Only 28% of people surveyed protect their PIN at an ATM

The Irish Payment Services Organisation (IPSO) has just released the results of a survey of 260 ATM users on the SafeCard website. The results were disappointing - only 28% of the cardholders (including 156 men and 104 women) actually make any effort to shield the PIN pad when keying in their PIN.

IPSO has released edited footage (see below) from a micro-camera recovered after criminals attempted to use skimming equipment at an ATM in Ireland.  This shows actual footage as would be seen by the criminals if they retrieved the camera. 

Peak shopping time increases cardholder risk....

As we enter the final run-up to Xmas and the New Year, the shopping bonanza is well under way.  This of course presents great opportunities for criminals.  Yesterday I noted that the Turkish authorities have just arrested 10 Bulgarian nationals for ATM skimming offences....these guys had skimming devices placed on 4 ATMs in Istanbul for over a week.  According to Bulgarian national radio the fraudsters managed to steal data from 300 cards and obtain 50,000 Turkish Lira.  The arrests were made in Istanbul, as well as in a hotel on the Turkish-Greek border.  A large amount of skimming equipment was also seized.  It is good that these guys are safely out of the way for the time being, but there are of course thousands more out there.

What can you do to reduce the risk of your card being skimmed at an ATM?

Always be vigilant when using an ATM (or any payment terminal) and always shield your PIN when entering it.  Does this make any difference?  Watch seized criminal video footage to see that it does.

Visit the website of the European ATM Security Team (EAST) for other cardholder security tips.

How to protect your PIN.....by being creative!

It is the responsibility of an EMV Cardholder (someone holding a Chip enabled card) to protect their PIN when entering it into an ATM, or at any payment terminal.  Best industry advice is to shield it whenever entering it into a device, thereby preventing visual compromise.  Sometimes this is not easy.........and you have to be creative in how you do it.  EURO Kartensysteme in Germany has produced the short amusing video below, which illustrates this point.  If you don't read German the text says:

At the Supermarket checkout.......................my PIN remains secret



For more cardholder security tips, and to watch seized criminal video footage of ATM PIN compromise, visit the website of the European ATM Security Team (EAST).

PIN compromise using thermal imagery unlikely at metal ATM PIN pads

Since my last post I have come across more information on the thermal camera threat relating to PIN compromise.  Having read the research paper it seems that most ATMs are not at risk from this threat as, at the moment, the possibility of PIN compromise from thermal imaging technology really only exists for PIN entry at plastic PIN pads, and even then the success rate is not high - although the researchers claim that it is economically viable.  As most ATMs seem to have metal key pads, this is a relief for the industry.  The possibility of using thermal imaging for PIN compromise was first demonstrated by Michael Zalewski in 2005.

At the Woot '11 5th USENIX Workshop on Offensive Technologies held on 8th August 2011 in San Francisco, a presentation entitled Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks was delivered.  This was based on research and analysis carried out by Keaton Mowery, Sarah Meiklejohn, and Stefan Savage from the University of California, San Diego.  If you want to read more you can visit the website of the USENIX Workshop and download the slide presentation made by Mowery et al and/or the full research paper.

Covering your PIN may not protect it from cameras?

The industry is already aware that covering a PIN when entering it may not be 100% effective as, if the criminals use a PIN pad overlay, the PIN will be compromised regardless.  It is still recommended as cardholder 'best practice', however, as the risk of visual compromise is significantly mitigated.  For cardholder security tips, and a criminal video showing actual PIN compromise, visit the website of the European ATM Security Team.

Now, according to Security News on msnbc.com, new research in the U.S. has indicated that thermal cameras can be used for PIN compromise, even if the cardholder covers their hand when the PIN is entered.  How?  Apparently the keys touched by a human hand still retain some residual heat and this can be detected be a thermal camera once the hand has been removed.  Researchers from the University of California have carried out a series of proof-of-concept attacks using a thermal camera mounted above a traditional ATM pinpad.

65% of EAST Poll respondents always cover their PIN at an ATM

“Do you protect your PIN at an ATM?” That was the question asked by EAST in its website research poll conducted from January to March 2011. The poll showed the following results:

Why should you cover your PIN? If the magnetic stripe on your card is compromised or skimmed, the criminals need your PIN to maximize fraudulent usage of it. You can watch seized criminal footage of PIN compromise on the EAST Website to see what the criminals see. If you cover your PIN you are at least protected against visual compromise.

Do you protect your PIN at an ATM?

Watch the video below to see why you should.  The seized criminal video footage shows you what they see.............