Favorite scams: Credit card skimmers

Skimming is the lazy thief’s way of making easy money. Sometimes skimmers get inspired and they put a lot of ingenuity into it but basically it’s the game for quick and easy scores. I know because it just happened to my wife and the guy who did it didn’t even pretend to work hard.

You can’t believe how easy it is for skimmers. If you want to know how it works in restaurants, watch this video on You Tube. The actor in the video does it without anyone at the table even seeing him. As you can see, these little skimmer devices are small and versatile. Some of the newer ones are the size of a small pack of gum and I have no doubt that future models won’t even need the magnetic card reader. It’s scary to think the thief could just walk up near you and turn on the skimmer to read everything in your wallet.

So what skimmers do, if you’re wondering, is buy a credit card reader device on-line legitimately for about $200. Sometimes they also buy a card writer as a package deal. The sale of these devices is completely unregulated because legitimate merchants buy them all the time. I’m not going to list the sites where you can buy them here on this blog. You have to go look for yourself but it won’t be too hard.

The Square Register iPod credit card reader. For all your thieving needs this holiday season.
The Square Register iPod credit card reader. For all your thieving needs this holiday season.

Older versions of skimmers used on-board memory to store stolen data. That meant a delay until the thief got off work or that he had to go back to collect the device and risk getting caught. The newer skimmers use Bluetooth technology or something similar to broadcast the stolen data to some guy hanging out nearby pretending to read a book. Much more efficient.

The skimmer device copies everything off that magnetic strip on the back side of your credit card. Everything. Your social security number, account numbers, address, etc. All sorts of things are stored on your credit card. As soon as the scammer has that info, they can do three things. Probably the most popular thing to do is to apply for new (fraudulent) credit cards and open bank accounts online. They use a private mailbox for the billing address. The victim never knows what happened until some collection agency tracks them down and starts harassing phone calls months later.

The next best way is to use a device to manufacture a ‘clone’ credit card and encode everything from the victim’s card onto the magnetic strip on the back of the clone. Sometimes the thieves use an actual Visa gift card because they have a real magnetic strip and clerks don’t get alerted to an altered card face. Then they run around charging electronics and stuff that they can return for cash. The victim doesn’t notice anything until they try to use their real card and it gets rejected, or they read their billing statement at the end of the month.

The third way is the way it happened to my wife. The skimmer probably used one of the hand-held devices and got the info off my wife’s card like the actor did in the video link I posted above. He watched her type in her PIN number, then he sent everything to his friend six states away. The friend, known in the criminal justice world as an accomplice, ran around charging a bunch of stuff as fast as possible before the credit card company noticed and alerted my wife. The first purchase was for $1.00 just to make sure it worked. Then they bought things worth less than $100 each time so that it would be easy to return the items without much suspicion. Why do they do it several states away, you ask? Because the small amount means the crime is probably a misdemeanor or a minor felony and states don’t put much effort into investigating them or prosecuting. The states don’t issue extradition warrants for these little things because it costs too much so cops just let the banks handle it unless there’s a lot of money involved. And a couple of hundred isn’t a lot.

So, I’ve explained the basic skimmer technology. Now let me tell you about how this scam works in three variations:

ATM skimmers

This is a very clever way of pulling off this kind of skimming. The thieves install the electronic skimmer over the top of the card reader on the ATM. Then they install a tiny pinhole camera somewhere on the ATM so that they can watch you type in your PIN number. Viola! They’re in business.

There are all kinds of clever ways thieves have devised to set up skimmers but so far they are almost always attached to the outside of the ATM machine. Sometimes they are set up above or in front of the card reader so you have to pass your card along the skimming device first before your card goes through the real one. A related method often used on the Redbox movie rental machines is to attach the micro reader just above the card swipe slot.

Banks figured this one out, so they devised those semi-transparent plastic covers for the ATM slot. Usually they are made with green lights or blue plastic so that they lit up and let customers know they are using a ‘safe’ ATM. Except that in the cat-and-mouse arms race between skimmers and banks, the thieves came up with skimmer devices that look exactly like those green plastic covers. What will those silly kids come up with next?

It’s hard to really see the detail, but this is one of the wafer thin micro skimmers that fit inside the ATM slot.

Recently skimmers have even figured out how to do away with anything attached to the outside of the ATM. They devised a very small, very thin skimmer device that actually fits inside the ATM card reader slot. I’m not sure if these are common or something just being developed. I wish I could praise good old fashioned American ingenuity but the reports on reputable websites all seem to suggest these are Russian inventions.

Retail Stores

Skimmers in stores are really hard to spot. Sometimes they look like something attached to the normal card swipe device we use to pay for stuff, except that most of the time what you see are perfectly legit electronics. Besides, the skimmers don’t have a big sign on them that says “Beware! This is a skimmer device.” Good luck spotting them.

The other problem is that big name stores aren’t going to allow a clerk to set up a skimmer on their credit card devices. It’s the small merchants and the ‘weekend market’ types that you have to worry about. They are not going to use the expensive credit card machine models you are used to. It’s likely they are going to buy all kinds of new technology like iPhone credit card swipers. However, unless you are the type to keep up on the tech stuff it’s unlikely you’re going to know the real ones from the fakes.

One great variation on this scam is that the clerk at the store slides your credit card through the skimmer they hide in their pocket without you seeing. Then they make a big show of looking away while you type in your pin number. Sometimes there is even a ‘privacy shield’ around the keypad. But what you don’t realize is that there is an overlay on top of the numbers. The newer overlays are extremely thin and nearly invisible. They often look like some kind of plastic protection device to keep the keypad clean or whatever. When you press the numbers on the fake keypad it records your numbers and simply presses the real key below it. You typed in your PIN and both the overlay device and the actual credit card machine read the four numbers correctly. The clerk then collects the info and they are in business as soon as their shift ends.

Gas Pumps

In the old days thieves had to attach the skimmer to the outside of the pump like with the ATM scam. Not so anymore. Now thieves can just plug the skimmer directly into the electronics inside the gas pump so you don’t even see it. Customers don’t have any idea about the skimmer because it’s hidden inside. But look at the picture of the gas pump plug-in skimmer. I’m not sure a gas pump tech guy would necessarily notice it. I do know that I wouldn’t know what I was looking at even if I was able to look for myself. Would you?

So in light of these really easy ways to use skimmers, my advice is to use cash the way Don Draper does on Mad Men. Don’t carry as much around as Roger Sterling but you get the point. Another good tip is to never lose sight of your credit card and always watch the transaction being processed. Good luck with that one, though. Thieves aren’t known for being obvious about their craft.

-Samuel Owen

Update: Contactless skimmers

HID-Reader-FrontThis device claims to be able to covertly read all the info off your credit cards/debit cards from as much as a foot away – without even touching your wallet or you even knowing anything at all is happening. I know it doesn’t look like much but these things are apparently on the way, my friends. If some joker can make one, imagine what well funded criminal organizations can do. You can read more about a recent demonstration of how this kind of technology works by clicking here.

© Samuel Owen 2012. All rights reserved. Please read important notices and disclaimers by clicking here.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Blog at WordPress.com.

Up ↑

%d bloggers like this: