Fraudsters have been busy “skimming” ATMs since at least the last holiday season, as fraudsters have sought to take advantage of magstripe readers before adoption of more-secure EMV chip card-compatible ATMs becomes widespread.
Skimming refers to fraudsters using a device to steal credit or debit card information in an otherwise legitimate card transaction. Skimming devices are often placed on ATMs. When a card is run through a skimmer, the device stores the information. Thieves then use the stolen data to make fraudulent charges either online or with a counterfeit credit card.
The ATM fraud resulting from these skimming incidents is often local to the cardholder’s residence and is known as “footprint fraud.” As fraud is perpetrated where a cardholder might normally frequent, illegitimate transactions become harder to detect.
For example, a case study prepared by CO-OP Financial Services reported on a card skimming scam discovered by Elevations Credit Union in Boulder, Colorado. In this case, all of the skimming took place at the same local supermarket. A few days later, the thieves used the information skimmed from the store’s self-checkout units to steal money with fraudulent cards from ATMs within the same several block area in nearby Denver.
No outlet is safe from these thieves. Gas stations, supermarkets, department stores, stadiums, hotels, shopping centers – anyplace that has an ATM. However, there are steps that credit unions can take to protect their ATM fleets – and their cardholding members – against this fraud trend.
Some Best Practices
For skimmers, the more, the merrier. Daily withdrawal limits for both amount and velocity for ATM usage should be reviewed and changed to meet the needs of your overall card base. Many credit unions still have limits well above $500 – some are at $1,500 and higher – increasing the likelihood of being a fraud target.
In a fraud situation, time is critical. Credit unions should block and reissue as quickly as possible any cards involved in a skimming incident where the PIN has been compromised in addition to magstripe data. A powerful means to help identify potentially compromised cards quickly is CO-OP Revelation, a data analytics tool used last Winter to track down compromised cards used by Elevations Credit Union members in the incident mentioned above.
All financial institutions reissuing cards struck by fraudsters should also report the incidents with equal speed to the card network (Visa, MasterCard, American Express, Discover, etc.).
ATM Monitoring Actions
A series of best practices are related to monitoring the ATM itself.
First, the time of day that card skimming occurs is largely authenticated through video surveillance, so test all video equipment regularly to ensure that it is in working order and recordings are properly archived.
We also recommend increasing security around all ATM equipment with trained eyes and keen ears. Uniformed guards and/or the presence of local law enforcement surveillance can be a crime stopper. Consult your local police to coordinate between your own security personnel and police patrols. With the black eye that fraudsters can leave on a community, we think law enforcement officials will be more than willing to help keep ATMs safe.
After years of evolution and perfection, the skimming device can look like a legitimate part of the ATM unit and is further fitted with electronics that record card transactions through a pinhole camera. This is a very sophisticated operation and some devices may even have blue tooth technology that can retrieve data without entering the establishment.
With this in mind, ATM custodians should make an extra effort to closely and frequently examine the front of every ATM for unusual attachments that may be disguised as native equipment. Even loose ceiling tiles above ATMs may also house hidden cameras or transmitters.
Examine the façade of ATM equipment for sticky tape or Velcro residue. The presence of similar sticky adhesives may indicate that an ATM parasite was attached prior to examination.
It may also be helpful to photograph ATM equipment to aid in any physical security inspections.
Finally, of course, contact local law enforcement if you suspect any tampering with your ATM equipment.
To be forewarned is to be forearmed. With ATM skimming on the rise, it’s more important than ever for credit unions to be both vigilant and proactive in fighting payment card fraud, for the well-being of your credit union, your members and, indeed, the entire community.
For more information on CO-OP Revelation, visit our website here.
About the Author
Eric Porter is Executive Vice President, Business Development, for CO-OP Financial Services, a financial technology provider to credit unions based in Rancho Cucamonga, Calif. (www.co-opfs.org). Porter can be reached at firstname.lastname@example.org and (800) 782-9042, ext. 2566.