ATM criminals increasingly use thin insert skimmers

Picture courtesy of EAST

The European ATM Security Team (EAST) has been reporting the usage of insert skimmers at European ATMs for some time now.  In a Fraud update published last month they stated that a new form of mini-skimmer was reported by one country, specially adapted to fit the card reader of one ATM type.  This mini-skimmer, which can be seen in the image to the right,  was used in conjunction with a new style of video camera for PIN compromise.

ACCA USA publishes Report on Skimmer Fraud

The Association of Chartered Certified Accountants (ACCA) in the USA has published a new research report entitled “Skimming the Surface – How Skimmer Fraud Has Become a Global Epidemic”.  The report was produced by Pace University, sponsored by ACCA USA.    

The report’s author, Dr Darren R. Hayes of Pace University, attended the first global conference of the European ATM Security Team (EAST), the EAST Financial Crime and Security (FCS) Forum, in June 2013.and EAST and its members subsequently assisted with research.

EC3 helps to dismantle an international network of payment card fraudsters

Romanian and French law enforcement authorities, supported by the European Cybercrime Centre (EC3) at Europol, have successfully dismantled a Romanian organised crime group involved in international payment card skimming and associated fraud.

During a raid on 17 January 2014, 11 suspects were arrested as they planned to travel to Italy to commit skimming attacks. Among them was the leader of the criminal group as well as the financiers.

In addition, 26 premises were searched and illegal equipment seized. Police also dismantled two factories producing skimming devices, including sophisticated miniaturised versions. This activity followed an earlier week-long surveillance exercise carried out by French and Romanian law enforcement officers.

For more information read the related Press Release on the Europol website.

EAST Publishes European Fraud Update 3-2013

The European ATM Security Team (EAST) has just published its third European Fraud Update for 2013. This is based on country crime updates given by representatives of 19 countries in the Single Euro Payments Area (SEPA), and 3 non-SEPA countries, at the 31st EAST meeting held at Equens SE in Utrecht on 9th October 2013.

Skimming at ATMs was reported by 20 countries, with increases reported by 8 countries and decreases by 6 countries. The usage of fake ATMs for card and PIN compromise has been reported, the first time such a method has been seen by an EAST National Member, and skimming devices placed on ATMs with dip readers appear to be becoming more prevalent.

European Police Take Down a Major ATM Skimming Operation

With the support of Europol, 56 suspected members of a major network of payment card fraudsters (38 in Bulgaria, 17 in Italy and 1 in the Netherlands) were arrested in a coordinated raid across Europe.

This major police operation, led by Italy and Bulgaria, was coordinated from the Operational Centre at Europol headquarters in The Hague. Earlier arrests carried out since the investigation started brings the total number of suspects arrested up to 105.

Cash trapping attacks in Europe seem to have stabilised

 

The European Security Team (EAST) has just released its third Fraud Update for 2012.  Cash trapping incidents were reported by 15 of the 21 contributing countries, and such attacks seem to be stabilising or falling in most of them.  The most common method used by criminals continues to be a fork or claw  inserted into the cash dispense slot during a normal transaction.

In October 2011 and April 2012 EAST reported significant rises in cash trapping incidents, so this latest news is welcome.

ATM skimming attacks continue in all but 4 of the reporting countries, and the migration of fraud losses away from EMV liability shift areas continues.  For more information visit the EAST website.

Now you can print out an ATM skimming device!

According to the blog 'KrebsonSecurity' a gang involved in skimming in the U.S. stole more than US$400,000 using skimming devices built with the help of high-tech 3D printers.  Is it possible to print out a workable skimming device??  Apparently it is.  3D printers take two dimensional computer images and build them into three dimensional items by putting down successive layers of powder that are heated, shaped and hardened.  The video below from 3D printing company i-materialise clearly shows how this is done.

3D printing in action from i.materialise on Vimeo.

According to Brian Krebs "word is spreading in the cybercrime underworld that 3D printers produce flawless skimmer devices with exacting precision. Last year, i-materialise blogged about receiving a clients order for building a card skimmer. The company said it denied the request when it became clear the ordered product was a fraud device."

Apparently a Federal court case is on-going in the U.S. with four men on trial for re-investing the profits from skimming crime to purchase a 3D printer.  These printers are not cheap and can cost from US$10,000 to US$20,000.

Blog view:  While this does appear to be one way to get a skimming device, the 3D printing technology is not cheap.  It is known that basic skimming devices can be obtained over the internet for just a few hundred US dollars, with more expensive USB, Bluetooth or GSM variants available for a wide variety of ATM models and types (these are in the approximate price range of US$2,500 to US$4,000 and kits are also available that include PIN pads and some blank cards).  Why would a criminal invest in such a piece of expensive 3D technology (which might not always create a perfect device and would always be at risk of seizure), when the ready made items can be easily purchased?  There must also be costs associated with designing each skimming device variant and with putting together the required two-dimensional drawings.  But for those illegally selling skimmers this might be a new way to produce them................ 

Ever wondered how skimming at an ATM works?

A lot is heard about card skimming at ATMs.  Most people have a vague understanding of what happens, and how the criminals involved cash out.  But do you really understand what they do, both to get your card data and your PIN, and also how they are subsequently used to create counterfeit cards for illegal cash withdrawals and other financial transactions?

If you can bear the Bond theme musical introduction, there is a video  produced by 'The Real Hustle' that explains quite well how the whole skimming thing works - from initial preparation of a skimming device to the final usage of the cloned cards.  It finishes with two bits of advice. 

1)  If you see anything that has been fixed to or sticking out from the card reader of an ATM, do not use the machine.

2) Always shield your PIN


Blog view:  Its fine to be suspicious of anything fixed to or sticking our from an ATM card reader throat, but bear in mind that such devices can also be genuine anti-skimming devices.  Best to be suspicious though.  Shielding your PIN, however should be routine.  While there are other ways to get your PIN (such as PIN pad overlays), covering your PIN does protect it from most visual compromise.  For more cardholder security tips and to see seized criminal video footage of PIN compromise, visit the website of the European ATM Security Team (EAST).