Fight back against ATM skimmers

In just two February weeks, at least three credit unions—in widely separated parts of the nation—fell victim to ATM skimming attacks.

In Maine, a criminal installed a skimmer on a Saturday, and before it was discovered, dozens of accounts were compromised. “It’s a horror show,” a local police sergeant told the press.

In central California an unidentified suspect apparently installed a skimmer on an ATM at a credit union on a Thursday and, according to police, it was removed by the criminal the next day, but by then he had compromised 120 accounts.

In Tampa, Florida a criminal put a skimmer on an ATM at a credit union branch. About 30 minutes later, a wary member felt “resistance” when attempting to use the ATM, reported it, and the skimming device was discovered.

Those are headlines from the recent police blotter. There are many more incidents, and that’s the problem. Know that there are ways for credit unions and their members to fight back. But the first step is accepting the magnitude of the problem.

What is surprising is how prevalent skimming is at credit union owned ATMs.

Historically, fraud experts have warned consumers to be especially wary of old ATMs, often at independently owned mini marts and similar retail outlets as well as saloons and delis. The basic argument has been that those kinds of establishments typically don’t have internal anti-fraud resources, and they may not have invested in anti-skimming defenses for their ATMs. It further makes sense that this kind of location is often targeted by skimming criminals who also need a minute or so of uninterrupted time to install a skimmer on the ATM.

The surprise however is that skimming remains an issue at financial institution owned ATMs, often in high visibility, high traffic locations. Data released by FICO in 2016 indicated that around 40% of ATM skimming incidents occurred at financial institution ATMs—and that is a call for heightened vigilance.

The good news: skimming at ATMs will likely drop after Visa’s October 2017 deadline for ATMs to be chip (EMV) compliant. The MasterCard chip deadline was October 2016. Either way, come Q4 2017, skimming at ATMs will probably tumble because the skimming devices won’t be able to grab useful information from the new-breed chip cards.

The bad news: until then experts expect a frenzy of skimming as criminals attempt to maximize use of their skimming devices, which commonly cost upwards of $1000.  Multiple experts have indicated they expect ATM skimming to spike in the run-up to the EMV deadline.

The worse news: skimmers have gotten highly sophisticated and, in some cases, can outwit most anti-skimming defenses. Ten months ago, NCR issued an alert that warned of “deep insert skimmers” that are difficult to detect. Said NCR about them: “These are a skimmer that is placed in various positions within the card reader transport, behind the shutter of a motorized card reader and completely hidden from the consumer at the front of the ATM.”

That is frightening because—traditionally—most skimmers have been detected by visual inspection.

However, this does not mean the criminals are in charge.

There is a simple defense that will thwart most ATM skimming: when the consumer uses one hand to cover what the other is doing when entering a PIN. This is because, according to the most recent Verizon Breach Report, 90% of ATM skimming incidents involve a tiny camera that is used to capture PINs.  The skimmer of course grabs the magnetic stripe data, but to make that fully profitable, the criminal needs the PIN—enter the tiny camera.

But there are also direct actions a credit union can take.

The three key steps to up ATM security are:

• Keep ATMs in highly visible, heavily trafficked locations.  A skimmer crook needs private minutes to get his/her trap in place.  
• Train employees to keep a watchful eye on ATMs, and also to look for pinhole cameras.
• Talk with the ATM vendor about available anti-skimming technology, which may include—depending upon the device—everything from hardware upgrades to software and firmware upgrades.  The big vendors know they are in a fight, and they are punching back.

Can you succeed in making your ATMs safe?  That is hard to promise, but what can be said is that a savvy credit union that takes the right protective steps will be ahead in the game, and that may be enough to send skimmer crooks looking elsewhere.