Reader Finds Another Card Skimmer On ATM
Kelly sent us these pics of a card skimmer he found yesterday on a Bank of America ATM in Atlanta. He writes, "I asked the police what to do; they said give it to the bank. I asked the bank what to do, they said give it to the police. I assume that no one has established standard procedures to handle this kind of thing yet." Well if nothing else, send us a photo! Then we can publicize it for other readers, which is how Kelly found it in the first place: "I would have not even recognized it or known to look for it had I not read the article on your website a week earlier about what to look for." Full size pics below.
Contrary to what some in the media were saying about our previous post, these are not the first instances of real world credit card skimmers—there have been stories about them and photos circulating online for a few years at least. However, it does seem like we're getting a lot more tips about them lately. Whether that's due to increased awareness on the part of consumers, or increased activity on the part of criminals, we don't know. We suspect it's both. But we figure the more of these examples we see, the easier it gets for all of us to spot them.
Same tips as always apply: try to use the same ATM for your transactions so you'll be more likely to notice changes, and try to use bank ATMs which in theory should be less susceptible to tampering—although our recent tips have all focused on bank ATMs, so clearly they're not immune.
Update: Kelly wrote back in with a response to some of the comments below:
The location was the corner of Ponce de Leon and Frederica in Atlanta. There are two ATMs at the location, one in the front and one in the back. The ATM that had the skimmer on it was the ATM in the back. When I discovered it, I was so surprised that I didn't think to call the number on the ATM, I called the main customer support number instead (the call was around 5:12 pm saturday).
The put me on hold for a bit and when they came back on they asked me for the location and time of discovery, and they asked me to give the skimmer to the police.
When I flagged down a police officer, he gave me the distinct impression that I was to give it to the bank so that they could "conduct an internal investigation."
I just thought it was funny that the bank didn't seem to want the device, and neither did the cops. So here I am, left with an illegal card skimmer with a whole bunch of strangers' card data on it. I just want to get rid of it!
Post a comment
Comments:
If you can get a skimmer for $18 then I think I'm in the wrong line of work.
@bigroblee: I wasn't able to find the UPC code but the prefix might belong to Agron Product Line Development System in Los Angeles, but I think they just handle some clothing lines.
Why haven't the banks upgraded these ATMs so the card skimmers are hard to attach? My bank, Royal Bank, has machines protruding card slot. It seems like a simple and cheap fix.
@andrewe: Even they can be screwed with.
Its basically impossible to use a scanner without some way in which they can hack it without the bank taking a PRO-active measure of checking the scanner every couple of hours.
"I assume that no one has established standard procedures to handle this kind of thing yet"
The skimmer is evidence of an attempted crime against you. As the victim, you have standing to file a criminal complaint.
In my opinion, the bank has nothing to do with it, and the police should be immediately notified. In fact, you shouldn't even be touching the damn thing, so you don't destroy any physical evidence there might be.
Giving it to the bank will probably mean they throw it away and keep it quiet so people don't get scared to use their ATMs.
A picture of the device on the ATM would be a lot more useful than just pictures of the device alone.
@bigroblee: It's for an Adidas Woman's Response Court Skort.
[www.buy.com]
So the scammer is a girl into tennis, or someone going out with someone who plays tennis. Can't blame them of course, girls in tennis outfits are hot. Unless they let themselves go.....
@rbb: Agreed. Unless this was stuck on the ATM crooked or falling off somehow, how can you tell? This looks just like the actual Bank of America ATM card slot, down to the clear plastic part for the flashing green light (though I imagine that wouldn't look quite the same in use).
now people are going to be breaking atm's all over the place looking for skimmers and I wont be able to withdrawal my money anymore! damn you all!
@rbb: That's what I'm looking for. I'd love to see what it looked like when it was on the ATM, so I can see what tipped the person off. The best I can figure now is that clear-ish plastic part in the middle, where you can see part of a cord. Then see pics of the ATM afterwards, on how it should be.
Believe me, I check every time now, but it's still hard to figure since there's no standard.
I agree a pic of it on an ATM would help. I'm not sure if i would have spotted it if i needed cash in a hurry.
I noticed one of the ATMs attached to a branch of my bank has added a clear, bubble-like enclosure over the card slot, no doubt to prevent this sort of thing. The branch closest to me closed their drive-up ATM and now only offers the walk-up by the front door, where I suppose it's easy for the staff to check for the presence of overnight additions.
@rbb: The consumerist story that ran a few weeks ago referenced a site that had photos of skimmers installed on the ATMs. They were extremely difficult to spot in most cases. You can view the pics at: [www.networkworld.com]
Anyone here from law enforcement that knows what crime has been committed by this and what should be done by all parties concerned?
where in Atlanta was this found?
