Here's What A Card Skimmer Looks Like On An ATM
A lot of you have been asking to see what a skimmer looks like before it's yanked off an ATM. Are they easy to spot or virtually unnoticeable? Our reader Timeus works for a bank and deals with this sort of thing every day, and he sent in the following photos. Enjoy.
He writes,
Now, let me explain some of the pictures. The scary thing when it comes to skimming device problems is that, the skimming device itself is only half the battle, per se. Take the following example.
See that gray rectangular box? That box was attached to the lighting above the ATM screen. If you look closely, you see a small pinhole in that box? There is a camera in that box, aimed right down at the ATM keypad where people enter their pin codes. Here's this device pulled off, sitting on the ground upside down, to show you the camera, with its Sony Lithium-Ion battery powering it.
[Editor's note: another reader, Will Z, sent us a link to a tiny battery-powered video camera he found through a simple Google product search. It looks strikingly familiar.]
Also included are pictures of the skimmer on the ATM, as some members of the site had asked to see, as well as the skimmer when it was removed.
The strange thing that gives this away to me as a skimming device is that the skimmer itself appears to be a part of what we call a Dip-Reader. A Dip Reader is where you slide your card in and out, like on the card reader you see in this picture of a Shell Gas Station card reader:
The other type of Card reader we use is what we call a motorized reader, where you slide your card in, and the machine takes the complete card, and then ejects it when you're done with your transactions. From the pics of this location, they stuck the housing for a dip-reader onto an ATM that has a motorized reader. That's a huge red flag to me, had I been someone who walked up to use this ATM before the reader was found.
Timeus also points out that even though the standard customer service rep may have no idea how to respond to your call if you try to report a suspected tampering, the bank's ATM security people will definitely want to know. He left a lot of good information in the comments to this post, so we've collected it together below for easier access.
I won't lie, skimming devices are still uncommon to come across. I can't tell you how many times we've spoken to a technician who says, "Well what do you know? I've heard of these things but this is the first time I ever saw one, what do you want me to do with it?" Not to scare anyone, but I've spoken to more than one police officer who has said, "Ok, what do you want us to do with it?"
The bank has to tell these people what to do with them, a lot of the time. Some PD will hold the device as evidence while our investigations unit tries to build a case and find out who was responsible, some PD simply destroy it, it seems to vary frm one police department to the next.
[...]
If we get notified, we can begin notifying all potentially affected customers and begin the process of safeguarding their accounts. If we don't get notified, potentially hundreds, maybe thousands of accounts are at risk for fraud depending on how busy a particular ATM is.
[...]
We have procedures for situations where an ATM skimming device is found. There's almost always a number on the ATM to call in the case of any emergency, that goes directly to our Corporate Security Department. They will contact us, unless a customer gets to my department first via Customer Service. We would immediately shutdown the ATM, dispatch a Second level technician to the site to evaluate the situation, remove the device, and send out a Privacy Event Notification to our investigations department as well as dispatch the police to meet our vendor tech on-site. We would also pull all ATM logs and submit that information with the Privacy Event Notification to notify all customers who were potentially effected.
In the future, if you ever come across a skimming device on an ATM, if you have the time, I know we appreciate a call to be notified. Trust me when I say, when a device is found, "alarm and whistles" go off in my department, upper management is notified and everyone gets involved.
In other words, if you end up talking to a standard CSR who doesn't get what the big deal is, try to find a way to reach the bank's security or fraud department instead.
Post a comment
Comments:
I never thought getting cash at the supermarket would be a better idea.
This makes me want to go all around town and search every ATM I find for skimmers.
I'm not sure if it helps or not, but I've taken to pretending to hit several of the buttons while I actually key in my code. I suppose the other option is the cover your hand over the keypad while you type.
@Tubasaurus: We love getting Consumerist mentioned in the mainstream media, but now I have this fear that our next mention will be because we've incited people to attack ATMS all over the country with flat-head screwdrivers.
I'm sorry to say, I must have a vision issue. I've looked at all the skimmers and short of looking for fake brochure boxes and pinholes, I'm having a serious issue telling a fake debit card entry slot from a real one. It sucks, it really does. All I can say is, I may stop using the atm and just go to the bank for withdrawals from now on. It will
A. Keep me from taking out cash without giving it a good long think
B. Keep me from the spiral of damnitdamnitdamnitno that comes with knowing your account as been compromised.
Add another to the list of things to be distrustful of.
