We continue to warn about credit card skimmers because it has become big business. As a merchant, you have an obligation to protect credit card data entrusted to you. This includes protecting and monitoring your credit card equipment and online processing. The latest trend is for thieves to install micro cameras allowing the thief to easily see the PIN code being entered into a keypad.
With this in mind, we will focus on sharing tips on what you should be looking for as a merchant as well as being a consumer that likely uses ATM's and other electronic payment points. It really only takes a quick inspection to look for things that might be amiss and cause you to become a victim of identity and credit card theft. Skimming works by retrofitting card readers such as an ATM or gas pump card reader with a camouflaged counterfeit card reader. The counterfeit reader records all of the information from the magnetic stripe on the back of your card. The thief can then duplicate your card onto a new blank credit card or simply capture all the data needed to sell on the black market.
You may wonder where a person might get such sophisticated equipment to do this. The truth is, skimming gear is readily available online at a cost of about $400. In most cases, the companies selling card readers are legitimate businesses that sell the readers to companies for use with point of sale systems. However, the sale of such equipment is completely unregulated. Since there are no regulations, skimmers can also buy them. A typical bundled package includes a card reader and a card writer.
A thief will usually buy a card skimmer that matches the type of device type he plans to attack. As an example, he might by a gas pump style reader and then connect it to the circuitry of the real card reader in a gas pump. The card skimmer has a magnetic stripe reader and local flash memory that stores the card data. Newer advanced skimmers are equipped with 3G radios that transmit skimmed data back to the thief in real-time over a cellular network. This eliminates the need for the thief to ever come back to collect the skimmer and data. It also reduces the chance that law enforcement will catch the thief by setting up a stake out and waiting for the thief to return.
A thief can also use a micro camera or a keypad overlay to capture data. This allows him to capture data the victim enters as well as the numbers on a card or debit card. The micro camera is placed somewhere nearby that has a good view of the keypad on the pump. The camera records the card image and makes a video of each key pressed. Cameras can be camouflaged on the machine itself or mounted nearby. If you see a brochure holder on the pump, check it out. This is a favorite spot for concealing cameras.
A keypad overlay accomplishes the same goal by resting over the top of the real keypad. Overlays are extremely thin and look and feel just like the actual keys of an ATM of gas pump reader. They are also capable of storing each key pressed, along with a timestamp on a memory chip. When you press the fake keypad it depresses the real keys below the overlay so everything looks and feels normal. Inspect the keys carefully for overlays.
Another common type of skimmer is called a handheld micro skimmer. These are used only for credit cards. These self-contained skimmers are about the size of a pack of gum or smaller and can be used by anyone you hand your credit card to for payment such as a bartender or waiter at a restaurant. Ideally, you never want your credit card to leave your sight. With a handheld skimmer, a rogue employee can capture up to about 2500 swipes on a single battery charge.
In yet the most innovative and brazen method of skimming we have seen is the credit card cleaner scam. This tiny device is innocent looking. The thief sticks this type of skimmer horizontally next to a real card reader with a label that says something like “Free Card Cleaner. Restore your card's magnetic stripe here.” You would be surprised how many people actually fall for this. Trust us.....your magnetic stripe doesn't need cleaning.
Once a thief has your data, your nightmares will begin. They could start using it online or, what happens more frequently is the thief makes a duplicate card using the stolen information. This is done using the last piece of equipment the thief needs called an MSR (magnetic stripe reader-writer). The MSR allows anyone to make their own cards. It writes the stolen data onto the magnetic stripe of a new blank card.
Chosen Payments recommends that you inspect your equipment regularly and keep track of your personal credit and debit cards when using them for purchases.