So, taking bets on how long it's going to be before a paranoid reader tries to remove a skimmer only to destroy an ATM. I say within the next two months.
@Andrew Mussey:
Yeah, seriously. I'm even on the lookout for them now but I don't want to be the idiot to be touching/trying to remove the card reader to find out it's the real thing and having myself on camera looking like a scammer.
There are standard procedures that banks follow for these things. Finding out what those procedures actually are is going to be extremely difficult unless you have a need to know.
It would be kinda like asking an armored car driver what his route is because... ya know... you're the curious type.
Diebold (the mfgr of most of the ATMs out there) has changed their designs lately to make it more difficult to install these things but it's not impossible.
Common sense rules. If it looks suspicious, don't use it.
These are not nearly as impressive as the banks' taxpayer dollar skimmers.
Isn't it interesting that both banks and law enforcement cry "beware of identity theft" but when the ball is in their court they drop it.
I did some research for point of sale and store cards equipment a few years ago for a business I was involved in. I was a bit creeped out how easy it is to get enough equipment to read and duplicate magnetic cards.
I am in the habit now of grabbing the hardware around the slot and giving it a little pull to see if it comes off. Is that enough? I would be interested to know how easy it was for Kelly to detach the device.
I atually found that by going into the bank, taking out cash and budgeting myself, I have been able to save money and avoid card skimmers, transaction fees and other complications. To be honest, since I decided to step backwards in time four years ago, I have only had one instance where I was flummoxed and had to return the next day to make my purchase. This actually turned out pretty good as it gave me the time second guess my purchase and I was happier with it in the end.
It is great that people are noticing the card skimmers, and that there is great advice on what to look for, and how to react if and when you find one. I do hope that a standard procedure can be put into place, even if it is on a bank by bank basis, or through your local police force, for reporting these things.
As a designer, I believe it is on us and the engineers to get many steps ahead of the scammers and design ATM's which are impossible to attach skimmers to.
This is extremely frustrating. I work as a Analyst in BOA's ATM Network Support Department, and as far as I know, unless I am mistaken, we did not receive any call about this possible site yesterday.
We have procedures for situations where an ATM skimming device is found. There's almost always a number on the ATM to call in the case of any emergency, that goes directly to our Corporate Security Department. They will contact us, unless a customer gets to my department first via Customer Service. We would immediately shutdown the ATM, dispatch a Second level technician to the site to evaluate the situation, remove the device, and send out a Privacy Event Notification to our investigations department as well as dispatch the police to meet our vendor tech on-site. We would also pull all ATM logs and submit that information with the Privacy Event Notification to notify all customers who were potentially effected.
In the future, if you ever come across a skimming device on an ATM, if you have the time, I know we appreciate a call to be notified. In this case, if anyone in my Department was notified about this device pictured above, and no one took action, they would lose their job. Trust me when I say, when a device is found, "alarm and whistles" go off in my department, upper management is notified and everyone gets involved.
@PETAKillsKittens_GitEmSteveDave: ...or their tech savvy enough to know the blogosphere would latch onto that barcode and purposely put it on there to generate assumptions...
@andrewe: We've begun a program of attaching what we call "Anti-Skimming Devices" on card readers about a month ago. They are similar to what you described, are green with a black lock symbol on them. They are not on all of our ATM's yet, the program is a pilot to see how effective they are.
@David Mays: They probably will not "throw it away", unless they want to get fired by corporate security. Plus, destroying evidence used in the commission of a crime/possibly a felony is a crime.
@David Mays: I cannot begin to tell you how misinformed you are. Following that line of thought, I think we should let our customers know clearly, what our procedures are when this sort of things happen, if anything, to avoid the kinds of statements you made above.
We do not simply throw it away and hope no one finds out. Stop being so pessimistic please. The bank has "everything" to do with it. If we get notified, we can begin notifying all potentially effected customers and begin the process of safeguarding their accounts. If we don't get notified, potentially hundreds, maybe thousands of accounts are at risk for fraud depending on how busy a particular ATM is.
@aja175: I agree. BOA primarily uses Diebold and NCR machines. We have some Valero machines as well at Diamond -shamrock gas stations in the south, but our primary vendors are Diebold and NCR.
@Drew Biondo: I won't lie, skimming devices are still uncommon to come across. I can't tell you how many times we've spoken to a technician who says, "Well what do you know? I've heard of these things but this is the first time I ever saw one, what do you want me to do with it?" Not to scare anyone, but I've spoken to more than one police officer who has said, "Ok, what do you want us to do with it?"
The bank has to tell these people what to do with them, a lot of the time. Some PD will hold the device as evidence while our investigations unit tries to build a case and find out who was responsible, some PD simply destroy it, it seems to vary frm one police department to the next.
@bmoctta: I think he was being pretty obvious with the sarcasm. ;-)
That said, I'm sure that's why they chose that UPC prefix. Or random chance. I'd guess the latter.