@Chris Walters
I'm by no means advocating vandalism, but a few sadly battered ATM's would be a catalyst to convince banks to come up with security measures. I am happy to hear that red flags go off when one of these is found but are they doing anything to fix the issue on a permanent basis such as make their ATM's more secure. At this point, I'd think that would be a selling point for a bank.
"Our ATM's are secure!"
@Dancin' Hooooomeeeeeer!: seems like it would work, the thieves would probably just pass you over in favor of less cautious folk, rather than waste time trying to analyze what you're doing in depth.
@Crystal Wojcinski: Reading Timeus' description of the dip reader being placed over a mechanized reader is a great example of why going to the same ATM all the time is helpful--you don't need to be an expert in skimmers then, you just need to be able to notice that something is different.
I think one thing ATM designers could do is make the slot areas one piece with the front of the machine, so that *any* add on is immediately suspect. They should also probably post photos or diagrams at each location of what the ATM should look like.
I suppose the other option is the cover your hand over the keypad while you type.
@Dancin' Hooooomeeeeeer!: Yup.
Now I actually know what one looks like and what too look for.
Just to fuck with the scammer, i'd cover the pinhole with gum. If I really wanted to piss him/her off, I'd post a "Out of Order" sign!
@Chris Walters: LOL Google brings up Consumerist links on almost every "Credit Card Skimmer" result. :)
@Chris Walters: What if you just gave the protruding part of the card reader a good hard tug before sticking your card in there? I can't imagine that these things are screwed in place.
Which brings me to another issue. Alright the camera equipment and card reading technology has valid legal uses and is readily available for sale. However, much like Sudafed it also has a large appeal for illegal use. Perhaps along with Chris's idea for making pictures of a correct ATM (which sadly can be easily covered with a fraudulent one) and making the front all one piece, we should be keeping tabs on who is buying this equipment.
@Dancin' Hooooomeeeeeer!: In most of the pictures of different skimmers posted here, they appeared to have been taped on. I would imagine an unguarded machine housing hundreds of dollars at any given time should not have any parts that are just taped on.
@Crystal Wojcinski: These things can't be permanently installed because the removal process would get you caught by the real security cameras. Best thing to do is to jiggle any protrusions and if everything is rock-solid, you're probably fine.
This is like the feeling money to check for counterfeits. It's easy to make something that looks right, but getting that feel of permanence and stability is tough for fraudsters.
@Crystal Wojcinski: Way, way, way too many cameras and card readers already out there. Every retail outlet has a bunch of card readers in the store, and means to order a bunch more. Tiny cameras are in every new cell phone.
Besides, the skimmer in the picture there looks like it was stolen from a dipper ATM/gas pump. People stealing card info probably have no problem stealing equipment for their skimmer.
Well, this certainly justifies my telling people to shove it when they make fun of me for covering my hand while I type in my PIN.
@liveallnight: Not necessarily. One of the grocery stores that I shop at had this happen with the keypads in the checkout lines last year. I can't find the follow-up story, but if I recall correctly, people came in claiming to be with the POS vendor and swapped out the reader for one that was set up for skimming.
@Dancin' Hooooomeeeeeer!: Yes! I mentioned this below, but I've had people make fun of me for being "overly paranoid" by covering my hand while typing in my PIN. It takes minimal effort and can save you pantsloads of trouble.
They should also probably post photos or diagrams at each location of what the ATM should look like.
I was thinking the same thing, but I suspect that the crimilans would just replace the photos too. The welcome screen should have an image of the slot that displays until you insert your card.
@Crystal Wojcinski:
The obvious answer is to do what the ATM operators do in Europe --
Have the ATM monitor display a picture of what the card reader should look like, before prompting you to insert your card.
The mfgr knows what their card slot should look like, and by making this the first screen shown on the monitor, you don't use a poster that could just be vandalized/replaced.
I remember reading a few articles back to wiggle or shake the card reader before you insert your card. For the most part, how securely attached are skimmers? Does wiggling it or shaking it a bit really help? I would think thieves make an effort to secure it pretty well onto the actual machine.
