7 ms·
ATM Skimmers
- rwhitman 13y agoThis is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas stations frown upon...
- jevinskie 13y agoI always jiggle the reader with a bit of gusto before I use an ATM. All of the ATMs that I have found have been sturdy enough that I don't worry about damaging them.
- cheald 13y agoI do too, but having never seen a skimmer, I'm not sure how effective this is. The slots are often loose enough to jiggle, though not loose enough to seem fraudulent.
- rahim 13y agoI had no idea. Any particular cities/areas in particular? (I live in LA.)
- rwhitman 13y agoBurbank, Orange County, El Segundo.. hard to tell tho because you don't find out till later
- mturmon 13y agoSee http://www.huffingtonpost.com/2013/02/03/credit-card-skimming-gas-stations_n_2607197.html http://www.huffingtonpost.com/2013/02/03/credit-card-skimmin... It's not easily avoidable.
- driverdan 13y agoThe only time you should ever use your PIN number is when it's absolutely required to complete a transaction. That means at ATMs, getting cash back at a retail store, or purchasing certain items like money orders or prepaid credit cards. NEVER use your PIN outside of these transactions. It increases your risk significantly.
- rwhitman 13y agoAt Arco they only accept debit. I would never use a debit card if I could avoid it. There are much more protections and insurance on credit card transactions, but if money comes out of debit, its gone.
- todd3834 13y agoI can confirm this, I live in Southern California and I have had multiple cards stolen. I try not to use my card anymore but always remembering to get cash from the bank is really inconvenient.
- Shivetya 13y agothere certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer. From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.
- georgemcbay 13y agoYeah my first thought on reading the article is that if enough actors cared about this they would redesign the standard for card readers so that the card goes flush into the reader without any protrusions (some are already like this) and then market this fact so that machines that aren't flat are viewed with suspicion, but I'm sure the costs to replace all the machines out there and do the marketing would be enormous at this point, and you would need buy-in from a ridiculous amount of companies so it is unlikely to happen.
- p0ckets 13y agoIt could happen if pushed by the companies that make the ATMs, rather than the banks.
- rwhitman 13y agoI agree completely. For a bank ATM I'm sure that they have a lot to lose from skimmers, as it affects their customers' accounts. But for a gas station, a generic ATM do they really stand to lose much from the skimmer? They still get your money. And in many cases I'm suspicious that its shifty gas station employees, store clerks that are installing these things in the first place. Who else has the time to go and study the layout of the card reader, maintain it and retrieve the data etc without getting caught? The only way there is going to be a real change is with legislation in my opinion
- dreen 13y agoThis is pretty scary stuff, I mean fuck, every time I see a story like that I can't help but be amazed at how incredibly insecure the services of credit card companies are, and how hypocritically they behave at every single step about security.
- brokenparser 13y agoIt's an arms race, never throw in the big guns if you want to stay ahead. I'm no expert, but this is ain't rocket science. Suppose the insurance company covers $256K worth of damages, it's useless to add more security when the damages total $192K. The insurance company would periodically (or rather sporadically) evaluate their claim requirements (ATM must have grade X lock, must weigh at least Y tonnes, etc.) and adjust for common risks (according to past cases). Between upgrading the contract to cover more risk and implementing security measures, the latter will probably have a better cost-benefit. The costs saved not doing anything beyond the minimum helps their bottom line and potentially you as well (albeit indirectly), by offering you a better deal (i.e. slightly lower interest rates) than their competitors. This may not be exactly how the system is set up, but I think I'm not too far off.
- GFischer 13y agoSee previous discussion on "How is an ATM Secure" Original article: http://security.stackexchange.com/questions/32917/how-is-an-atm-secure http://security.stackexchange.com/questions/32917/how-is-an-... Comments: https://news.ycombinator.com/item?id=5421864 https://news.ycombinator.com/item?id=5421864
- lucb1e 13y agoAnd that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn't mean they don't have 'em. Crypto is cool, until you mention physical security. Obligatory: http://xkcd.com/538/ http://xkcd.com/538/
- vrta 13y agoAh yes, the rubber-hose cryptanalysis: http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
- DigitalTurk 13y agoI live in a European country where chips are common. Yet, about one year ago I encountered a skimming device (I ripped it off and brought it to the cops). Unless magnetic strips are completely disabled (domestically and abroad) the security issue is still there. Incidentally, one of my banks by default blocks all use of Maestro (the European debit card system) outside of the Eurozone. You have to activate use of Maestro abroad on a trip by trip basis. One of my other banks automatically blocks credit cards used in the United States unless preceded by cash withdrawal at an ATM.
- EwanToo 13y agoI've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?
- kalleboo 13y agoI just wish banks had the option to get a card without a magstripe. I could use the chip-only card for day to day stuff and only use the magstripe when I travel to the U.S.
- dredmorbius 13y agoArticle dates from 2010. Title should be revised to note this.
- ck2 13y agoThere also is the technique of completely replacing an ATM in say a mall. Read about that one a couple times. Some ATMs in convenience stores and even retail chains like Walgreens and CVS already look sketchy enough.
