Ever since I heard a rumor of an ATM that had been set up in a hotel lobby to steal card numbers, I've been a paranoid user of cash machines. As the story went, the machine didn't dispense cash or even account balances. All it delivered was an error message, but only after customers had swiped their cards and entered their PIN.
The story seemed so plausible -- I'm a fan of crime fiction, after all -- that ever since I heard it, I've preferred to get cash at my own bank's machine. Sure, I could be paranoid, allowing my behavior to be strongly influenced by what might have been just an urban legend, but today an alert came across my desk from the Better Business Bureau that made me feel justified. Not only is the fake ATM a real crime, it's a common one, though a modification to an existing ATM usually does the trick.
[ Got a software or licensing grievance? Find out how to take your tech vendor to small claims court -- and win. | Frustrated by tech support? Get answers in InfoWorld's Gripe Line newsletter. ]
In this scheme, criminals retrofit ATMs with a card reader that stores the magnetic information of customer cards. They then put that data onto a blank card to make transactions -- or cash withdrawals. For withdrawals, they also install a small camera to capture the customer typing in the PIN. Thus, with a small investment of time and equipment, they have everything they need to grab cash from the bank accounts of unsuspecting ATM users.
According to the BBB alert, "ATM skimmers are close to reaping $1 billion annually from unsuspecting consumers. Javelin Strategy & Research estimates that one in five people have become victims."
It's hardly an urban myth. In fact, I think I am revisiting my previous paranoia and considering becoming yet more cautious. Installing a skimming device and a camera is a quick operation, so even the ATM I prefer in the well-lit parking lot of my own bank could fall prey. According to the BBB, in addition to using ATMs that are clean, well lit, and in good repair, I should give it a good visual examination each time I use it. If part of the reader apparatus seems loose, move on -- or pull on it and see what happens.
In May, a Florida man did just that. His bank's ATM looked wrong. He tugged on a part that looked loose -- and it came off in his hand. It was a skimming device. His "paranoia" allowed police to shut down that particular operation a mere 10 minutes after it had been set up, thus saving any number of people from being scammed.
The BBB also recommends shielding the keyboard with a hand or other object as you type in your PIN, even if no one else is around. The cameras used to capture the PINs can be small and hard to spot. But a skimming device that doesn't also have the PIN won't allow the criminals to get too far.
In addition, you should scan your bank statements for charges you don't recognize. Since most banks' fraud departments have gotten good at spotting strange charges, be sure your bank issuers have a reliable way to reach you -- even if you are traveling -- so they can call and confirm anything that looks suspicious.
If you ever lose your ATM card, notify the bank immediately. According to an article on this topic at Bankrate.com, "If you notify the bank within two days of discovering the card was lost or stolen, your loss is limited to $50. After two days, this amount jumps to $500, and after 60 days of receiving the statement with the fraudulent charges, your loss may be unlimited."
Got gripes or questions? Send them to firstname.lastname@example.org.
This story, "ATM Skimming: Cash Machine Paranoia Justified" was originally published by InfoWorld.