Is ATM skimming something you need to worry about? A recent high profile arrest suggests yes, but an expert we interviewed suggests otherwise.
Two Bulgarian ATM skimmers were arrested this week in New York, accused of setting up a skimming operation on two Chase ATMs near Union Square in Downtown Manhattan. According to the police, the pair stole 1,500 customers’ information, and used it to steal $300,000 — an average of about $200 per victim.
It’s likely the amount was exactly $200 per victim, actually, once you learn what goes into an ATM skimming scam.
ATM skimmers use card readers that sit atop the ATM’s card reader, which is connected to a small camera set up above the ATM’s PIN pad. They gather your card’s name and number onto their reader and get your PIN from the video footage. The only way a skimmer can get money out of your account using this process is by going to an ATM themselves and taking the money out — that the average number removed from accounts is a multiple of 20, and so low, should come as no surprise.
Mostly Urban Myth?
We spoke with financial security expert Chris McGoey about the topic this week, to find out some tips for how to avoid falling victim to ATM skimmers. Needless to say, we were surprised when he told us that “most of this is urban myth.”
It requires a lot of technology and manufacturing expertise to make an ATM skimmer, explained McGoey. They must be manufactured to high enough standards that they blend in with ATM machines visually and otherwise — if they prevent an ATM from working, people will complain, and the device will be discovered. Not only that, it must also be linked to a video camera over the PIN pad.
The technology is so complex, explained McGoey, that the incentives are hardly there to commit the crime; anyone with this much expertise could easily hold down a well-paying job. Though a quick rundown of the FBI’s article on the topic shows that virtually every large skimming scam in the United States has been perpetrated by thieves from poorer Balkan nations — Bulgaria, Romania, Serbia — suggesting that excellent Communist engineering educations combined with depressed post-Communist economies have created a capable batch of criminals. Perhaps these gentlemen can’t get jobs.
Anyway, after leaving the machine alone for a while, collecting data, the thieves must return to the scene of the crime and download the data somehow (presumably, this would involve removing the skimmer). Then, they need to have blank ATM cards and a machine that can encode these cards back at their hideout/lab/white van. And they need to corroborate all the PIN videos with the card numbers, in order to use the cards. Only then can they go to an ATM and use the card, risking being identified later on video camera, to take out your daily maximum, or maybe $200.
The cards can’t be used online or elsewhere.
Cards Can Only Be Used at Other ATMs
“How would that work?” McGoey asked me, pointing out the somewhat-obvious — without the security code on the back of the card, which thieves can’t get with a typical skimming operation, you can’t buy anything online. So you don’t have to worry about criminals buying flatscreens, rare birds, and Air Jordans with your debit card online — worry about phishing scams for that. And they can’t take a blank card to a merchant with the PIN written on their hand and expect things to go well.
And besides, as stated above, this is a very high-risk and high-effort operation for potentially low returns. If you can get $200 out of someone’s checking account before having to move on, this only gets profitable when your numbers get big. And when your numbers get big, you get caught — like our Bulgarian friends.
“It’s not like it’s so widespread that every other machine is at risk,” explained McGoey, who thinks that media hype has trumped up the threat posed by . It requires so much time and effort that McGoey joked the only people capable of it would likely be “speed freaks.” And perhaps they are.
Here’s Some Advice
But, considering that these scams do happen from time to time, even in places like Union Square, and speed isn’t that hard to get ahold of, McGoey does have some advice:
1. Limit Your ATM Use: This is simple, the less you use them the lower the odds that your info will get skimmed.
2. Use Familiar ATMs: It’s not always practical to avoid using ATMs, but if you’re familiar with your ATM, you’ll know if something is amiss. Avoid using unfamiliar ones and you’ll be safe.
3. Use ATMs in Retail Spaces: Skimmers need time to install their devices, and they won’t be able to get away with it in a retail space.
4. Cover the PIN Pad: This is the safeguard above all others. Let’s pretend all ATMs in your vicinity have skimmers installed (they don’t), if you protect the PIN pad from being recorded from above while you punch in your PIN number, your bank account will be safe. Your card number is useless without your PIN.
According to the FBI, however, there is new technology available that thieves can use on keypads to log your PIN number without a camera, sidestepping the only failsafe tip (#4). But still, ATM skimming won’t empty your bank account, and all you have to do is pay attention to the ATM you’re using to avoid these pitfalls.