Beware of Fraud at ATMs & Other Transaction Terminals

You’ve probably heard about it on your local news over the last few years; criminals caught with equipment that allowed them to capture credit and debit card activity of unsuspecting consumers fueling up at the local gas station or using their cards at other outdoor accessible transaction terminals. These criminals are typically found with cash, devices, and hundreds of fake cards manufactured from the data they stole. Even more terrifying is that these seemingly local intrusions are almost always part of a larger international criminal enterprise.

In 2021, two cases involving international crime organizations using skimming devices were brought to a successful conclusion by the United States Department of Justice, one case involving ATM skimmers, and the other case involving skimmers installed on gas station pumps.

In each of these cases, the individuals involved had the technology, equipment, and techniques that allowed them to steal thousands of card numbers from unsuspecting consumers. Taking these criminals off the street is helpful, but busting them also led investigators to understand the real depth of this type of crime and the ever-evolving techniques the criminals are using to go undetected. Now it’s time for all of us to get a little smarter to help stop this criminal activity.

Skimmers and Shimmers. What’s the Difference?

Skimmers

According to the FBI skimming costs consumers and financial institutions over $1 billion annually. Skimmers are typically devices that are attached on top of the card reader of ATM machines, gas pumps, or outdoor drive-in fast food point of sale terminals and vending machines, and are sometimes indistinguishable from the real thing. These devices capture the information on the card’s magnetic stripe as it passes through the skimmer on its way into the card reader. For ATMs, a hidden camera near the machine also captures keystrokes to identify the user’s PIN. Instead of a camera, a more recent criminal innovation is the use of a touch-sensitive keypad overlay that may look like the keys themselves or a simple weatherproof covering. With the information gathered from a skimmer, criminals can replicate your card to sell to other fraudsters or use for fraud themselves.

Shimmers

As card security has become more sophisticated, so have the techniques of criminals. When most cards in the United States changed from magnetic stripe to EMV chip (Europay, MasterCard® and Visa®) criminals were challenged with a much higher level of security. However, fraudsters found that by carefully positioning, or shimming, an ultra-thin electronic component inside the card reader it would allow their device to record the information from the EMV chip on the card; thus, the “shimming” technique was born. Even though the criminal hasn’t defeated the security features of the EMV chip, they are able to gather the same information that is on the magnetic stripe in a manner that is much more difficult to detect.

How to Detect a Skimmer or Shimmer Device

While owners of vulnerable transaction terminals try to secure their devices, and law enforcement continues to shut down these criminal enterprises, you can also play a part in stopping card fraud and identity theft. Follow these steps to detect when a card terminal may be at risk, and if you see something, say something!

1. Outdoor point of sale terminals, such as gas pumps, drive-in fast food purchase, vending machines, and ATMs are particularly vulnerable. One thing you can count on is that these devices are built to be sturdy. Before inserting your card, give the reader a tug. If there are any ill-fitting parts on the machine, don’t insert your card. Report the terminal to the business owner immediately.
2. When you are at the gas pump or at the drive-in restaurant, look around at the other card readers. Fraudsters will often only have one or two skimmers that they will use at one time. If the card reader you are about to use looks different than the rest, consider using cash or paying with your card inside the business instead.
3. Gas stations and other businesses will use a security seal over the opening of the cabinet panel to show that the machine has not been tampered with since the last inspection. If the machine’s panel has been opened, the label will read “void”. If you see a machine with a voided security seal, or the panel is bent, loose, or open, report it to the business owner.
4. When using a vulnerable ATM, especially one that is located away from a bank building, consider the risk. If you can avoid using these machines you should.
5. Since skimmers and shimmers can be very hard to detect, the best defense is to check your account balance regularly to spot suspicious card transactions.
6. Working together to create more secure interactions is critical. We’ll continue to improve card security while you remain vigilant in protecting your personal information.

Keep in mind, if you suspect identity theft at any time, you have access to an Identity Theft Recovery Advocate as a no-cost benefit of your Premium Checking account.  If you suspect identity theft has occurred, a professional is standing by to help you identify and reverse the damage to get your life back on track quickly. You can count on us.