After hours, swiping your bank card through the reader (at left) unlocks doors (at right) allowing access to ATMs in the bank’s locked foyer.
Ever use an ATM at a bank after hours? Was it inside a locked vestibule, where you had to swipe your bank card to unlock the door to enter the antechamber?
Chase Bank branches in and around Las Vegas have found card skimmers on their doors, enabling thieves to capture bank card info without tampering with the ATM at all. At the cash machines, all the thieves need are pinhole cameras to record the PINs.
And of course, alone and private in a locked bank foyer, who shields his PIN as it is poked onto the keypad?
Very clever thieves. Expect to find this latest technique at a bank near you.
[dropcap letter=”F”]irst there was skimming, now there’s shimming,” says Kim Thomas, former Las Vegas Metro Detective, now an international authority on forgery. Information on this new credit card acquisition technique comes via a Citibank investigator.
Now, looking for parts stuck onto the front of a cash machine, which might indicate fraudulent activity, is not enough. A shimmer does the work of a skimmer, but is housed completely inside the card slot of an ATM. In other words, entirely invisible to users.
Shimming
Kim Thomas describes the shim-skimmer: “The thief makes a circuit board the size of a credit card, but approximately .1 mm thick. They use a carrier card to insert the device. Basically it is a reader-transmitter. The reader does what the usual credit card skimmer does: capture full track data. The transmitter does what bluetooth does: transmit the track data to a receiver. The technology is pretty sophisticated and will be hard to catch once it goes into mass production.”
According to Jamey Heary, Cisco Security Expert, “effective flexible shims are recently being mass produced and widely used in certain parts of Europe.” He diagrams the physical layout of this “man-in-the-middle” attack as installed inside a card-reader.
I haven’t found anyone who has actually seen one of these shimmers, but no one’s calling it just a proof-of-concept, either. It isn’t clear to me whether or not the shimmer works with U.S. credit cards that lack the chip-and-PIN. Anyone know more about this?
I read the post you did with my picture. It was very impressive. At the end you said a thief attached a skimmer in eight minutes. I just wanted to give you a small correction. We found that the one on the side of the gas pump drawer was attached in about 11 seconds, so if you add in opening the door, you’re looking at about 30 seconds (and that’s us fumbling with the key). So here’s the process: put the key in the lock, open the door, slide out the drawer, unplug the two cables from the gas pump connectors (keypad and reader cables), slap on the device, plug the two gas pump cables into the skimmer, plug the skimmer cables into the gas pump connectors, slide the drawer in, close the outside door, turn the key, remove it, test with a known credit card (outside the process of hooking the skimmer because anyone seeing you do that would assume you’ve doing something legitimate. Sounds like a lot, but look at a watch, close your eyes, and envision the process, then look at the watch and see what kind of time you get. It’ll probably amaze you. Now imagine practicing it a bit on your own gas pump either in your storage unit or living room or buddy’s gas pump. Now you’ve gotten faster and smoother, so you’re faster. See?
Thomas continues on the frightening trajectory of credit card fraud:
This type of crime used to be done strictly by hi-tech crews, but now we’re seeing it done by Joe and Julie the tweeker people (common street criminals), the traditional black crews who used to be just check passers and bust-out crooks, and the Hispanic immigrant groups who have always supplied ID documents (to name a few groups). There’s just so much money and property in this.
A hotel loyalty card and its data showing on a skimmer
I just asked for a warrant on a member of a group of rich college kids (who bought a $7,500.00 watch in a high end Fashion Show Mall store) who have been buying numbers skimmed from American hotel chains in Europe, then using that track data to make counterfeits (this is a good way to do it because the cards are from American customers and less likely to raise a red flag with the bank looking at the transaction since it’s used in the US), which they then use at stores here, in SoCal, and in Arizona. They then take the property and sell it. The kicker is that all these kids are Mexican nationals whose parents are so wealthy they have their kids going to school at American Universities.
A tiny skimmer removed from an ATM way back in 2006.
A reader wrote of an ATM experience which, soon after, led to $9,000 in fraudulent withdrawals. He was abroad, but this happens at ATMs everywhere; and so frequently that I think it’s worth posting as a reminder.
