As financial institutions make the switch to EMV-enabled cards, skimming attacks on ATMs and gas pumps are ramping up nationwide, prompting law enforcement to advise bankers to double down on their security efforts.
Recently, the Connecticut Financial Crimes Task Force, in conjunction with the state’s consumer protection agency, has inspected hundreds of gas stations statewide and recovered a handful of skimming devices, said Detective Mark Solomon, of the Greenwich Police Department.

Solomon, who works with the task force, said that law enforcement has seen a definite uptick in skimming attacks over the past year, particularly in Connecticut, Massachusetts and New Hampshire.

“One of the biggest increases we’re seeing is in what we like to call the softer target locations,” he told the Commercial Record. “Traditionally, the skimming devices have been at financial institutions, but we’re now seeing an uptick in placement of these devices at ATMs in convenience stores, hotels, resorts, ski lodges.”

“Skimming” refers to the attachment of electronic devices on or around an ATM or point-of-sale system to deal data from the magnetic strip of the card. One of the most common skimming devices attaches to the card reader at the entrance to the ATM kiosk and coordinates with a pinhole-sized camera strategically placed to capture an unwitting consumer’s PIN.

But as bankers wise up to skimming techniques, the criminals in question have been responding with smaller, sleeker devices that are not necessarily visible to the naked eye. For instance, Solomon said that law enforcement has found the skimming devices placed on gas pumps placed inside the machine. Those devices are Bluetooth-enabled, so the thief doesn’t even have to open up the machine to extract the card data it’s been collecting.

The response, so far, is fairly low-tech: a seal placed across the machine so that consumers and gas station owners can tell when it’s been tampered with.

(Felonious) Child’s Play  
The problem isn’t confined to New England. Solomon said skimming is on the rise nationwide, and Bob Stockwell, chief technology officer at Stanley Security, would agree. Stockwell said he attributes it to younger, would-be cybercriminals cutting their teeth on an easy target.

“We see this as a junior cybercrime play,” he said. “It’s a simple enough task that a high school kid with rudimentary computer skills can pull off. And it’s a younger offender. They are getting more organized, and those the ones that really concern us. It’s very much a younger crowd and it’s a pretty easy play.”

But Solomon said many of those skimming scammers are foreign to the United States, although sometimes they are American. He said he’s also seen an uptick in the involvement of younger adults or minors in these crimes, and he attributes that to the perception that those who get caught will face less severe penalties than an adult would.
He also said that criminals may be reacting to America’s delayed adoption of chip-and-PIN technology, making one last concerted push to nab what they can while banks and credit unions are still switching over to EMV.

That’s not to suggest EMV is invulnerable to thievery. Because EMV-enabled cards do still have magnetic stripes, thieves can steal that card data, too. They just have to be careful about where they deploy it, often preferring large retail purchases online or older ATMs not yet enabled with EMV.
Stockwell said the market has responded to the rise in skimming where it can.

“We’re seeing physical skimming where somebody is putting something over the read head itself. That’s the most prevalent one, the device that goes right over the card slot,” Stockwell said. “We know that when you put something over the card reader, the ambient light changes inside the machine where the reader is.”

In response, he said, some companies have manufactured a device that sits inside the ATM and detects changes in the ambient light in the card reader. That can then alert the machine – and ultimately the bank – that the machine has been tampered with and can signal it to shut down in response.

In the meantime, Solomon advises vigilance and intelligence sharing on the part of financial institutions. That seems to be the best method of stopping these schemes in their tracks – even when those skimmers are placed on privately owned ATMs in convenience stores or hotel lobbies.

“A lot of these are being detected by financial institutions that see a common point of compromise,” he said. “Obviously, the best thing is intelligence sharing between law enforcement and financial institutions. That has lead to a lot of identification of a number of skimming incidents and has lead to the arrest of individuals, so that partnership is very important.” 

Email: lalix@thewarrengroup.com