skimmer on (at least for my bank) so I'd notice pretty quickly that there was something odd.

Of course, many people will probably just assume it's a new model of ATM. Sigh.

Re:Mirror in case of /.

[MKalus]

Try this [cfra.com].

Of course, news.google.ca [google.ca] is your friend.

Re:550 Pounds of money?!?!?!?

[Anonymous Coward]

It was the pace of a Roman Soldier:

Roman pace - an ancient Roman unit of length (4.85 English feet) measured as the distance from the heel of one foot to the heel of the same foot when next it touches the ground

ALso, check out the Glossary of Ancient Weights and Measures at http://www.hemyockcastle.co.uk/measure.htm

Roman pace (passus):

5 Roman feet. 58 inches (approx). Double step. ...
Roman mile (milia):
5000 Roman feet. 1000 Roman passus. 8 Roman stadia. Approx 4860 modern feet.

English & USA mile:
5280 feet. 1760 yards. 8 furlongs. 80 chains. Changed from 5000 feet during the reign of Queen Elizabeth I

That page also mentions:

Inch:
10 lines. 1000 thou. or mils. Width of man's thumb, length of 3 barley corns (Anglo-Saxon).

Yard:
3 feet. Length of man's pace. Man's reach from nose to finger tip.

Of course, I never claimed these are 100% accurate. All I claimed was that they related to the real world better than Metric measures do.

Re:Mirror in case of /.

[Anonymous Coward]

Try this:
CBC [www.cbc.ca]

Re:Here is what I do

[shepd]

>b) The store has to pay a debit fee with each transaction. Whoopie, you've bought an 80cent pack of gum (on which only 20 cents profit at most), and are asking the guy to incur 50cents to 75cents worth of debit fees on his end. This is why some stores have a minimum purchase requirement to use debit.

I dunno about where you are, but my store pays 15 cents CDN per debit transaction. The 50 cents thing is just a way to rip you off in stores that are cutting a thin dime on profits to purposely undercut the competition (such as us). Of course, you only get the customer once when you do nasty tricks like that...

Also, the 3 - 4% some shops charge on non-cash purchases is a load of bunk too. We're a new shop, the worst percentage you should be getting charged is 2.8% (that's what we're charged). However, as we're with the BBB (YAY! More protection fees!), next year it will be the 1.8% that most established shops should be paying.

As far as cashback, if people asked for it, I'd deal with it. Since nobody has asked, I haven't bothered. Even if someone did, they wouldn't get much more than $40, as that's all I try to keep in the till at max.

Change hasn't been a problem. My estimate is about 4 cash transactions out of about 40 - 50 a week (it's the low season right now). We saw a bit more cash at Christmas, but that's how people budget (if they're smart).

If your store is hurting so bad that you have to sqeeze $0.35 or 1.2% extra from a customer, put yourself out of your misery. Seriously. You're screwed.

>Even if you pay quickly and on time, a credit card advance will have a nasty surprise attached.

Ain't that the truth. :-S

Re: Metric System

[Frogbert]

<nitpick>
Actualy the Human hand is base 11 because you have 10 fingers and zero is represented with no fingers being up. If you were to grow two more fingers you would have a base 13 pair of hands and that would be way out.
</nitpick>

IIRC If we were going for optimism we would have e/2 fingers on each hand however IANAMP (I am not a maths prof.)

Re:Here is what I do

[mashx]

From my experience, the difference is between Mastercard and Visa: others like Amex Blue follow one or the other I suppose:

Mastercard: No interest charged until end of month, and then lowest interest amounts charged first cascading down, unless payments have been made in which case the lowest interest bearing amounts are deducted first (i.e. the highest interest accruing amounts they try to leave until last).

Visa: Interest charged from next day

Admittedly I have only experience of UK and US cards, and I know that there are great variations in Europe (no-one in UK would pay an annual fee for a credit card, whereas no-one in France thinks twice about paying it) but that seems to be the general rule. I have had a Mastercard as explained above, where cash started to accrue immediately, but this is the exception in the UK.

Re:Questionably Legal???

[Avakado]

In some countries (or maybe only Norway), whenever your ATM card is used in an ATM machine, the machine writes a new unique code to the magnet strip. The next time you use the card, it must contain that specific code, or it is swallowed.

Sadly, the terminals used in stores cannot do this, so you have to use your card in an ATM every now and then, to make sure nobody has a copy of it (quite the opposite of the problem mentioned in this article).