As I was using an atm at a money exchange kiosk, I received the cash I wanted but was unable to get my card back. The man in back of me told me I had to enter my pin number again in order to have the card returned. He even reached in front of me and hit some buttons and told me to enter my pin. I did so and after a slight wait, the card came back. The experience was unsettling because I had never heard of entering a pin number a second time to get your card back after a transaction and no one had ever brazenly reached in front of me to assist me at an atm. Since I received my cash and finally my card, I felt everything was fine. But that was the day the mysterious withdrawals began.
I called my bank as soon as I realized there was a problem. The woman I spoke with immediately closed the credit card account linked to my atm card. Within a couple weeks, the bank had deposited the total of the disputed withdrawals into my account.
There are two essential goodies the card fraudster needs: the info on your card and your PIN. Info on the card can be gained in many ways. A snapshot can be taken of it with a cellphone camera, an imprint can be made, or a skimmer can be attached to the ATM itself. Nowadays, skimmers can be tiny and imperceptible. The vital PIN can be easily obtained by the crafty thief’s strategy. The example above is a classic: the false samaritan. The fraudster offers help in order to gain what he needs. Sometimes these “samaritans” even make cellphone calls to helplines, handing the phone to the mark; but the person on the other end of the phone call is the fraudster’s colleague, who pretends to be a bank official.
To protect against these scams, first, don’t use an ATM that looks suspicious in any way. Unfortunately, they usually don’t look suspicious, even if they’ve been tampered with. Second, shield your PIN with your hand as you enter it. A wireless video camera may be mounted to capture the entry of your PIN. The illicit video camera, which is only the size of a sugar cube, might be in front of you, so your body won’t block it. Use your hand. Third, if your card gets stuck, get suspicious! Do NOT accept help from a stranger. Walk away from the card if you must, but do not give up your PIN. And lastly, always suspect the stranger who enters your personal sphere. That’s just not natural. He or she is after something—of yours!
It’s sad that we must suspect a friendly stranger, but a look at identity theft statistics is enough to convince anyone that it’s better to be safe than sorry. Ruthless, creative scammers specialize in benevolence, and they’re darn convincing. CONvincing, as in gaining your CONfidence. That’s why they’re called CON artists!
A shoulder-surfer in Stockholm gets seniors' PIN, then steals their ATM card.
I want to wail even in Sweden, because the country has long been perceived as enjoying a relatively low crime rate. And it did. But not any more.
The day I arrived in Stockholm, the paper featured a spread on thieves lurking at ATMs who preyed on the elderly. The scam stars a shoulder-surfer lying in wait for seniors to come use a cash machine. He watches them enter their PINs, then tricks them into allowing their bank card to be physically stolen in one way or another. The thief may ask to change a ten crown note, or may meet the mark at the parking meter and ask for a small coin. Anything to get the mark’s wallet out.
One wallet, many hands.
Then what? “Magic arts,” one victim said. “Finger magic,” said the police. Hard to believe that a bank card can be stolen from a victim’s wallet right under his nose. Yet, Bob and I recognize the trick we call the “flower gift lift,” as practiced by women in Palma de Mallorca (and I’m sure other places, too). It’s forceful, brazen, devious, and it works. I’ve written about that here.
The Stockholm shoulder-surfer was part of an international gang from Romania. He and one other were sentenced to a few years in prison. Police say they’ve operated all over Sweden, targeting the elderly and handicapped. ATM surveillance photos show victims in wheelchairs and using walkers.
At around the same time. a community newspaper warned of “false policemen” also targeting seniors at ATMs. The thieves convinced the seniors that they needed their bank cards and PINs in order to control illegal withdrawals. Police report additional ploys: door-to-door police impostors warn of burglaries in the neighborhood and want to photograph jewelry and valuables. Whatever the ploy, the thief gets in—cash and valuables go out.
Graph from www.bra.se
As I was writing this, the evening news came on. Seems some scammers are knocking on seniors’ doors to give them tips about H1N1. Rather, one scammer knocks and talks. While the senior is occupied, the other slips in and robs the resident.
Meanwhile, last month, police saw for the first time credit cards being skimmed at gas pumps. “So far police have no suspects and haven’t been able to determine how the skimming operation has been carried out.” I have advised them!
