It wasn't your traditional bank heist, but thieves recently got away with more than $90,000 from Columbia Bank by using a scheme called "skimming."
The thieves implanted a device in October on an ATM at the bank's Long Gate Parkway branch in Ellicott City, collecting account information each time a customer used the machine over two weekends, officials say. Armed with this information, they were able to withdraw money from customers' accounts — which the bank later replaced.
Skimming at ATMs and gas pumps has been around for years, although the equipment used to be somewhat clunkier and easier for consumers to spot, identity theft experts say. Now, devices are smaller and so advanced that even wary consumers may not detect the fraud easily.
"These guys that are creating skimmers are becoming more and more sophisticated and more and more brazen," says Jay Foley, executive director of the Identity Theft Resource Center in San Diego.
Some skimming devices now automatically send account information to the thief's cell phone, Foley says. And a bank's security camera is not a deterrent to these financial criminals.
Firm figures aren't available on how widespread this type of theft is. But authorities expect it to grow, particularly along the busy Interstate 95 corridor, which includes Maryland. The state in 2008 made it illegal to use a skimming device.
"People who practice skimming do it in a highly populated area, where you will get a lot of traffic in a short period of time," says Joe O'Hara, executive director of the Maryland Coordination and Analysis Center, which deals with crime and terrorism.
Skimmer devices are placed over the card slot by glue or magnet. They may be painted to match the ATM so they appear to be part of the machine. When customers insert their cards, the device captures their account information. Thieves also mount a camera nearby — on keypads or envelope holders — to record the PIN number a customer punches in.
This is enough information for thieves to create their own cards and pull money out of customers' accounts.
Columbia Bank never had a skimming incident before, says John A. Scaldara Jr., chief executive officer.
"Every bank has a security department that works tirelessly to try to prevent this from happening," he says.
Columbia Bank, for example, inspects its ATM machines every business day for such devices. The skimming device was applied during two weekends in October after business hours, Scaldara says.
Customers alerted the bank to unauthorized withdrawals from their accounts. Thieves tried to gain access to more than 100 accounts through hundreds of fraudulent transactions in the Baltimore- Washington region, according to Howard County police.
Columbia Bank contacted all the customers who used the ATM during the time the skimming device was attached. The bank replaced the stolen money and issued new ATM cards to customers.
The case has since been referred to the Secret Service field office in Baltimore. No arrests have been made.
Consumers can protect themselves by avoiding ATMs that look different from usual and by monitoring their accounts frequently for any suspicious transactions.
Protecting against skimmers
•Pay close attention to what the ATMs you use look like. Don't use an ATM that appears different from usual, such as one with wires or devices attached. Notify bank staff if you spot anything fishy.
•If you spy a skimming device, don't remove it. Let the authorities take care of it.
•Check your bank account daily for any unusual activity. If you wait until you get your statement, the damage could be more severe. The Secret Service says fraudulent transactions will occur within 48 hours after an account is compromised.
•Contact the bank immediately if you notice suspicious transactions in your account.