Tuesday, April 6, 2010

Bank expert discusses ATM skimming -- and how to detect it

The ATM skimming scam has resurfaced.

A customer spotted a skimming device on Saturday night at a Wachovia bank in the 1600 block of Rockville Pike at Congressional Lane and alerted a manager.

Rockville police said the device is “identical” to one discovered Feb. 28 at an Alexandria Wachovia branch in the 3600 block of King Street. At least $60,000 was removed from accounts at that bank, Alexandria police have said.

As of the close of business Monday, no losses had been traced to the Rockville incident, according to Wachovia spokeswoman Aimee Worsley. But customers who have used that ATM are being asked to check their accounts for unauthorized withdrawals in the wake of the discovery. Wachovia has policies to make customers whole -- the particulars are discussed below.

The check and fraud section of Montgomery County Police at 240-773-6330 will handle the criminal investigation into the Rockville case.

The resurfacing of the thievery revives the question: What was a customer supposed to have noticed? In the examples of the identical devices, the tipoff was the green flashing light around the card slot where, normally, there were no lights for that particular ATM model. The “face” of the ATMs also protruded slightly. The side-by-side shots released by Alexandria police illustrate the points.

But not all ATMs are alike, so sometimes the tipoff will be the exact opposite and the scammers will have attached a skimming device to the front of the ATM that blocks lights on machines where they are normally visible.

Wachovia’s expert, Jonathan Velline, senior vice president for ATM banking at Wells Fargo (which includes Wachovia), said customers should look closely at the ATMs they use most often. Many customers, he said, have a routine of using the same two or three machines and get a feel for how they appear even if they could not describe them fully.

Does your usual machine have flashing lights? Sit flush in the wall or extend out? Is the slot loose in the wall? Is a wire visible? Does the PIN keypad normally have buttons with colors for “enter” and other prompts or keys that all are the same color? Is there or isn’t there usually a box -- with envelopes for deposits, for example -- mounted on a wall close to the screen and keypad?

Velline said most customers do have an instinct for when something is awry even if they cannot put their finger on exactly what looks suspicious to them. Trust that instinct and notify a branch manager when something at the ATM appears odd, he said.

After the Alexandria case and again Monday, readers immediately began posing questions about skimming.

We posed some of your questions to Velline. Information he shared follows. When there is a direct quote, it is his.

What is skimming?

It is a crime in which thieves attach a device to an authenticate ATM in order to capture the information stored on the magnetic strip on customers’ bank cards. The basic components in skimming are a small magnetic head, like those on old tape recorders, to capture the account information on the bank card as it is inserted and a small camera positioned to view the keypad as the security PIN is entered.

The recorder may have a memory stick to store account information or may be able to transmit digital data over radio waves. Some thieves keep an eye on machines they’ve tampered with and so are nearby to receive transmissions. The digital data is stored and read at the end of the day.

The camera is tiny and may be attached in an overhang above the ATM keyboard or on the wall beside the ATM keyboard, say in the bracket holding deposit envelopes, and either records or transmits the PIN numbers entered.

Thieves who manage to collect the coding from a card’s magnetic strip and score the PIN have what they need to create a duplicate of the card and access an account.

How can I tell by looking that someone is doctoring my ATM?

Thieves often fit their own card readers (think false fronts with a slot) atop the genuine card reader, so look for ATMs where the slots seem to protrude or be out of alignment with the rest of the opening.

In other tactics, a small piece of metal may extend from the slot. In still other schemes, the fake device obscures the flashing lights that are around the slot openings of ATMs, so you won’t see a flashing light where you normally would.

But here is the problem: there are variations in the models and make of ATMs.

Does this crime happen only at banks?

No. It has occurred at gas pumps and other retail (point of sale) machines where you swipe a card and use a PIN.

Why isn’t there a foolproof system to stump these chumps?

“There is a little bit of cat and mouse to it.” Banks improve on their security and thieves connive to outmaneuver the upgrades. And as with so much, Internet access to components and undergound how-to guides make it easier for crooks to get information and the parts they need. But Velline said “we’re making progress and our loss rate in 2009 was half as much as 2008.” And no, he would not say what that means in terms of actual dollars for his bank network.

Are customers out of luck on the losses?

Best bet is to check your bank’s policies on reporting fraud and ask specifically what you to have to do and how quickly in order to be made whole. For example, Wachovia has zero liability for cardholders if their credit card, ATM card or check card is lost, stolen or used without authorization and the cardholder provides prompt notification, which Wachovia’s press office defined as within 60 days, although the sooner the better.

What can customers do to protect their account information?

Look at the ATM before you put in your card -- really look at it.

Shield your PIN as you enter it -- not just from the person over your shoulder in line or from people passing on the street. Shield it right on the keypad as you punch it in with an arm or with a shoulder-think of the positioning you might have used to keep that slacker in fifth grade from copying your math test answers.

Watch your bank statements for banking activity that you didn't do.

ATMs have surveillance cameras so why can’t that equipment catch the would-be thieves as they stand there and put on the skimming equipment?

“Because the camera data usually shows someone with a black cap and hoodie and some sunglasses, so it is not particularly useful.” washingtonpost.com

No comments:

Post a Comment