Skimmers have been found attached to ATMs at Ikea and a Stockholm Toys R Us store. There was a home invasion in the sleepy suburb where my family lives.
What has Sweden come to?
Would you notice if a skimmer were attached to an ATM?
Skimmers, officially called magnetic card readers, capture the data on a card’s magnetic strip. Exactly what information is that?
Credit and debit cards have three “tracks” of data. Track 1 stores your name, account number and expiration date, and discretionary data to verify the PIN and security code. This information goes to the point of sale terminal, and allows your receipt to include your name and the last four digits of your account number.
Track 2 stores similar information coded and formatted specifically for the banking industry. This is the data that, from a merchant, goes to the bank via modem. Actually, it goes to an “acquirer,” a middle-man organization that authenticates the account data and guarantees payment to the merchant.
Track 3 was supposed to store biometrics, like a photo and thumbprint, but the banks decided it was too expensive to implement and do not use track 3 at all. It’s sometimes used on non-bank cards: airline cards, hotel and club memberships, etc. Track 3 is also writable.
Credit card fraud
ATM: sucks data, spits cash.
Legitimate mag-strip readers are everywhere. Illegitimate ones, which I’ll refer to as skimmers, are, too. They may be stuck onto the faces of ATMs or gas pumps (possibly detectable). They may be attached to a merchant’s point-of-sale terminal (undetectable by customer, should be detectable by aware merchant). They have recently been found inside gas pumps (undetectable). Tiny, handheld models are used by waiters and others who swipe credit cards legitimately; they make an additional, criminal swipe through the portable skimmer.
Mag-strip readers are easily, legally purchased. The largest distributor is (no surprise) just outside Las Vegas. Bob met with the owner of the business, and bought a skimmer. The owner claims that his largest customers are schools and libraries, which buy in bulk in order to record attendance and keep track of books. I’ve heard from law enforcement that his biggest customer is the FBI, which buys skimmers, encodes them with trackable ID, and lets them fall into the wrong hands.
Our skimmer, pictured below, captures all three data tracks. Bob could have bought one half the size with twice the storage and a bluetooth interface for twice the price. The kind just pulled from the apron of a waiter at a high-end restaurant at Caesar’s Forum in Las Vegas—a restaurant frequented by a celebrity clientele (i.e. high-limit credit cards).
Whether obtained by an employee using a handheld skimmer, or one attached to stationary equipment, card data is gathered and stored, then collected by wired download or wireless transmission. Then what?
Credit card theft is a growing problem but it does not happen the way most people envision it. It’s not the lone hacker who goes it alone to compromise one site and sell the credit card numbers to fraudsters.
These days it’s a network of carders who each have a specific role. Roman Vega of Boa Factory fame was known for having lawyers, botnet owners, hackers, traffickers, and pushers all on staff. These days the professional carder will knock over several merchants and store the information without using it for up to two years. Once they have amassed enough information they join the databases together forming a master datasheet on peoples lives.
Once they join databases with your credit card number and others with your e-mail address they can perform ‘spear phishing’ where they send you a targeted e-mail, with your credit card number, asking for your PIN number.
Portable magnetic card reader, aka skimmer.
Credit card fraud is highly organized, en masse. Besides phishing and spear phishing, data is also written to new cards. These new cards can be blank stock, stolen cards (where sometimes the encoded data does not match what is printed—but who notices that?), gift cards, or shared-value cards. Mag-strip writers can be purchased as easily as mag-strip readers; and some models of readers just need a little extra software in order to write.
Everything one needs for credit card fraud can be learned or purchased on “carder sites.” Skimmer “dumps” are sold in lots, with payment made via Western Union. Here’s a typical “ad,” found among Afterlife’s blog comments (link above). This one’s about six months old:
The Best Dumps for a Good Price. Selling USA.
Hello dear friends. I’m a Memfis.
I have USA dumps, and some Asian.…¨I have a good price for it:
USA…¨20 USD CLASSIC, MASTER…¨25 USD VISA GOLD…¨30 USD VISA PLATINUM AND BUSINESS
ASIA…¨80 USD CLASSIC, MASTER…¨100 USD PLATINUM
I have my own base, good approval percent …“ about 90%…¨USA and Asia …“ 101 only. But I dont have EU bins.
USA …“ original track2.…¨Asia …“ both tracks are original, track1 and track2.