@Timeus: In fact, you shouldn't even be touching the damn thing, so you don't destroy any physical evidence there might be.
Despite what you see on TV, prints off something that is in public are just about useless in court. That includes the outside of a car, outside of a window, etc.
@Blueskylaw: Until the skimmed cards are actually used, there isn't any theft or loss by any "victim". There is no such thing as "attempted theft" and "theft" of a number is not a theft until it involves actual loss. This would have to come under a computer crimes or a fraud statute...and most district attorneys don't like to prosecute those because they're too complicated for juries to understand.
@masterying01: Yeah, with my luck, I'd go "Hey! A skimmer!" RIIIIIIP...and then the defacing an ATM charge.
@Timeus: As someone who worked for BofA for many years until about six months ago, I can guarantee you that customer service is most likely NOT trained in this procedure. I don't recall it even being in the online procedure guide called Solution Center. I worked in the ATM/Check Card disputes department, so we got these calls routed to my team ALL the time. We never received this training in my department. And because outbound calls were discouraged (increases handle time, etc.) I doubt more than a few of us ever bothered to call ATM Network Support to inquire. It's only one of many things wrong with call centers all over the country - not just BofA.
I was able to scan the barcode using my G1, but it didn't find anything.
@PETAKillsKittens_GitEmSteveDave: They are also high maintenance. Country club dues and bills for lessons don't pay themselves.
@Poisonous Taoist: I apologize, I should specified that ATM Network Support has procedures for when a skimming device is found. I couldn't speak for what Customer Service or any other department got trained on.
@lauy: I should have been more clear on my reply, I apologize. Like I said to Poisonous Taoist, ANS has procedures for when a device is found. I cannot speak for what kind of procedures Customer Service would have, if any at all, when faced with this type of situation. I agree with you yes.
@Timeus:
I've called the number on the ATM to report ATM problems (for TD Bank, not BoA) and the attitude was as close to "we don't care" as possible.
In this case, someone had attacked the three ATMs at my bank, destroying the card slot on one, another one was permanently stuck on "TEMPORARILY OUT OF SERVICE" and the last one the card slot had been damaged enough that I was the last customer that managed to use the thing. The ATMs were, however, repaired after a day or two (Perhaps because they were attached to a bank, I can't imagine it had anything to do with my call with the attitude I got on the phone). I switched banks a while after.
Another, separate, experience calling a similar number for Bank of Montreal when a few rolls of their proprietary receipt paper had been left lying around all night also resulted in the same uninterested attitude. I also switched banks over this one. I mean, seriously, do you really want it to be this easy for criminals to forge bank receipts? *sigh*
Note to banks: Take people calling your ATM numbers seriously. Or not. Up to you. I'm now with a bank that seems to give a crap (for the moment).
@shepd: I'll be honest that's very surprising to hear, sad as well. I know personally I take great pride in our fleet of ATMs. ANS is one of the best places I've ever worked. i love it at BOA. I would certainly hope anyone from BOA who got a call about an ATM issue would convey a sense of urgency to correct whatever the problem might be. Heaven knows though ultimately. I just do what I can.
@Timeus: Why do you keep saying "we"? We don't know who "we" are. The bank in question apparently didn't give a shit.
Am I the only one that "hides the keys" when entering a PIN? You never know if there is a camera recording you entering your PIN, or someone watching you enter it.
I guess I'm paranoid, but I hit the keys with all four of my fingers held together so it's not clear which finger is hitting which key. Or I hold my four fingers together over the keypad and hit the key with my thumb, tucked under the fingers.
I just wondered if anyone else did that, too.
If you're reading, Kelly - where in Atlanta? I'm in Vinings and have a BoA account, though I seldom use the ATMs.
if anyone in my Department was notified about this device pictured above, and no one took action, they would lose their job.
What about Bank of America tellers who give out money to somebody who presents ONLY a driver's license, and yet, tellers don't demand a bankcard, demand that the person punch in a PIN, or check the person's signature?
On seven separate occasions, in Texas and in California, B of A's tellers gave out my money ($12,000 total) to women who presented ONLY a fake driver's license in my name -- with the wrong expiration date.
I investigated and it seems B of A's computers aren't connected -- at many branches (a highly expensive procedure when a bank has gobbled up a bajillion little banks). According to my investigation, in many cases, the tellers CANNOT check these signature or read your bankcard; they just HOPE it's you.
When I complained about this -- instead of just saying, "Oh, okay!" to B of A's apparently making their customers more attractive victims to identity thieves with such practices -- the bank sent me a letter firing me as customer and telling me I had about a month to get my money out.
Any comments on this level of "security"?
Interesting that it has a bar code; just where does one go to buy one of these off the shelf for 18$?