Safeway DVD Kiosk Comes With Credit Card Skimming Device

Crafty identity thieves attached a credit card skimming device to a DVD kiosk at a Colorado Safeway. The 2-inch skimming device was discovered only after a customer asked a Safeway employee for help after his card wouldn’t scan.

They both determined that an electronic device had been put above the actual credit card reader. It was a device that was used to scan someone’s credit card when they swiped it through the slot. They were able to take the device off of the box and turn it over to the deputies on scene. The device was taken into evidence for processing.

At this time, this is the only report that detectives have received about this type of device being attached to a DVD rental box in the county. Deputies did check out other businesses close by and did not find any other of these devices.

Consumers should always be aware of potential identity theft traps. If you see any sort of device hovering ominously above a credit card reader, ask the store to call the cops.

Sheriff Weaver as well as the detectives who handle these types of identity theft cases want to remind citizens to be extra careful when using credit cards at these types of unmanned machines.

This could apply to ATM’s, automated fuel station pumps, DVD rental boxes, vending machines, concert or event type machines, or any other machine that may ask you to scan your credit card without actually dealing with a clerk or employee.

ID thieves install credit card reader on DVD kiosk []
(Photo by Tim Boyle/Getty Images)


Edit Your Comment

  1. Buran says:

    I’m waiting for a store to be sued for this, as I’d imagine a lawyer could argue negligence because the store allowed this to happen. (they could and should be walking by the machine to make sure nothing is changing). I’m tired of nothing being done.

  2. Bulldog9908 says:

    The reason they didn’t find any other reports of these attached to similar DVD machines is the thieves usually only leave them in place for about 30 minutes–just long enough to grab a few numbers, but not long enough to arouse suspicion.

    Always be on the lookout for anything out of the ordinary attached to a machine. They’re usually very difficult to spot, but if you have any question, tug on it. They’re usually not attached firmly because the thief needs to be able to quickly attach and detach the device.

  3. Bulldog9908 says:

    @Buran: Two show stopping problems with trying to sue over this:

    1) You’d have to prove that the store knew about the device but did nothing about it. Clearly not the case–at least this time. If a store employee was involved in the scheme, then maybe you’d have standing to sue the store.

    2) You’d have to show injury. As all good Consumerist readers know, your liability for credit card fraud is limited to $50 by law. That’s a pretty small amount to sue over.

    I seriously doubt any judge or jury would decide that the store knew, or even should have known, that a card skimmer was in place. They’re often only attached for a few minutes.

  4. dshjyd says:

    I think Buran said that assuming that sooner or later, there WILL be some injury. And regarding your first point, that is not true. Negligence only requires that the risk be foreseeable to a reasonable person, even if you don’t have the blatant intent to commit a tort.

  5. dshjyd says:

    and yes, I think the store SHOULD have known about the skimmer.

  6. overbysara says:

    I wish I knew what it looked like.

  7. XTC46 says:

    @dshjyd: it needs to be foreseeable and you have to show that the person/company did not take reasonable steps to prevent it. Having the machine in the middle of a store, in plain view of employees and security cameras(most likely) would be considered a reasonable amount of security.

  8. dshjyd says:

    Having security cameras and still not catching onto the skimming is negligence in itself. Either no one was monitoring the cameras or the cameras were simply not intended to prevent something like this. Therefore, not reasonable IMHO.

  9. EtherealStrife says:

    @overbysara: They come in all shapes and sizes.

    ATM Examples

    Just be on the lookout whenever using your CC. They could be anywhere or anything.

  10. EtherealStrife says:

    @EtherealStrife: and atm/debit card :)

  11. cde says:

    @dshjyd: It is reasonable, because no store should be required to have someone monitor every single camera every single second of the day. And if a person standing in front of the machine, physically touching the skimmer can’t tell its attached, how can someone watching on a 7″ screen? Skimmer negligence can only be considered such, if I dont know, a skimmer was attached to a terminal behind the counter that onlly employees use.

    Plus, you also have to consider that the store does not own or make direct profit from the sales of the machine. Most stores rent the space to a third party company, which besides tax reasons, helps minimize any claim a person can have against them for simply having the machine on the property.

  12. edrebber says:

    @Buran: Safeway is just renting floor space the the DVD merchant. Safeway assumes no liability

  13. Roundonbothends says:

    How long will it be, or have we already reached it in this age of mass markets and miniaturized electronics, that these devices transmit what they steal over cellular of WiFi frequencies, dutifully encoded, (to the crooks in the van outside – hey, isn’t that a reversal? – or cities away) and then are considered expendable?

    So that typical thirty minutes becomes as long as the device is not discovered? Possibly hours or days later?

  14. Bulldog9908 says:

    @Roundonbothends: Who’s to say we’re not already there?

    This week, an SD memory card (like those that fit in a camera) was released with a wireless radio integrated on the same card.

