ATM skimming crimes on rise

Criminals refine techniques to steal banking information

Some anti-skimming devices are blue or green semitransparent plastic casings that protrude from the card acceptance slots.

krebsonsecurity.com

A PIN-capture overlay device pulls back to reveal the legitimate entry pad. At its most basic, a skimmer is a device that fits over the card slot of an ATM and reads the magnetic strip on the card. Some criminals place a tiny camera to record a customer entering data.

On May 12, a sharp-eyed customer using an automated teller machine at a Fifth Third Bank branch on West Central Avenue in Sylvania Township noticed something strange attached to the ATM and decided to notify the police.

What investigators found was a "skimmer" -- a custom-made electronic device that attaches to an ATM in order to record and steal a customer's bank card data and personal identification number.

Five days later in downtown Cleveland's theater district, just blocks from the city's new Horseshoe Casino, a suspect was caught using fake bank cards to withdraw money from a Fifth Third ATM. The man, an illegal immigrant from Bulgaria, had 24 fake bank cards and $6,000 in cash on him during the arrest and had taken $21,000 from various Fifth Third accounts using data stolen from the Sylvania Township ATM, the Ohio State Highway Patrol said.

The incident was just the second known foiled ATM skimming attempt in northwest Ohio -- in 2007 two men were charged with placing skimmers on ATMs at Fifth Third Bank and KeyBank branches in Sylvania Township.

"It does happen a lot in certain parts of the country, but it happens around here very rarely," said Sgt. Joe Heffernan, a spokesman for the Toledo Police Department.

But the crime of ATM skimming, which mainly has been confined to larger East Coast metro areas and popular tourist destinations in the United States might be increasing in northern Ohio.

RELATED ARTICLE: 'Skimmer' found on bank ATM in Sylvania Township

In March in the city of Mentor, near Cleveland, police found a skimming device attached to an ATM belonging to a FirstMerit Bank branch. Police in the city of Euclid said they encountered skimming attempts in March and April.

Though numbers of actual skimming fraud are difficult to calculate, because many banks are loathe to make details public, security experts say they believe skimming is on the rise.

Identify theft and ATM security expert Robert Siciliano dubbed 2012 as "the Year of the Skimmer," while business advisory firm the Aite Group said the average loss per skimming crime ballooned from $30,000 in 2010 to $50,000 in 2011, and that the financial industry can expect greater losses as global crime rings refine their skimming techniques.

The U.S. Secret Service, which is handling the Sylvania Township case, estimates that ATM skimming losses total about $1 billion annually.

Financially, skimmers take less than half of 1 percent of money involved in the 14 billion ATM transactions annually in the United States. But when you consider that those transactions will involve nearly $1 trillion, the take is pretty substantial, according to the Electronic Funds Transfer Association.

"This skimming issue is not new, unfortunately. And you can buy a skimmer on the Internet, just like you can practically buy everything these days," said Kurt Helwig, executive director of the Electronic Funds Transfer Association.

"If I were to judge the size of the problem, it hasn't gone away. It's been around a good 10 or 15 years and it is growing," Mr. Helwig said.

What is a skimmer?

At its most basic, a skimmer is a device that fits over the card slot of an ATM and reads the magnetic strip on the card when it is inserted, capturing the data. Criminals also place a tiny camera nearby, usually disguised as a part of the ATM to record the customer entering their personal identification number on the ATM keypad.

In the early days of skimming, criminals would stand near an ATM and attempt to watch someone entering their PIN. Mr. Helwig said one famous case in New York involved a crude skimming device placed elsewhere on the machine with a note identifying the real card reader as a skimmer and directing customers to place their cards into the fake card reader.

"A lot of people did as the note instructed. That still really gets me," he said.

However, as the crime has evolved, so have the criminals' techniques, Mr. Helwig said. Criminals have upgraded from using hidden cameras to realistic-looking fake keypads that sit atop the real keypad and record customers' PINs.

"Some of these are … so sophisticated that maybe only an expert could see if they looked closely."

According to Brian Krebs, a former Washington Post reporter who now runs a security information Web site, KrebsOnSecurity.com, ATM skimmers have begun pairing fake keypad devices that steal PIN data with wireless devices that will transmit PINs to the criminals via text messages.

Mr. Krebs reported that other criminals have foiled anti-skimming measures by using 3D Printers -- devices that build 3D versions of an object -- to flawlessly match the shape and look of card readers on ATMs so that the fake device can be placed over the actual card reader.

Banks react

After the May 12 incident, Fifth Third spokesman Carla Nowak said the bank's Fraud Detection team had been contacting customers to alert them of the problem.

By law, skimming losses are covered by the bank and a customer does not lose any money.

The ATM at the affected Fifth Third branch is behind the building.

Fifth Third officials said the ATM is checked periodically by employees during times when the bank is open, but not when it is closed.

Some anti-skimming devices are blue or green semitransparent plastic casings that protrude from the card acceptance slots.

Mr. Helwig said it isn't surprising that the ATM was obscured from view. Criminals usually like to attach skimmers to ATMs where they are unlikely to be observed.

"In most cases, skimmers are usually detected on a Monday. Someone will put it on the ATM on a Friday after the bank closes and then monitor it over the weekend," Mr. Helwig said.

Barry Shaner, who is the CEO of Directions Credit Union, said he had been expecting a skimming attempt to occur locally for a while.

"Everything pops up here eventually. We've been aware of it for a while and have tried to be prepared for it," Mr. Shaner said.

"We have done some education for our members in the past because they're our first line of defense. We've asked our members to be aware and if they notice something different to tells us.

"That's how these things get found," Mr. Shaner said.

Foiling techniques

Fortunately, experts and law enforcement officials say there are some very simple techniques for foiling skimmers.

The best way, said Mark Knierim, a spokesman for KeyBank, is to check your account regularly, especially through online banking, for any suspicious transactions.

When using an ATM, the Secret Service and Federal Bureau of Investigation offer several tips:

Pay attention to the front of an ATM. If it looks different from others in the area (for example, if it has an extra mirror on the face), has a sticky residue or extra signage, be wary. If it has anything loose, crooked, or damaged, or if you notice scratches or adhesive residue, a skimming device might be attached.

Be vigilant about how it feels to type in your PIN. If it's difficult to strike the keys or the key's resistance feels odd, there could be a keypad overlay on the machine.

When in doubt, give the key card slot a small tug. If it loosens or comes off, alert the bank and police. If you find a skimming device, notify the police.

It's difficult to do when at a drive-thru ATM, but when entering your PIN, try to block the keypad with your other hand to prevent a possible hidden camera from recording your number.

If possible, use an ATM at an inside location because it provides less access for criminals to install skimmers. And always be careful of ATMs in tourist areas because they are popular targets of skimmers.

"Eventually, this will go away completely away because the industry is moving to placing a chip on the card that will make it more difficult to defraud because the information on the card will be encrypted," Mr. Helwig said.

But until that more expensive approach becomes widespread, the best defense is common sense, Mr. Helwig added.

"Just pay good attention. If something doesn't look right, trust your instincts. Don't use that ATM," he said.

Contact Jon Chavez at: jchavez@theblade.com or 419-724-6128.