Earlier this month, a Romanian man with ties to the Russian mafia was charged in Boston Municipal Court with robbing Massachusetts and New Hampshire bank customers using cameras and ATM skimmers, devices which allowed him to recreate magnetic strips from debit cards and withdraw at least $400,000 from bank customer accounts over the past two years.
Dedham Institution for Savings was one of the banks affected by the recent ATM skimming scheme. According to Mark McKinnon, senior vice president and chief information officer, a skimmer was installed at another bank’s remote ATM location across the street from the main office of Dedham Savings. Using the customer data obtained in the scam, the thief then created “bogus cards” and used them at the Dedham Savings ATM.
McKinnon said managers at the Dedham Savings branches check the ATMs there several times a day.
“They look for anything unusual,” he said, adding that unless someone knows what they are looking for, it often is difficult to spot an ATM skimmer, many of which have become more sophisticated.
“It looks like a collar that sits over the existing ATM card insertion slot,” McKinnon said.
Customers, however, should look for telltale signs that an ATM has been tampered with. Mike Urban, director of operations for Minneapolis-based Fair Isaac Corp., a company that provides analytic solutions to businesses, said sometimes there is double-stick tape visible, drill holes, dust or something placed over the machine, such as a false face plate. McKinnon also noted that skimmers add about half an inch of depth to the ATM’s card interface area.
“It’s harder to get your card out” of the machine, McKinnon said.
However, with most skimmers, customers are able to complete the transaction they have started, which often gives the false impression that nothing is amiss.
Pennsylvania-based Sovereign Bank’s local automated teller machines were not affected by the latest round of ATM skimming in Boston, according to Ellen Molle, assistant vice president and manager of public relations for the bank. But like Dedham Savings, ATMs at Sovereign are checked often by employees.
“ATMs are inspected regularly for any foreign devices,” she said, adding that cameras also exist at many of the bank’s remote ATM locations.
Devices used for ATM skimming vary from some that are fairly easy to spot to small strips or overlays that can sit at the entrance of a card reader and are nearly impossible for most consumers to notice, Urban said. With bank ATMs, the skimmer often will use a device that fits over a card slot. It is thin, so the card can still enter the machine and the user can then complete a transaction. The skimming device is often fitted with a radio transmitter that can immediately send the information from the card’s magnetic strip to a nearby laptop.
That information allows the skimmer to recreate the card and its magnetic strip. But to simplify the subsequent withdrawal of funds, the skimmer also needs the PIN, or personal identification number, that activates the card. There are several ways to get the number. Some skimmers – like the man accused in the latest fraud ring – use small cameras aimed at the ATM’s keypad. They can later watch the tape, record the PINs and, using time stamps, match that information with the information taken from the card itself.
In addition, skimmers can use PIN pad overlays, which are similarly fitted with radio transmitters and can send the keystrokes to a laptop. Some skimmers also use fake face plates that they place on the front of ATMs.
Skimming is most common with non-bank ATMs. ATMs that are located in places like convenience stores are often hit because skimmers more opportunities to install skimming devices that won’t be detected. In those instances – and instances where a skimming device is used at gas station pumps – it is more common to see internal skimming devices, according to Urban.
Skimming doesn’t just happen at ATMs, according to Urban. It is more common to find it at other points of sale connected with customers’ personal identification numbers such as gas stations.
“There are hundreds of points of compromise for PIN-based skimming,” he said.
‘Best Practice’
Skimming also can happen over the Internet. Phishing for bank customers’ card numbers and PINs is the most common form of skimming. Phishing is when a computer user sends e-mails – which often look like authentic e-mails from financial institutions – to e-mail users, requesting personal information that can lead to money stolen from accounts or even identity theft.
One ploy by phishers is to ask bank customers for their card numbers and PINs. The phisher can then recreate the card and magnetic strip with the card number and use the card at an ATM with the PIN provided. Banks that issue cards with CVV/CVC numbers – numbers integrated into the card’s magnetic strip that can be used as an extra form of verification – are virtually immune from that type of skimming, but not all banks and card providers use them, according to Urban.
“Literally hundreds and hundreds of institutions are getting hit with [that ploy],” he said.
Portland, Maine-based TD Banknorth is one institution that does use the CVV/CVC numbers to protect their customers. Jeff Nathanson, director of corporate communications, said the industry is beginning to see the importance of embedding additional information into the strip.
“It’s becoming an industry best practice,” Nathanson said.
While added measures are in place to protect customers’ accounts, banks say the greatest cost of ATM security actually comes when there is a breach.
McKinnon said Dedham Savings spends more money and time when accounts are actually compromised.
“We’ve really incurred a lot of expense when cards are reproduced,” McKinnon said. When account data are compromised banks often must replace the ATM cards of large numbers of account holders as a preventive measure.
So how can banks and their customers escape being victims of an ATM skimmer scam?
“We put [information] on our Web site about ATM safety,” McKinnon said.
Sovereign Bank tells its customers to monitor their accounts regularly and also provides brochures on identity theft in its branches.
McKinnon said one way banks can make it harder for data thieves is to have adequate surveillance. He points out that many times ATM cameras are not functioning.
Employing a security team is one of the more popular methods banks use to keep tabs on their machines.
“We have an Internet security group that monitors not just ATMs, but all our bank systems,” Nathanson said, adding that the team looks at physical security issues before installing an ATM at a new location.
Another step banks should take to minimize losses – since the financial institution ultimately assumes all skimming-related financial risk – is to have a system set up that lets them respond immediately to any cardholder reports of ATM modification, Urban said. Banks’ call centers should have communication scripts to deal with that and letters ready for sending to cardholders in case any cards are compromised.
It also is important for banks to report the losses to law enforcement, Urban said. They are often reluctant to do so because of the time it takes to compile all the necessary information, but if a district attorney is willing to aggressively prosecute skimmers, the banks should cooperate. The jail sentence for someone convicted of the crime often will correspond with how much money they stole.
Companies like Fair Isaac have programs that can help prevent skimming. Fair Isaac’s program, which is called Card Alert Fraud Manager, tracks transactions at members’ ATMs and, when suspicious activity is detected, contacts the bank. If it is fraud, the company can quickly identify where the cards were compromised and block the affected cards.
Ultimately, banks will continue to “play a cat-and-mouse game” with criminals.
“The industry needs to continue to develop ways to thwart thieves,” Nathanson said.
Katie Curnutte contributed to this report.
Jennifer Jope may be reached at jjope@thewarrengroup.com.