@FuryOfFirestorm: I would just spend a few evening hanging around waiting for them and find out who the criminal is. Vigilante justice seems to be the only way they would be punished if cops are just passing the buck to the banks, or destroying evidence.
@huadpe:
None of my bank ATMs have any protrusions. The card slots are flush with the machine.
So if something is sticking out, that's an immediate red flag.
Wow...thanks for the work, folks. Good examples of skimmers that I might have easily passed over. I've tried impressing upon my wife in the past to only use the Suntrust ATM that is inside our Publix, since it's always in clear view of the bank employees AND the supermarket employees, thus making it a little harder for someone to rig up something like this without getting caught. Seems I will maintain this caution.
I know we're talking about ATM's alot here, but this also reminded me to me aware of skimmers on gas pumps as well (even though the pump pictured is OK).
@Dancin' Hooooomeeeeeer!: It doesn't help when they employ the newest method where they just overlay a thicker keypad on the PIN keypad. I've seen pictures of these found on Dutch machines, and they have sensors relaying the numbers pressed to the skimming device.
I don't use the ATM all that often, but I'll remember to keep skimmers in mind when I use one in the future.
Those cameras intrigue me. I'd love to find one on an ATM, take it home, and replace the videos with rick-rolls.
@Crystal Wojcinski: Another jewel of a facebook comment...destroy the bank's private property because of criminal activity unrelated to the bank?
There are plenty of ATMs, even full-sized ones, that use that type of reader (never seen one that used that particular shape...it was always better integrated into the case)
A local pair of bozos were working at some gas stations with a card swiper sitting behind the cash. They would swipe the cart through their own machine and then the store's. It was a friend of mine who stepped out and called the police. The bank contacted him and basically begged / threatened him not to say anything to the press.
My wife had her card pulled after someone hooked one of these up to a local theatre's machines. If I know two people who have been hit then either I am beating the odds or this is happening much more often than we are being told.
Yay, Timeus, Consumerist HERO!
Thank you, Timeus for sharing actual real photos.
@Trai_Dep: They better add a little dancing man made of /'s and \'s so I can enjoy my visit to the ATM more.
@Syrenia: That's a terrifying thought. Still, I think those probably have a much lower fraud rate than standalone ATM's, so I'll probably stick with them for the meantime. I always go to the same checkout line (express self-checkout FTW!!!) at the same supermarket, so I'll know if something looks hinky.
@donovanr: This happened to my boyfriend and me as well. We went to a flamenco club in Madrid, and they double swiped his card. They charged 3,000 euros before he figured out something was amiss. Seems like a pretty common thing nowadays.
@Kali Mama: dammit! Okay, how bout this: you have a separate account just for ATM use. Before using the ATM you call your bank and transfer just enough money into the ATM account. Then you go withdraw that amount.
It's crazy buy it'd work!
Good article. Love the pics of the camera: I always wondered how that would look. (I had pictured a big, visible camera posing as an ATM security camera, not something that looks like, well, a grey rectangle.)
I'm amazed at how much the banks don't seem to care. Surely, at least, if you spoke with the bank manager? After all, it's his location that's being affected.
@Dancin' Hooooomeeeeeer!: I'm thinking we should start going up to the teller and withdrawing bills in stacks, like in the old-timey days
Card skimmers have been found in my area, so I am glad there was an article about this so I am well aware of the problem and what to look for. Although it helps that I don't use ATM's personally and my family only uses them maybe 1-3 times a year. As for paying with a credit card at stores we usually don't do that either unless its a dire emergency.
My ultimate security tactic is to avoid using ATMs at all. If I need cash, I'll go into my branch and pull some out. I know there are instances in which I may need cash right then and there, and I always keep an eye out for skimmers, but for the most part I avoid the ATM altogether.
Crooks take it upon themselves to take your money without your permission. Let's vote these incumbents out in the next election.
@cupcake_ninja: As someone said above, most are just taped on. Making them secure beyond that risks discovery when they have to take it back off.
Word of advice: make such reports anonymously. Reporting a security hole at a courthouse earned myself a criminal investigation, not a reward (or even a "thanks"). Not pleasant.
I live in the Seattle area, and you my friend just gave me a nice shock. Good article.