ATM skimming explained

Print More

Laura Michaud works for the North Carolina State Employees Credit Union and is a graduate student at North Carolina State University. She wrote the following article for a graduate technology writing class at NC State.

At first glance, everything appears normal at the ATM. No one suspicious is lurking around. The area is filled with people. Then, you notice a piece of bulky plastic attached to the card slot. You examine it, but ultimately shrug and insert your card.

You are now $500 poorer and have just been victimized by a skimmer, and some of the newest identity theft technology to hit Raleigh. Here’s how it works:

Skimmers are electronic devices that are cleverly disguised to blend in with an ATM’s appearance. Their purpose is to record the information that is stored on the magnetic strips of debit and credit cards. “They sound complex, but they’re actually quite simple and can have devastating effects on their victims,” said Cory Mathes, a security officer at the North Carolina State Employees’ Credit Union (NCSECU).


A bulky plastic covering placed over an ATM card slot. Photo courtesy the North Carolina State Employees Credit Union.

Although you have been victimized by this technology, you are not alone. According to Raleigh police, four separate skimmer cases have been investigated since the beginning of 2009. Don’t let this small number fool you. It doesn’t include the many others who are in the process of reporting fraudulent activity on their accounts. If this frequency of fraud seems disturbing, wait until you see the lengths people go to in order to steal your account information.

ATM skimmers can have two different hardware parts: a card reader and a camera. The card reader is a plastic covering that is attached over the card slot using a sticky substance like glue or tape. This covering is usually bulky, but blends in because the color matches the ATM. “If the individuals involved want just the card numbers, they’ll stop there,” said Mathes. “If they want cash, they need cameras to record PIN numbers with.” The camera is hidden in a discrete object like a small mirror. “This object is attached further up on the ATM and has a pinhole at the bottom of it,” said Mathes. “The pinhole lets the camera view and record PIN numbers that are punched on the keypad below.”

ATM skimming pinhole camera
A pinhole camera used to capture ATM users’ PIN numbers. Photo courtesy The North Carolina State Employees Credit Union.

Skimmer investigations started in Raleigh about three years ago, according to Detective G.R. Bowman at the Raleigh Police Department. “In the past two years, skimmers have really hit us hard,” said Bowman. “It’s difficult to detect them and to figure out who’s involved.” Over the past year, NCSECU has investigated 12 to 15 skimmer cases. “Three of these were in Fayetteville and four were in the Raleigh/Cary area,” said Jon Mallaber, another security officer with the credit union.

Although NCSECU has already had its fair share of headaches with skimmers, other financial institutions share this burden. BB&T has also had cases of skimmer fraud and, like NCSECU, has found the problem to extend beyond just ATMs. “A skimmer can affect any machine where a credit card is accepted,” said Lisa Snyder, who works with fraud at BB&T. “This includes gas pumps, retail stores, and restaurants. We’ve already seen cases of each of these.” Although Raleigh is new to the skimmer scene, according to police and credit union security officers, other states, and indeed, countries are not.

In June 2009, for instance, investigators in California discovered that a Russian mafia member performed some inside skimmer work at a gas station, according to LA Weekly. By acting as a model employee, he was promoted and finally had the opportunity to implant a skimmer. After he vanished from the job, thousands of bank accounts in Southern California were drained using the personal information that the skimmer stole.

In early November 2009, Romanian police arrested 19 additional mafia ring members that used skimmers in Switzerland, Italy, France, and the United States, according to Wired.com. The article says police watched this group for 9 months before intercepting a package of circuit boards used to operate the skimmers. Foreign-made skimmer parts like these are actually commonplace among the skimmer suspects within the United States, who usually get the parts from their home countries.

“Skimmer hardware parts come from both overseas and within the United States, but most of the suspects are from foreign countries like Russia,” said Sarah Thompson, who works at NCSECU. “We would see more people using skimmers here if they were readily available in the United States.”

So the question remains of how this technology actually steals information. There are two different types of wireless transmissions that take place. The first uses Bluetooth technology. Once the hardware is attached to the ATM, someone in a nearby car downloads the information instantly onto a laptop as people perform their transactions. “This information is immediately uploaded to the Internet and put up for sale, usually to hackers or scam artists overseas,” said the credit union’s Mathes. Hours later, someone removes the hardware attachments from the ATM and leaves.

The other type of wireless transmission is through a router. After attaching the hardware to the ATM, the individual places a laptop and router at the bottom of a nearby trashcan. The router transmits the information from each transaction to the laptop. After several hours, the individual returns to remove the hardware and the laptop. “The stolen information is uploaded onto stolen blank gift cards,” said Mathes. “These cards can now be used to make in-store purchases. If these cards are used at an ATM to make cash withdrawals, they will be accompanied by the stolen PIN numbers that were recorded with the pinhole camera.”

ATM skimmer parts
Parts used to capture debit card information. Photo courtesy The North Carolina State Employees Credit Union.

Although ATM skimmers often consist of visible bulky parts, gas pump skimmers aren’t this easy to identify. “They are harder to detect because they fit discretely into the gas pump’s card slot,” said Thompson. Even hand-held skimmers often fly under the radar. “These types of card swipers are generally the ones you should look out for at a restaurant or retail store,” said Thompson. “No one should be swiping your card using a hand-held piece of plastic.”

Since skimmers show no prejudice when it comes to their victims’ bank accounts, financial institutions and law enforcement must all work together to combat this technology. NCSECU already has a system in place for any type of fraud. “Because of our agreement with VISA, we send out a CAMS (Compromised Account Management System) alert whenever we’re notified of fraudulent activity,” said Thompson. “This alert is sent to all financial institutions notifying them of the incident.” NCSECU also has fraud alert meetings once a month. These meetings encourage networking among law enforcement and financial institutions to foster better collaboration and communication.

NCSECU also works directly with law enforcement. “We provide photos from every instance and set up additional cameras in various locations at our ATMs,” said Jon Mallaber. “We pretty much have a reactive stance, meaning that we have procedures in place where the police are immediately contacted, but there’s not much else we can do.”

Although financial institutions and law enforcement work hard to minimize damage caused by skimmers, there are limitations to what they can do on their own. This makes it even more important for people to take bigger measures in protecting their finances. “First of all, use ATMs you’re familiar with,” said Melodie Lewis, a senior security officer at NCSECU. “It’s easier to detect abnormalities that way.” You should also be up-to-date on your financial statements. “Frequently checking up on your accounts means that you’re more likely to catch something unusual before it does too much damage,” said Lewis. “NCSECU also has time restrictions on when we can no longer reimburse your money that was stolen.” Regardless of what ATM you use, it also helps to conceal your fingers as you type in your PIN number. “This will make it harder for skimmer cameras to capture your finger movements,” said Snyder.

Ultimately, awareness is the key when protecting yourself from this dangerous technology. “Don’t be overly cautious to the point of panicking,” said Lewis. “It’s okay to use ATMs, but be familiar with them.” If anything, we should bring this awareness with us wherever we go. Perhaps more attention should be paid to issues that help skimmer fraud advance as far as it does.”

3 thoughts on “ATM skimming explained

  1. Why don’t you publish the names of the PLACES where this crime was committed. As a consumer and member of NCSECU, I feel you have failed to completely inform me and protect me from this type of criminal activity. I’d like to know the locations of these gas stations so I can use my debit card where it is safe!

  2. The response to this article by Susan Beddingfield goes to show what is wrong with the mindset of some of the idiots at large. Read the article again, Beddingfield. Laura Michaud is a graduate student (no doubt she is better educated than you) who wrote the article for a CLASS ASSIGNMENT. That means her objective was to write a clear, concise, and informative paper on a subject she no doubt had exposure to as an employee of the credit union. She doesn’t work for the local paper and her job was not to “completely inform and protect” you as you so ignorantly whined about in your response. If anything, Ms Michaud should be commended for writing a school paper on a topic the local newspaper felt worthy of picking up and adding to their recent edition. If you had any questions or concerns about the subject of ATM skimmers, the prudent response would be to contact your credit union for the answers you were looking for, not to cowardly attack a graduate student from the anonymity of your keyboard.

  3. ATM skimmer for sale, Magnetic strip card reader-writer, Portable card reader for sale.
    The Card reader-writer (china MSR series) comes with user manual, CD and USB cable. (Does not require power cable)
    The software is compatible to most card writer-reader and the Kit includes a software dvd (with full instructions),
    MSR206, Skimmer + Pinpad, and encryption key to decode dumps ,which are encrypted on the devices.
    The Portable reader MSR 500 (mini1, 2, 3) comes with batteries, USB cable and software.
    We offering you ours product,to a price accesible !!!

    1 ATM skimmer,
    USB Model skimmer + Pinpad:
    GSM Model skimmer + Pinpad:

    1 magnetic strip reader-writer
    1 Portable MSR 500 (mini1, 2, 3) Card reader.
    100 Magnetic strip cards
    Super Bundle € 1950 ,price includes World wide shipping.

    Please enquire for details.Contact & Payment Details.
    Payments accept is : Western Union & Money Gram.
    Shipping: Express 3 working days , overnight shipping : € 150
    Same day shipping after confirm payment.
    Now , choose what do you want to buy from us.