Re:An idea

[Lumpy]

actually the US post offices use a entry keypad kind of like that.

all 12 keys have a 7 segment display behind them. every time the keypad is activated the numbers displayed are scrambled, you type your 4 digit pin and voila. someone standing there or recording the keypad will get NOTHING.

Old tech, it's just that ATM's are designed for durability as most people are so stupid as to bash on the things or really stupid kids that get jollies out of destruction...

Happened to me...

[jbrw]

...almost.

Went to take some money out late one night. There were about three (eastern european) guys huddled around the machine fiddling. Went to get money out, and the machine held out to my card - you could see the card in the slot, but couldn't get it out. Guys reappear and tell me something like "Oh. I've seen this before. Press blah, blah, blah and enter your PIN" while standing over me. Hmm, I don't think so...

So, I step back call my bank, wait on hold for an age, and as soon as they hear me confirm to the bank I want to cancel my card, I get my card thrown back at me by said guys, and they scarper into a car that has subsequently double parked.

I reported it to the local police station, and they said it happens all the time, but it wasn't actually a crime until they withdrew money (!!!).

It's called a "Lebanese Loop". More info here:

http://hoaxinfo.com/atmscam.htm [hoaxinfo.com]

I see plenty of machines in London with glue residue around the card slot. This must happen all the time...

Re:Insert Your Card Machines Only?

[Syclone]

"As for swipe ATMs, my major worry (as a bank operator) would be that I would expect that they would be more prone to mechanical failure (from ease of dust building up, people spilling coffee, etc) than an insert ATM."

Actually, it is the opposite. There is a much higher failure rate on motorized readers that take the card into the machine. Moving parts vs no movie parts, and all of that. With a motorized reader, you can get jams, misalignments between the internal reader and the face of the machine, etc. We see much higher failure rates on these.

As I said below in another reply, dip/swipe readers only generally allow one transaction per insertion, and unless you walk away from the machine before doing a transaction and somebody immediately walks up behind you, it is not a likely problem. Also, cash is generally sucked back into the machine after a given interval on most dispensers (around 30 seconds). There are a few machine types that have what we call "spray" dispensers that completely let go of the cash and cannot suck the money back in. Most of these are old models, though.

If a machine sucks your cash in because you didn't get it in time, in the US, you just go to your bank and file a Reg E dispute. This kicks off research of the transaction, and the bank can tell if you didn't get your money and will credit you back.

Re:Here is what I do

[Elvisisdead]

It's my understanding that on a merchant account, the fee for processing a credit card transaction is only around $.30 USD for Visa, MC, Discover, etc. I'm not sure, but I think American Express always charges a percentage, which is why they're not accepted everywhere.

I agree that they increase prices to cover those expenses, though. That's why my dirt-cheap dry-cleaner only accepts cash. He keeps his prices low because he doesn't have to account for "alternate payment overhead".

/. as personal security tool

[alazar]

I am always learning so much on /. Now I'll also consider it as a personal security site.

I will reluctantly admit to not knowing about this sort of scam, although I am not at all surprised. Working in New York City, I'll bet it's an issue. So now I will change my ATM behavior.

1. Only use ATMs at the larger, reputable institutions. Not that that's a panacea, but at least I'd have a machine to talk to should an issue arise. I'd also like to believe that they are more diligent about ATM security.

2. Don't use the stand-alone ATMs anywhere, regardless of the institution on the placard.

3. Conceal my PIN: use false button presses, slow, staggered timing.

4. Be aware of the environment. Is there anything that might be a skimmer and/or camera?

5. Be even more diligent about recording my ATM transaction.

Since my credit union has only 1 ATM, very far from where I live and work, it would be impossible for me to limit myself to their machines, that I'd do that if I could.

I wish there were a way to promote/encourage a more secure technology. But I'd also like to solve world hunger too.

Re:Questionably Legal???

[Anonymous Coward]

Because that magnetic stripe includes quite a bit more info than the card number. Including bank information, the cardholder name, expiry, the card TYPE and some other stuff. Granted, you can get MOST of that info with a picture of the front of the card, but not ALL.

Re:Here is what I do

[TClevenger]

It's my understanding that on a merchant account, the fee for processing a credit card transaction is only around $.30 USD for Visa, MC, Discover, etc.

All of the major cards charge a percentage plus a per-transaction fee. (Some can price it 'bundled', but the two components are usually there.) Higher rates are charged for manually keyed transactions. ATM fees are a flat $.20 to $.50 per transaction, depending on the merchant's volume.