Visual Autopsy Of An ATM Card Skimmer

Bert64 writes "A chap at work was recently the victim of an ATM card skimmer which took his card details, cloned them and allowed the fraudster to take 550 pounds out of his account. Having tried to explain how the fraudsters can hide a camera and card reader around the ATM, he decided it would be easier to show one of them after a few drinks down the pub. He was a little surprised to find that the machine he chose had a card reader and camera in place. These were removed and analysed, we believe we have reclaimed about 800 pounds worth of kit. Result: Pictures."

550 Pounds of money?!?!?!?

Holy cow! That's a lotta dollars! Hope he hurt his back carting it all away. ;)

Re:550 Pounds of money?!?!?!?

How much is that in kilos?

Re:550 Pounds of money?!?!?!?

About 250 Kilograms [google.com]... man I love google...

Re:550 Pounds of money?!?!?!?

But I'm sure what we all really want to know is, how much is that in Libraries of Congress?

--joedoe

Re:550 Pounds of money?!?!?!?

I guess it's just easier for you to use all *12* fingers then?

Re:550 Pounds of money?!?!?!?

Watch out when you get to 132, you might upset some passerby.

Re: Metric System

Actually, there is one rather good argument for using "English" measurement, at least when one is evaluating length.

It is far, far easier to split measurements in the English scale into fourths and thirds. The math is much simpler to do in your head. Halves work just as well as in Metric (Decimal). Fifths work better under Metric, but English can do sixths.

This is a simple consequence of their prime factors: 2*5=10 as opposed to 2*2*3=4*3=2*6=12.

Feet to yards brings us to 2*2*3*3=36, which is strange but functional, and then we come to miles which is where it all falls apart. But we can't afford to replace all the signs with kilometers per hour. I'm not sure I'd trust American drivers to make the transition safely, either.

Metric is a perfectly valid scheme to nearly all your measuring in. It is superior in several ways to English measurements, but there are valid reasons for not switching to it.

I believe that most people don't want to swap our convoluted babylonian time system for decimal time, and I consider this an example differing in degree but not type from the English/Metric debate.

Much Love,
ArekRashan

Re:Centigrade is artificial, Fahrenheit is natural

Through the magic of this new "real number" system just now being developed we are able to now handle such tricky numbers as 28.4 and 17.1234. It's cutting edge and not everyone can "get" it, but I have real hope fractional numbers will take off in the future.

Re:550 Pounds of money?!?!?!?

"The metric system is the tool of the devil! My car gets forty rods to the hogshead and that's the way I likes it." Abe Simpson [snpp.com]

Re:550 Pounds of money?!?!?!?

Reminds me of one of my favourite Terry Pratchett quotes from Good Omens.

Two farthings = One Ha'penny. Two ha'pennies = One Penny. Three pennies = A Thrupenny Bit. Two Thrupences = A Sixpence. Two Sixpences = One Shilling, or Bob. Two Bob = A Florin. One Florin and one Sixpence = Half a Crown. Four Half Crowns = Ten Bob Note. Two Ten Bob Notes = One Pound (or 240 pennies). One Pound and One Shilling = One Guinea.

The British resisted decimalized currency for a long time because they thought it was too complicated.

Re:550 Pounds of money?!?!?!?

Holy cow! That's a lotta dollars! Hope he hurt his back carting it all away. ;)

Sadly, with the current exchange rate 550 GBP is almost 550 lbs. of USD.

Re:550 Pounds of money?!?!?!?

That's actually true.. If you take your cash in nickels.

Mirror in case of /.

This is a bit creepy. I always wonder when I hit those run-down ATMs in the corner of convenience stores if I might have my card nabbed.
I've stopped using some of the sketchier ATMs because of this.

MIRROR HERE IN CASE OF A /.'ING [sr20.net]

Here is what I do

Two things that I always ask my friends to do too.

1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.

2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.

Re:Here is what I do

Actually, correct me if I'm wrong, but with credit cards, my understanding is that you get nailed for interest the *second* you pull the cash out, unlike purchases, where the interest is calculated at the end of the month.

Re:Here is what I do

You are correct, cash advances on a credit card start accruing interest from the moment they are taken.