- tlrobinson 13y agoA couple years ago someone brought a fake ATM into Defcon.
- match 13y agoI'd also like to point out that it was placed there by local criminals, not the conference attendees. It was however discovered by the attendees and the hotel was notified and the offending ATM was turned over to police.
- blhack 13y agoWere these the most idiotic criminals of all time? "Hey, Bob! Let's place our ATM skimmer right in the middle of a bunch of FBI goons and security experts!"
- chiph 13y agoI seem to recall that some banks (in Estonia??) will mail you a piece of paper with a list of single-use PIN numbers. Use one, mark through it. When you get close to running out, they mail you a new list.
- srik 13y agoSome banks do RSA ids, and you have to punch the right number in at the time of withdrawal.
- brazzy 13y agoThis used to be standard practice for internet banking here in Germany, but not for cash withdrawals or debit card use. I seriously doubt this method is ever used for that, as it would massively increase the risk when your card gets stolen (along with the PIN list you'd have to keep on hand). Additionally, I don't think it would work with international payment/withdrawal networks like Maestro.
- kalleboo 13y agoI always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.
- peterwwillis 13y agoSometimes the real card readers will pop off easily when tugged. You can also check for pinholes for cameras, and cover the holes up with gum.
- didsomeonesay 13y agoIf you suspect a skimmer, be aware that the person operating the skimmer might be close-by and not too pleased to see you take it apart.
- dredmorbius 13y agoVery unlikely.
- objclxt 13y ago> Why don't ATMs in Europe use chip and pin yet? Many of them do - one security feature is to have the ATM pull the card very, very slowly into the slot whilst oscillating them to prevent skimmers reading the mag strip, as it's no longer required (unlike the US, nearly all ATMs here in the UK feed the card in automatically, rather than manually dipping it). If you're not used to this you might think the machine was on the way out. Even with ATMs that support EMV (chip and PIN) you still run into the problem that a) ATM design inherently involves pushing the card into something, which could allow the mag stripe to be raed, and b) as long as there are ATMs and places that don't use EMV then there's always going to be a way to get money out / buy product with cloned cards.
- nutate 13y agoI had an ATM card eaten in London on vacation because I couldn't recall the PIN. That was a weird moment.
- msluyter 13y agoA while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdrawals for pocket cash. (I use Simple, btw, which is quite nice.) An unintentional side effect of this system is that it also minimizes the risk posed by ATM skimmers, since I don't keep much in the ATM account.
- nutate 13y agoI do the same thing. It helped when I did get skimmed. Looking back the card slot was slightly wobbly. Now I always check. My credit union contacted me the same day, hours after the skimmage and everything was taken care of practically instantly.
- pault 13y agoI do this as well, mostly because I do a lot of third world traveling and it's easy to get your card cloned. I only keep $500 in the checking account linked to my debit card, and the rest in a savings account that I can transfer money from instantly. I did have my card cloned once and this technique saved many thousands of dollars from being spent. I would have recovered it all eventually but it takes weeks and it would be a disaster while on the road.
- krenoten 13y agoHaving this setup really helped when my card was skimmed. I received a call from my bank asking if I had anything to do with attempting to purchase some very expensive train tickets in Sweden. They tried to make a large purchase, and when the card was rejected they tried to make a smaller one - but still over the small amount I had in the account.
- yeureka 13y agoYes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.
- kaoD 13y agoYou should ALWAYS put the hand over the other one while you type the PIN number. At least your PIN typing is not going to be recorded. It's something.
- PeterisP 13y agoThe standard skimmer "online kit" options include also replacement keypads - a thin (1mm) overlay over the real keys that record your physical keypresses.
- driverdan 13y agoI'm surprised this is new to HN. The article is from 2010 and ATM skimmers have been around for 15+ years. They've become significantly more sophisticated over time. Back when I was involved with this stuff 9 years ago most people were making skimmers you had to hook up with a USB cable to get the data. Now people are using cell phone hardware to transmit the data automatically.
- joelhaasnoot 13y agoJust today I was in the test lab for the ticketing machines at the transport company I work for. Our machines being unattended and often in public spaces, skimming is a real concern (and it has happened to me personally). The solution? Adding a plate with random bumps to each machine, and also adding a contraption infront of the card slot into which you place your card and then slide it in (see http://blog.webwereld.nl/wp-content/uploads/2009/08/nspas.jpg http://blog.webwereld.nl/wp-content/uploads/2009/08/nspas.jp... ). This last solution seems to be patented BTW.
- fluxon 13y ago2011 story. Can somebody downvote this? Gah.
- squozzer 13y agoI want to thank HN for possibly saving my arse. During my lunch break, I put some gas in my car. During the fill-up, I noticed the anti-tamper stickers on the pump were all broken. I paid it no mind, finished the fueling, bought some lotto tix with cash, then left. Came back to my desk, fired up HN, and read the article upon which we are commenting. Simmered in paranoia for a little while, then called up my bank and told them my card might have been compromised. New card with new number on the way. Now just have to remind myself to check my transactions until the new card arrives.