Payment is Western Union.…¨I’m sending order only after recieving payment, in 3-24 hours.…¨I have a replace pocily, but i should know what cards declined or holdcall in 24 hours, to replace it, in other time i wont replace.
For real buyers:…¨I can proove my quality, message me my ICQ.
Latest ATM skimmer, with measurement in centimeters.
Here’s a good thing: some of these gizmos hidden in gas pumps cause the pump to fail, so they’re found. But there’s bad news, too. Data from skimmers slyly hidden in gas pumps and other good places is often not used for three or four months. Why ruin a good thing if the skimmer is steadily transmitting account numbers and PINs? When credit card holders start reporting fraud, the common merchant on the victims’ accounts will be investigated and the device will be pulled. Has your card already been skimmed? Has mine?
…¢ Identity theft is now the number one crime in the world.
…¢ Las Vegas is number one in the U.S. for ID theft; even though it’s estimated that only 20% of the crimes are reported.
…¢ The FBI estimates that seven out of every ten stolen dollars end up in Las Vegas. There’s more money in Vegas than most places. Hence Vegas’s place at the top of the ID theft heap.
These wispy facts were spit out by Las Vegas Metro Police Department Forgery Detail’s Detective Kim Thomas at the start of his recent identity theft presentation. Then he got to the scary stuff.
I recently wrote about “profiles,” the findable bits of personal information about an individual. A utility bill constitutes a profile, though not as good of one as a loan application. Envelopes, receipts, statements, are others.
Detective Thomas emphasized the importance of shredding all documents before discarding them. Then he pointed out how something as simple as a discarded box can trigger both a burglary and ID theft. He gave the example of a resident getting a new plasma tv. A trawling thief spots the box at the curb on trash day. He watches the house and notes when it’s unoccupied. Then he steals a truck, kicks in the front door (that’s how they break in nowadays, Det. Thomas explained; no finesse involved), grabs the tv—and the pile of bills in the kitchen at the same time. “Even a box has value to someone,” he said. “Cut it up.”
We can shred.
We can break down our discarded boxes, or take them to dumpsters.
We cannot control how businesses store and discard our data. (My own little example: I went to a health clinic where patients are given forms on clipboards to fill out and return to the desk. When I returned to the unattended desk with my completed forms, I stood staring at other patients’ medical histories and Social Security numbers on the clipboards they’d left on the desk as instructed.)
Credit card data skimmer: the size of a Bic lighter.
But here’s the big thing now: skimmers. Wait! You think you know, but I’m about to describe the very latest in skimmers; not the deck-of-cards-sized box in a waitress’s apron, not the big old multi-part plastic set-ups of yesterday stuck onto ATMs. If you’re not sure exactly what a skimmer is, read the three little paragraphs of my previous post. In the old days (not very long ago), waiters and store clerks were given skimmers to swipe credit cards through and they were paid for the data they collected. But a waiter might talk if caught. A store clerk will be watched if suspected, leading police to the skim-master. And how many cards can they skim in a day, anyway?
Skimmer with keypad taken off ATM.
Old news: nowadays, skimmers are attached to the fronts of ATMs and gas pumps. Yeah, we know. But you probably don’t know how impressive the latest version is. It’s tiny: 3.5 inches long, by a half inch by a quarter inch. It’s almost impossible to detect. It contains batteries charged by an induction plate and stores data on a camera memory card. It attaches to a thin number pad overlay to capture PINs, and as a secondary method, also has a motion-activated video camera (jury-rigged from a high-end mobile phone) which is time-tagged to match up with the right credit card info. It has a bluetooth transmitter that allows remote, anonymous downloads, which means the skim-master doesn’t have to go near the scene of the crime, once the thing is installed.
About 40 of these tiny self-contained data-collectors have been recovered in Las Vegas in the past month. Probably more by now. Certainly more still out there, too.
Where do you get your gas?
Skimmer (somewhere) inside a gas pump.
Yes, they’re still stuck onto the fronts of ATMs. But they’re also put inside gas pumps. How do you open a gas pump? Use the same key that opens an RV storage locker, five bucks online. LVMPD found that one of these skimmers can be installed in eight minutes flat. Which, they figure, means the skim-master can probably do it in seven.