    It seems to me it would be trivial to integrate this same technology into a skimming device. Some may already use SD cards for memory, so it would be plug-and-play.

  15. timmus says:

    They were able to take the device off of the box and turn it over to the deputies on scene.

    Stupid! Stupid! Stupid! The correct course of action would have been to post a deputy out of sight to monitor the box and find who reclaims it. That is unless there is reason to believe it is transmitting over WiFi.

  16. Bulldog9908 says:

    @dshjyd: From my business law book:

    Negligence under common law consists of three elements:

    1) Breach of duty of care: that a legal duty required the defendant to conform to the standard of conduct established for the protection of others and that the defendant failed to conform to that standard.

    2) Proximate cause: that the defendant’s failure to conform to the required standard of conduct proximately caused the injury and harm the plaintiff sustained.

    3) Injury: that the injury and harm is of a type protected against the defendant’s negligent conduct.

    Your negligence lawsuit would fail at step 1. The bar to reach negligence is actually quite high, and skimmers stealthily installed by a criminal third party without the knowledge of the store or the machine owner is not negligence on the part of the store or the machine owner.

    Skimming is a fairly new and scary type of credit card fraud, but it’s easy to limit your exposure by paying attention to your statements and notifying your credit card company if you see fraud.

  17. Shadowfire says:

    @dshjyd: You don’t know everything… for all we know, the employees checked the machines, saw nothing, and 30 seconds later, someone threw a skimmer on. Jesus Christ, people, we don’t need to sue the store, we need to find the little bastard who put the skimmer on there and arrest him/her!

  18. dshjyd says:

    “The bar to reach negligence is actually quite high…”

    I disagree. Read up on Martin v. Walmart or Mary vs. Speedway. As a merchant, they are trusted by customers to process and handle their credit cards without being stolen from. They breach that duty of care when they swipe the cards through a skimmed credit card terminal that is their property and they are in full control of.

    @cde and @Shadowfire:
    According to your logic, a grocery store should not be held liable for a customer who falls and slips from a spill b/c the store can’t possibly monitor everything that goes on in the store.

  19. EtherealStrife says:

    @dshjyd: The theft is occurring before the card even touches the store’s hardware (as I understand it). And the customer is the one swiping.

  20. BigNutty says:

    I agree with TIMMUS. How could you not set up a surveillance for at least a few hours to see if someone shows up and removes the device?

    Ever since I herd about these devices I keep looking for one of these just to see if I can find and take one. With my luck as soon as I pry it off, a cop will walk up and arrest me.

    I’m always interested in how crooks scam and con people. The people that come up with these new and different idea’s to scam probably have the intelligence to get a real good job. Amazing.

  21. cde says:

    @dshjyd: Yes, they shouldn’t be sued for other people’s negligence (both the spiller and the person falling). Look where your walking should be a law. But your own arguement backs mine.

    //They (The Business) breach that duty of care when they (The Employee) swipe the cards through a skimmed credit card terminal that is their (rented BY the store) property and they (The store) are in full control of (liable for).//

    In a spill, it is store property being spilt. In a behind the counter terminal, the employee takes the card and scans it. Even when the terminal allows for the customer to scan themselves, the store owns the terminal and an employee is in direct proximity of the scanner (~3 feet). With these DVD terminals, all three main tenents of those rulings are not present. The store does not own the terminals, nor does their employee handle the card or transaction, nor is the store liable for any malfunction of the machine, hence not liable for anything that happens with that machine.

  22. dshjyd says:

    From the article: “It was a device that was used to scan someone’s credit card when they swiped it through the slot.” And yes, you’re right that the customer swiped in this case.

    “Yes, they shouldn’t be sued for other people’s negligence (both the spiller and the person falling). Look where your walking should be a law. But your own arguement backs mine.”

    Are you joking?

    Regarding your later argument, (“store does not own the terminals”) stores CAN choose to either rent/own the terminals, (“nor does their employee handle the card or transaction”) employees in many cases do handle the transactions, (“nor is the store liable for any malfunction of the machine”) and the machine is not malfunctioning, it is modified to harm the customer, regardless of who did it. We’re not talking about this particular kiosk, we’re talking about the general case and the possibility of a lawsuit arising from skimming. And anyway, how do those points make the store not liable?

  23. cde says:

    @dshjyd: 1) The store does not own the DVD-RENTAL TERMINALS. 2) Why would safeway be paying it’s employees to stand next to the DVD-Terminal and swipe the transaction for you? 3) You can quibble about the meaning of malfunction in this situation, but how can Safeway be liable for something they don’t own or directly operate? Is safeway responsable for any physical damage to the machine? How bout a non-skimming malfunction, like an arcade machine “eating your quarter”?

    Also, a little bit of reading comprehension goes a long way you know. //With these DVD terminals// right before those three parts you quote from me would lead anyone to believe I was talking about that specific case, with those DVD-Terminals.