'Skim' Threat Grows As Economy Worsens

Tiny Technology Used In Atm, Credit-card Fraud Becoming More Accessible, Harder To Detect

April 16, 2009|By Liz F. Kay | Liz F. Kay,liz.kay@baltsun.com

Privacy experts, banks and others are warning consumers about another threat to their personal financial information: electronic "skimming" devices that record credit-card and debit-card numbers at ATMs, gas pumps or vending machines.

Using tiny technology disguised as part of the machine, the thieves then press new cards with customers' numbers and run amok, to the dismay of cardholders such as Kristin R. Kyriakos, 29, of South Baltimore, who returned from vacation Monday to find numerous bank overdraft notices in her mailbox.

Thieves had stolen her number while she used the ATM at the Wachovia branch in the Southside Marketplace on Fort Avenue. With that information, they withdrew cash from several ATMs in New York City, taking a total of $2,500, she said.

"All of a sudden, I'm really apprehensive," Kyriakos said. "I wasn't aware that people were even capable of doing this."

There's no central source of data to determine the extent of the problem, said American Bankers Association spokeswoman Margot Mohsberg, but anecdotal evidence suggests skimming is cyclical, like other types of fraud. "As the economy gets worse and people get more desperate for money, the amount of fraud tends to go up," she said.

Also, the technology is more accessible, with people able to purchase the necessary equipment via the Internet, she said. Criminals use magnetic stripe readers, some as small as your palm, to record the information from the ATM card, and either a camera mounted on the ATM or tampered keypads to record customers' keystrokes as they enter their personal identification numbers. They then "clone" the cards and use them to withdraw cash.

But it is not just ATMs that are vulnerable - thieves have tinkered with stand-alone credit-card readers at gas stations and supermarkets. Employees of Red Box, a video rental vending machine company with locations at McDonald's and supermarkets nationwide, found credit-card skimmers installed last year on machines in three cities, including Baltimore.

The company warned customers about the threat via e-mail. "Since then, we've really not had any problems," said Red Box spokesman Chris Goodrich.

Wachovia spokesman Jim Baum confirmed that the bank "did have a situation happen in early March" at the Locust Point branch.

Law enforcement officials could not say definitively that a skimming device was the culprit, but there were no indications of other types of fraud.

"We know it happened ... in a very specific, small time frame," Baum said. Sometimes criminals will tamper with an ATM and leave the devices in place for just a few hours, he said.

The spokesman said he did not know how many customers had been affected, but "all customers who we have confirmed lost money have been made whole." The victims would also be covered by Visa's zero-liability policy, Baum said.

But under the federal Electronic Funds Transfer Act, banks have up to two weeks to investigate before returning the money, said Paul Stephens of the nonprofit Privacy Rights Clearinghouse. That can be a big problem for people who need cash in their accounts to pay their bills.

"You may be in a position where your account is completely depleted," he said. "Don't be fooled by the promise that ... you have 'zero liability for fraudulent transactions.' You have zero liability once the investigation is completed."

But he cautioned that skimming schemes in which thieves capture ATM card information as well as PINs are not very common. Debit cards or check cards are more vulnerable because they are used like credit cards for less secure point-of-sale transactions without entering a PIN, Stephens said. ATMs often have security cameras that would record any tampering, he said.

Also, federal law provides limited protections for consumers who use debit cards or check cards. Debit-card users are liable for only $50 of fraudulent charges if they notify their banks in writing within two days of noticing the errors, but up to $500 within 60 days, said Hugh Williams, coordinator of the identity theft office of the state attorney general's office.

"After that, it's gone, basically," he said. That's why he reminds everyone to regularly inspect their bank statements.

Mohsberg, the banking association spokeswoman, recommends that consumers check their accounts online as well. "The sooner they report it, the better chance that they're completely protected," she said.

To thwart potential skimming attacks, Mohsberg recommends covering your hand when entering your PIN at an ATM. Also, keep an eye out for any strange equipment or unusual error messages at the machine. Williams said, however, the technology is so compact that many consumers might not notice it.

Kyriakos, an attorney, said she called Wachovia's fraud claims department after spotting the erroneous charges to her account online. The crooks had gone back and forth between several New York City ATMs, withdrawing sums of $500 or $200 at a time. She went to the Fort Avenue branch to fill out paperwork to get a new card, and staff members there said that about 30 other customers had been affected as well.

Kyriakos said she was told it would take the bank at least 10 days to research the claim and return her money. "We do it as quickly as possible," said Baum, the Wachovia spokesman.

Luckily, Kyriakos could still reach cash in a credit union account. In fact, that is partly why she had originally signed up for Wachovia in August - she wanted the convenience of using the bank's many ATMs. But for the time being, at least, she can't use any.

"I guess it kind of backfired," she said.

How criminals are able to "skim" you during an ATM transaction. PG 10

Baltimore Sun Articles
Please note the green-lined linked article text has been applied commercially without any involvement from our newsroom editors, reporters or any other editorial staff.