ATM Skimming: 8 Tips to Fight Fraud

Credit EligibleAs a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

Despite the recent bust of an alleged skimming ring, ATM fraud is on the rise and shows no sign of abating.

But one industry expert has a list of incident response tips for financial institutions that want to fight back against ATM skimming attacks.

Mike Urban, Senior Director of Fraud Solutions at FICO (Fair Isaac Corporation, the provider of credit scoring), says all types of ATMs - and even pay-at-the-pump gasoline stations - are under attack by tech-savvy fraudsters.

"As I have seen, [fraudsters] pretty much go after anyone; it's not one manufacturer or one model," Urban says.

Several skimmers have been found at gas stations around the country in the last month, and these are where the criminals are placing readers to capture the PIN and the card number before the PIN is encrypted. "I predict we're going to see more of those," he says. "They are targeting the weakness of the mag stripe, and that will be something we have to live with until a better solution is developed."

The Skimming Trends
The current trend began slowly, says Urban. Several years ago, the targets were primarily off-premise ATMs. Criminals could buy ATMs, place skimming devices in them and collect card and pin information. But when changes such as the encrypting PIN pad and other advancements in technology changed how PINs were protected, criminals began focusing on financial institutions' ATMs.

Recent arrests show the criminals perpetrating these crimes are from Eastern Europe. "A lot of the techniques and a lot of the technology they are placing on the ATMs are coming from Eastern Europe," Urban says. "Those criminals have been targeting financial institution ATMs for years, primarily because those are the kinds that are deployed -- there aren't as many stand-alone ATMs in Europe."

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

Criminals placing skimming devices will target an attack for a day, a weekend, or a short period of time. They usually go to other ATMs of the same model/make to attack, that fit the look of the skimming device. They are much more sophisticated than previous skimming devices, he explains. "They also use the same paint coatings, so they are getting access to that information somewhere -- those compounds that generally aren't available at a local hardware store. You can't go in and order ATM gun metal grey paint. There is a real industry around the creation of these ATM skimming devices."

Urban says he's seen the Internet forums that offer the specially made devices. "I've seen examples of the IRC chat rooms where these devices are offered for sale. They usually are offered at about $2000 apiece, and they are very sophisticated, much more like a part of the ATM than ever before."

The Challenge for Banking Institutions
Many financial institutions don't invest in real-time fraud monitoring of PIN-based transactions, Urban says, because traditionally risk has been lower. His advice: Institutions need to take a hard look at where they're going to spend monitoring money. "By now I mean getting ahead of the curve before the fraud starts to happen, and get PIN-based card transaction monitoring in place."

In terms of thwarting attacks, Diebold's "jitter" technology has been effective, Urban says. With this approach, the card is drawn back and forth as it is pulled into the ATM reader. "It is best out there now, because it breaks up the card going in and out of the machine," Urban says. "Even if a skimmer was placed on the outside, they would only get parts of the stripe, not all of it at same time -- they would only get pieces of it as it goes forward and backward."

But even this technology advancement won't stop a determined criminal. It is a cat and mouse game, and from what Urban sees with increased skimming in the UK and Canada, "We're going to see significant increases in skimming."