Be on the lookout for debit, credit card skimmers
“I should say it’s not a very technically sophisticated way to steal information.” Tirthankar Ghosh, a cybersecurity professor at the University of New Haven
At first glance, you may not think there is anything wrong with the PIN pad at the local grocery store.
Arms weighed down with bags, you probably were more focused on how much this was about to cost.
But sometimes there’s a reason to take a closer look.
At several grocery stores in Massachusetts and New Hampshire, officials said so-called skimmer devices were found secretly installed in checkout machines. More than a dozen of the devices have been found since mid-November.
The devices are installed by thieves on legitimate checkout machines or ATMs. When a customer slides their card to pay or withdraw money, the skimmer also copies the card’s information from the magnetic strip on the back of the card.
Newer devices, called “shimmers,” also can copy the data from the card’s chip after it’s slotted into the machine.
At some point, the thieves who installed the skimmer will return to retrieve it, along with the credit or debit card data it collected. They’ll then encode the stolen data onto a spare card, and use it, according to Tirthankar Ghosh, a cybersecurity professor at the University of New Haven. He recalled one case from years ago when thieves in Las Vegas used discarded hotel key cards to clone the stolen cards.
“They were common at some point of time, going back 10, 15 years,” Ghosh said.
Criminals also would install a hidden camera with the skimming device that would capture the person’s PIN number, Ghosh said.
Skimmers are no longer as commonly used, since most people don’t use their card’s magnetic strip anymore, opting for nocontact payment methods such as Apple Pay or tapping a credit card.
The devices have also been linked to organized crime. In November, the FBI said agents out of Los Angeles conducted an operation with authorities in Romania targeting dozens of locations. The dragnet resulted in 48 arrests and the seizure of about $1 million in various currency.
The FBI said it targeted organized crime figures who were involved in ATM skimming in the U.S. and a “money laundering apparatus used to send the profits of their crimes through western Europe back to Romania.”
So far, no skimmers have been found in Connecticut during the spate of instances in other New England states. But they have shown up here in the past.
“I should say it’s not a very technically sophisticated way to steal information,” said Ghosh, who also serves as director of the Connecticut Institute of Technology at UNH. He pointed out that thieves have to physically install the skimmer device. Shimmer devices need to by wired into the card reader itself.
The chance thieves will be detected is high, so criminals “don’t want to take a chance of installing a physical skimmer anymore,” Ghosh said.
That appears to be how the FBI caught half of a duo they said stole more than $127,000 using skimmers installed at three bank ATMs in upstate New York in 2015.
The FBI said Ilie Sitariu, a Romanian citizen and a co-conspirator who fled the United States, installed the devices at night. They left the devices in place for about a day and then came back to retrieve them. They wore hats and sunglasses to disguise themselves, the FBI said, but they were still able to be identified with the help of security footage.
As far as protecting your credit or debit card from skimmer or shimmer devices, Ghosh had a few suggestions.
For one, be on the lookout for anything “fishy,” he said.
“Sometimes when these criminals install these card readers, it kind of sticks out,” he said. Customers might notice a skimming device if the card reader looks a little bit off, has cheap plastic or isn’t aligned properly.
If it’s an option, Ghosh said customers should pay using a contactless payment, such as tapping their card, Apple or Google pay or cash. He also recommended using a credit card, over debit, since transactions can be disputed.
“Let’s say, for example, you drive into a gas station that kind of looks fishy to you but it’s an emergency,” he said. “Definitely don’t insert your debit card. If possible, pay by cash. If not, then your credit card.”
But you should always be on the lookout for fraudulent transactions, he added.