It used to be that cash and purchases were treated the same, with basically a month interest-free loan as long as you paid your bill in full, but people could just pay one card with a cash advance from another, and be able to borrow money interest-free for as long as they stayed under the credit limit.

not anymore

These days they nail you for interest the week before you take cash out. And sometimes it's as much as a full billing cycle in advance.

How do they know, tinfoil-hat man? Data mining! They know when and where you'll be taking that cash out, oh yes they do.

Re:Here is what I do

Also, remember that many CCs charge a fee for the ATM cash withdraws, usually 1% to 2%, but not to exceed $20.
Why? CCs make a lot of money from these 1% or 2% they charge for ALL transactions. The difference is that when you use your CC at the store to buy something, the CC company charges the retailer this percentage. When you take out cash, they charge you.

So, whether you use a CC to buy stuff or not, you're still paying for it. Retailers spread the charge from the CC company by simply increasing prices for everyone.

Re:Here is what I do

As an addition to the first point, if you're going to do it at a store choose one that let's you swipe the card yourself. If they have to swipe don't let your eyes off the card. If the card reader is out of view it's in your best interest to go somewhere else.

Toronto police busted 70 people working at convenience stores for double swiping a few years ago. (Between 98 and 2001, as I lived there at the time). A second reader located beside the primary was used to collect card info. I don't know if cameras were used to collect the pins or not.

Since the story at the time indicated that it was mostly employees that had been approached by people not involved with the store, I'm guessing the machines were portable so they could be brough t in and out with the boss none the wiser.

Re:Here is what I do

1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.

You then end up paying a debit fee instead. Admittedly, it's lower than a 3rd party ATM fee, but it's still more expensive than going to an ATM owned by your home bank. Further, a lot of stores don't want to do this, because:

a) In one small pissant purchase, you've cleared out the register of cash, which makes it difficult to give change to the next customer.

b) The store has to pay a debit fee with each transaction. Whoopie, you've bought an 80cent pack of gum (on which only 20 cents profit at most), and are asking the guy to incur 50cents to 75cents worth of debit fees on his end. This is why some stores have a minimum purchase requirement to use debit.

Also, your definition of "no risk" may not be the same as mine. There have been instances in Canada where some of these scammers have set up shop in a real shop. This is how it's done. The first time they swipe your card through, they swipe it through a slot near the real one, and claim the card was rejected or didn't read right. The second time, the card is swiped through the real one and a the real transaction happens. All the while, the "clerk" is watching you enter your PIN, and he's got a copy of your card now. Perhaps this is why the store doesn't have a problem with giving you a cash advance and being hit by the vendor debit fees on such a small item.

I'm not saying that every instance where your card gets rejected is a scam, since it does happen that a card will be unreadable or rejected. I'm just saying there's still some risk involved.

2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.

What, do you work for a credit card company? Unlike credit card purchases which hit you with interest only if you pay late, cash advances put interest on what you owe the instant you get the cash. You've already mentioned the high interest rate. Even if you pay quickly and on time, a credit card advance will have a nasty surprise attached.

Debit generally cheaper, mins are NG

IIRC Debit fees are generally cheaper than the credit fee for the same transaction - it's cheaper for them to let you do debit, and you can shop around for a bank that allows unlimited monthly debit purchases.
and
IIRC MC/V generally do not allow for minimum purchases for transactions - yes, the convenience store just lost 80 cents to make 20 on your pack of gum, but they just sold a case of beer or the 20 gallon truck fillup on 80 cents a minute ago. It more than evens out for most
and
If they are hand entering or mechanically imprinting your card, something's not normal, as they're the most expensive rates (as opposed to just swiping your card). Makes you go hmmmm...

Re:Here is what I do

1) Some merchants charge fees. Many don't as it's cheaper than credit.

2) Some merchants offer cashback as an _incentive_ to get your business.

3) If you clean out the register at a medium to large shop (small shops can be different), you've saved them the trouble. That's that much less cash for them to send out to be converted electronically. Also, it's less cash to send out on armored cars (depending on the size of the merchant).

4) For the places that eat the $0.20 fedwire (Automated Clearing House) fees, it's typically less than the cost of a credit card, and they often don't have to pay a percentage. Buying nothing more than a pack of gum means they lose money, but they run that risk with a Credit Card too.

Re:Mirror in case of /.

Forget sketchy ATMs! $500 was taken from my account using an ATM at a local bank branch machine, in a mall no less! Get this -- they caught the guy after he stole about $64,000 CAD, found out that he entered the country illegally and... sent him to prison? Nope. Our illustrious Canadian gov't deported him. They didn't recover any of the money either. Bastard's living it up in the Caribbean with the cash that he wired there before he was caught.

The bank ate the loss and gave us back our cash, but what kind of justice is it when scammers get to go free with the cash they stole?

Re:Mirror in case of /.

what kind of justice is it when scammers get to go free with the cash they stole?

The bank did not want to press charges as it would have been bad publicity. This was an easy decision for the bank as the criminal was going to be deported regardless.

Re:Mirror in case of /.

In Canada, it doesn't matter whether or not the bank "wants to press charges". If a crime has been committed, the police can proceed without anyone pressing anything.

Why?

Well, a prime example is if the mob is threatening someone to "withdraw" his charge. In Canada, it doesn't matter _what_ the victim says, if it looks like a crime took place, charges will be laid and courts will be involved.

I imagine this "story" about an immigrant was one of those mouth to ear stories, that tends to get altered every time it is repeated.

Re:Testimony

But the case will be built on the testimony of those involved - witnesses. If nobody wants to cooperate, what's Inspector Gadget to do?

Umm... go go gadget sodium pentathol?

-a

No kidding?

This makes Canada an ideal vacation place. I might spend Spring Break robbing Canadian banks. See ya soon.

Re:Mirror in case of /.

Your wrong. They didn't deport him, they sent him back to his riding...

And for those of you who failed to get the joke, check out the Federal government in Canada and the word Scandal.

Re:Mirror in case of /.

Ah, yes. This is one of those irregular verbs, isn't it? I Sponsor, you Lobby, he Bribes?

Re:Mirror in case of /.

So what? 64k canadian is what like 4 dollars?

Easy as Ebay

This is a growing trend. Along with other questionably legal items, you can find a card reader from Ebay [ebay.com] for a fraction of what you can scam.

What ever happened to "Stick 'em up??"

Questionably Legal??

There are plenty of legitimate uses for magnetic stripe readers. Why, here at the University of South Carolina we just installed 3 $1,200 newspaper machines to limit the free newspaper program to students and faculty. I suppose you also think taxing blank CD-R and giving the proceeds to record companies is a good idea, because nobody would ever want to, say, back up data with them.

Re:Easy as Ebay

That's not questionably legal in any way; that's for a cash register. Many registers nowadays are just PCs and use one of those (generally affixed to the keyboard) to process credit card transactions. In fact, the legality of all of the items involved in the fraud is unquestionable. Turning them into the fraudulent device and attaching them to the ATM, however, is just as unquestionably illegal. (FYI, in case you're unconvinced about the Ebay auction, you can walk into any office depot and buy the gadget you linked [officedepot.com].)

Re:Easy as Ebay

Not brain surgery but more sophisticated than a tape head connected to a serial port. Since the speed of the card over the head is expected to have a wide speed range, the reader has to have its own adaptive clock circuitry in it to decode the card, and THEN it's converted to rs-232 or CMOS level signals.

Questionably Legal???

There are a myrid of legal uses for stripe readers, including computer and home security, and making really cool copies of your bank cards*

I have a friend who has a reader who does this.. he takes a plastic generic card with a cool photo on it, with a blank stripe, and copies your ATM stripe onto it. Fully functional, totally customized ATM card.

You should see the looks he gets using his "superman" debit card.

Re:Questionably Legal???

Sounds cool... but just out of curiosity, is it legal to make your own ATM card?

Re:Questionably Legal???

Sounds cool... but just out of curiosity, is it legal to make your own ATM card?

To make? Sure. Afterall, an ATM card or credit card is nothing more than a piece of plastic with a standardized magnetic stripe that repeats the same 16 numbers that are on the front of the card over and over.

To use? Uh... well, that's up to your bank. I kinda doubt they'd be to happy with it.