You’ve probably heard about it on your local news over the years. Your card activity may have even been captured by criminals at the gas station or other outdoor accessible transaction terminals. These criminals are typically found with cash, devices, and hundreds of fake cards manufactured from the data they stole. Even more terrifying is that these seemingly local intrusions are almost always part of a larger international criminal enterprise.
In 2021, two cases involving international crime organizations using skimming devices were brought to a successful conclusion by the United States Department of Justice. One involved ATM skimmers, and the other involved skimmers installed on gas station pumps.
In each of these cases, the criminals had technology, equipment, and techniques that allowed them to steal thousands of card numbers from unsuspecting consumers. Taking these criminals off the street is certainly helpful. Busting them also led investigators to understand the depth of this crime and the ever-evolving techniques that go undetected. Now it's time for all of us to get a little smarter to help stop this criminal activity.
Skimmers and Shimmers: What's the Difference?
According to the FBI, skimming costs consumers and financial institutions over $1 billion annually. Skimmers are devices that attach to the top of card readers on ATMs, gas pumps, or drive-in, fast-food point of sale terminals and vending machines. They are sometimes indistinguishable from the real thing. These devices capture information on the card's magnetic stripe as it passes through the skimmer on its way into the card reader. For ATMs, a hidden camera near the machine also captures keystrokes to identify the user's PIN. A more recent criminal innovation is the use of a touch-sensitive keypad overlay that may look like the keys or a weatherproof covering. With the information gathered from a skimmer, criminals can replicate your card to sell to other fraudsters or to use themselves.
As card security has become more sophisticated, so have the techniques of criminals. When most cards in the U.S. changed from magnetic stripe to EMV chip, criminals were challenged with higher security levels. However, fraudsters began to carefully position an ultra-thin electronic component inside the card reader. They found the device could record the information from the EMV chip on the card. This is known as shimming. The criminal hasn't defeated the security features on the EMV chip. However, they can gather the same information that is on the magnetic stripe through a technique that's harder to detect.
How to Detect a Skimmer or Shimmer Device
Owners of vulnerable transaction terminals try to secure their devices, and law enforcement continues to shut down these criminal enterprises. But you can also play a part in stopping card fraud and identity theft. Follow these steps to detect when a card terminal may be at risk, and if you see something, say something!
Outdoor point of sale terminals, such as gas pumps, vending machines, and ATMs, are particularly vulnerable. One thing you can count on is that these devices are built to be sturdy. Before inserting your card, give the reader a tug. If there are any ill-fitting parts on the machine, don't insert your card. Report the terminal to the business owner immediately.
When you are at the gas pump or at the drive-in restaurant, look around at the other card readers. Fraudsters will often only use one or two skimmers at one time. If the card reader you’re about to use looks different than the rest, consider using cash or paying with your card inside the business instead.
Gas stations and other businesses inspect their machines regularly. They place a security seal over the opening of the cabinet panel to show that the machine has not been tampered with. If the machine's panel has been opened, the label will read "void". If you see a machine with a voided security seal, or the panel is bent, loose, or open, report it to the business owner.
When using a vulnerable ATM, especially one that is located away from a bank building, consider the risk. If you can avoid using these machines, you should.
Since skimmers and shimmers can be difficult to detect, the best defense is to check your account balance regularly to spot suspicious card transactions. To report fraudulent activity associated with your McCoy Federal Credit Union accounts, call (407) 855-5452 or 1 (888) 584-7701 toll-free. Report your lost or stolen Debit Card immediately to (800) 528-2273 and your lost or stolen Credit Card immediately to (888) 987-2450.
Working together to create more secure interactions is critical. We’ll continue to improve card security while you remain vigilant in protecting your personal information.
If you suspect identity theft, you have access to an Identity Theft Recovery Advocate as a McCoy member. This is a no-cost benefit of your Smart Checking, Smarter Checking or Fresh Start Checking Account. If you suspect identity theft has occurred, a professional is standing by to help you identify and reverse the damage to get your life back on track quickly.
