How Counterfeit Credit Cards are Created From ATM Skimmers

There is no limit to human ingenuity when it comes to fraud. We have discussed previously the prevalence of retail fraud through the use of counterfeit credit and debits cards, and in particular card skimming. Fraudsters mount a small device on top of an existing card reader – in an ATM, a gas pump, or even inside a store – which records the magnetic strip information of the inserted cards the same way a legitimate card reader does. A tiny pinhole camera or a keypad overlay record the PIN numbers entered. Fraudsters then download the stolen info and print them on newly-manufactured counterfeit credit cards.

As with ever other kind of fraud, skimmers have gotten sophisticated to the point where they are almost undetectable beneath the actual card readers. Which means a lot more people fall for them: according to Krebsonsecurity.com, run by former Washington Post writer Brian Krebs, the Secret Service numbers losses from ATM fraud at $350,000 a day, or $1 billion a year, and 80% of it from card skimming. And while Europe is switching card payment systems to a more secure EMV (EuroPay, MasterCard, Visa) microchip standard, the U.S. continues to use magnetic stripe technology. So all the fraudsters who used to target European residents will start switching over to victims in the U.S.

As Krebs reports, there is now a whole industry built around card skimmers, including online stores that sell them customized for different kinds of ATMs, or that transmit the stolen numbers wirelessly – sometimes via the Web, sometimes by text message – so that the criminals do not have to risk retrieving the data in person.

Here is one exampe of a typical ATM skimmer. Notice how the device fits perfectly on top of the actual card slot, making it almost undetectable at first glance.

The second part of this fiendish device is the camera that records victims' PIN numbers. In this case, the camera is cleverly disguised as an ordinary pamphlet holder. Inside the "holder" is a battery for the camera, and sometimes a wireless transmitter.

It should be noted that not all skimmers look like the ones above. There are as many variations are there are sophisticated criminals. Here, for example, is a card skimmer embedded in an entire false front panel of an ATM.

Instead of a camera capturing PIN numbers, other skimmers use numberpad overlays - a second pad placed over the real one.

If these photos are not frightening enough, consider that it is now possible to get an entire ATM for less than $1,000. An intelligent fraudster can the reprogram it, outfit with a skimmer, set up in a high-traffic area and watch the money roll in. All without anyone ever suspecting foul play. Identity theft expert Robert Siciliano,in conjunction with the local police, demonstrated how easy it actually is using an old ATM bought from a bar going out of business. With a few keystrokes he pulled up the transaction history for the previous four months, giving him the card number of every recent user of that machine. And of course there would be nothing stopping him from setting it up again with a skimmer.

Siciliano even went on Boston's local news channel to show his technique in action.

More than anything else, this demonstrates the absolute need for fraud prevention. We are not just talking about security at the point where the information is stolen, but at the point of sale where that stolen information is used. Procuring victims' information and transferring it to a magnetic stripe is still easier than making a convincing card on which to print the stripe. Counterfeit credit and debit cards can be fairly easily detected under UV light with the right training, making the fraudster's previous efforts at collecting and printing the info all for naught. Vigilance is a must: the counterfeits are out there, and given the rise of ATM skimmers, their onslaught will only get worse.