Skimming with ATM Cameras

Scam:   Thieves equip ATMs with duplicate card readers and wireless cameras.

Example:   [Collected via e-mail, January 2004]

Bank ATMs Converted to Steal IDs of Bank Customers

A team of organized criminals is installing equipment on legitimate bank ATMs in at least 2 regions to steal both the ATM card number and the PIN. The team sits nearby in a car receiving the information transmitted wirelessly over weekends and evenings from equipment they install on the
front of the ATM (see photos). If you see an attachment like this, do not use the ATM and report it immediately to the bank using the 800 number or phone on the front of the ATM.

The equipment used to capture your ATM card number and PIN is cleverly disguised to look like normal ATM equipment. A "skimmer" is mounted to the front of the normal ATM card slot that reads the ATM card number and transmits it to the criminals sitting in a nearby car.

At the same time, a wireless camera is disguised to look like a leaflet holder and is mounted in a position to view ATM PIN entries.

The thieves copy the cards and use the PIN numbers to withdraw thousands from many accounts in a very short time directly from the bank ATM.

Ordinary-looking ATM?

A false card slot is affixed over the original card slot. The false slot holds an additional card reader used to copy card information.

An ordinary monitor and pamphlet holder?

The pamphlet holder houses a hidden micro-camera.

The hidden camera is angled to view the monitor and the keypad and transmit wireless photos of them up to 200 meters.

The camera hidden in the pamphlet box includes its own battery and transmission antenna.

Origins:   Since the advent of the Automated Teller Machine (ATM) a few decades ago, banks and their customers have had to deal with a new form of theft: card-skimming. Card-skimming is the collection of ATM card numbers and PINs for the purpose of stealing money from bank accounts, a scheme accomplished through methods as low-tech as

simply watching customers as they use ATMs (a technique known as "shoulder surfing"), or methods as high-tech as installing false card readers (or whole false fronts) on top of existing ATMs. With the purloined information, scammers can manufacture counterfeit ATM cards and use them to withdraw money from accounts. (In some cases the thieves may steal the original ATM cards, then use some form of card-skimming to collect the appropriate PINs.)

The scheme described in the e-mail warning quoted above is one of the decidedly high-tech variety: a phony card slot installed over the real one scans information from an entered card's magnetic stripe, and a small camera hidden within an adjacent pamphlet holder records information from the ATM's display screen and keyboard. The pilfered information is sent via a wireless transmitter to waiting thieves, who can capture it on a laptop from up to 200 meters away.

The very scheme pictured here was indeed used in South America to steal information (and money) from customers of Bradesco, a Brazilian bank:

Similar card-skimming equipment was also found on ATMs in Hong Kong in January 2004:

In the United States, where independent ATMs (i.e., machines not maintained by banks) are more common, some crooks have resorted to even more thorough methods for stealing money. In December 2003, U.S. Secret Service agents arrested Iljmija Frljuckic, who had bought and installed more than 55 ATMs in California, Florida, and New York. Frljuckic used the machines to collect information on more than 21,000 accounts from 1,400 different banks, which he used to appropriate over $3.5 million from customer accounts.

Skimming techniques can be used not only at banks and other ATM sites, but also at many point-of-sale locations (such as gas station pumps) where customers commonly use debit cards to pay for purchases. Although ADT announced in 2009 that they had developed a device to prevent card skimming, this form of fraud remains a concern for consumers. As recently as January 2010, a Boston area man was arrested for using cameras and a skimming device to steal over $100,000 from the accounts of bank customers.

Although other schemes (such as the introduction of "smart cards") have been mooted as potential solutions to the problem of skimming, distinguishing a rigged ATM (especially one of the independent variety) from the real thing can be a difficult task even for the most careful of users. For now the best defense is for ATM customers to remain cautious and vigilant when using their cards, and to get into the habit of using the same ATM for as many transactions as possible so as to better recognize when something appears different about the machine. Be wary of any changes you see on the outside of an ATM. If it's affixed to a bank, walk in and ask why the changes were made before using it.

Additional information:

ATM Fraud: Banking on Your Money (MSNBC)

Last updated:   1 February 2010

Sources: