Visual Autopsy Of An ATM Card Skimmer

Bert64 writes "A chap at work was recently the victim of an ATM card skimmer which took his card details, cloned them and allowed the fraudster to take 550 pounds out of his account. Having tried to explain how the fraudsters can hide a camera and card reader around the ATM, he decided it would be easier to show one of them after a few drinks down the pub. He was a little surprised to find that the machine he chose had a card reader and camera in place. These were removed and analysed, we believe we have reclaimed about 800 pounds worth of kit. Result: Pictures."

550 Pounds of money?!?!?!?

Holy cow! That's a lotta dollars! Hope he hurt his back carting it all away. ;)

Re:550 Pounds of money?!?!?!?

How much is that in kilos?

Re:550 Pounds of money?!?!?!?

About 250 Kilograms [google.com]... man I love google...

Re:550 Pounds of money?!?!?!?

But I'm sure what we all really want to know is, how much is that in Libraries of Congress?

--joedoe

Re:550 Pounds of money?!?!?!?

I guess it's just easier for you to use all *12* fingers then?

Re:550 Pounds of money?!?!?!?

Watch out when you get to 132, you might upset some passerby.

Re: Metric System

Actually, there is one rather good argument for using "English" measurement, at least when one is evaluating length.

It is far, far easier to split measurements in the English scale into fourths and thirds. The math is much simpler to do in your head. Halves work just as well as in Metric (Decimal). Fifths work better under Metric, but English can do sixths.

This is a simple consequence of their prime factors: 2*5=10 as opposed to 2*2*3=4*3=2*6=12.

Feet to yards brings us to 2*2*3*3=36, which is strange but functional, and then we come to miles which is where it all falls apart. But we can't afford to replace all the signs with kilometers per hour. I'm not sure I'd trust American drivers to make the transition safely, either.

Metric is a perfectly valid scheme to nearly all your measuring in. It is superior in several ways to English measurements, but there are valid reasons for not switching to it.

I believe that most people don't want to swap our convoluted babylonian time system for decimal time, and I consider this an example differing in degree but not type from the English/Metric debate.

Much Love,
ArekRashan

Re:Centigrade is artificial, Fahrenheit is natural

Through the magic of this new "real number" system just now being developed we are able to now handle such tricky numbers as 28.4 and 17.1234. It's cutting edge and not everyone can "get" it, but I have real hope fractional numbers will take off in the future.

Re:550 Pounds of money?!?!?!?

"The metric system is the tool of the devil! My car gets forty rods to the hogshead and that's the way I likes it." Abe Simpson [snpp.com]

Re:550 Pounds of money?!?!?!?

Reminds me of one of my favourite Terry Pratchett quotes from Good Omens.

Two farthings = One Ha'penny. Two ha'pennies = One Penny. Three pennies = A Thrupenny Bit. Two Thrupences = A Sixpence. Two Sixpences = One Shilling, or Bob. Two Bob = A Florin. One Florin and one Sixpence = Half a Crown. Four Half Crowns = Ten Bob Note. Two Ten Bob Notes = One Pound (or 240 pennies). One Pound and One Shilling = One Guinea.

The British resisted decimalized currency for a long time because they thought it was too complicated.

Re:550 Pounds of money?!?!?!?

Holy cow! That's a lotta dollars! Hope he hurt his back carting it all away. ;)

Sadly, with the current exchange rate 550 GBP is almost 550 lbs. of USD.

Re:550 Pounds of money?!?!?!?

That's actually true.. If you take your cash in nickels.

Mirror in case of /.

This is a bit creepy. I always wonder when I hit those run-down ATMs in the corner of convenience stores if I might have my card nabbed.
I've stopped using some of the sketchier ATMs because of this.

MIRROR HERE IN CASE OF A /.'ING [sr20.net]

Here is what I do

Two things that I always ask my friends to do too.

1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.

2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.

Re:Here is what I do

Actually, correct me if I'm wrong, but with credit cards, my understanding is that you get nailed for interest the *second* you pull the cash out, unlike purchases, where the interest is calculated at the end of the month.

Re:Here is what I do

You are correct, cash advances on a credit card start accruing interest from the moment they are taken.

It used to be that cash and purchases were treated the same, with basically a month interest-free loan as long as you paid your bill in full, but people could just pay one card with a cash advance from another, and be able to borrow money interest-free for as long as they stayed under the credit limit.

not anymore

These days they nail you for interest the week before you take cash out. And sometimes it's as much as a full billing cycle in advance.

How do they know, tinfoil-hat man? Data mining! They know when and where you'll be taking that cash out, oh yes they do.

Re:Here is what I do

Also, remember that many CCs charge a fee for the ATM cash withdraws, usually 1% to 2%, but not to exceed $20.
Why? CCs make a lot of money from these 1% or 2% they charge for ALL transactions. The difference is that when you use your CC at the store to buy something, the CC company charges the retailer this percentage. When you take out cash, they charge you.

So, whether you use a CC to buy stuff or not, you're still paying for it. Retailers spread the charge from the CC company by simply increasing prices for everyone.

Re:Here is what I do

As an addition to the first point, if you're going to do it at a store choose one that let's you swipe the card yourself. If they have to swipe don't let your eyes off the card. If the card reader is out of view it's in your best interest to go somewhere else.

Toronto police busted 70 people working at convenience stores for double swiping a few years ago. (Between 98 and 2001, as I lived there at the time). A second reader located beside the primary was used to collect card info. I don't know if cameras were used to collect the pins or not.

Since the story at the time indicated that it was mostly employees that had been approached by people not involved with the store, I'm guessing the machines were portable so they could be brough t in and out with the boss none the wiser.

Re:Here is what I do

1. If you can, go to a supermarket or any store nearby that gives you cashback on your debit card. I can buy a pack of gum instead of paying stupid ATM fee AND get cashback with NO risk.

You then end up paying a debit fee instead. Admittedly, it's lower than a 3rd party ATM fee, but it's still more expensive than going to an ATM owned by your home bank. Further, a lot of stores don't want to do this, because:

a) In one small pissant purchase, you've cleared out the register of cash, which makes it difficult to give change to the next customer.

b) The store has to pay a debit fee with each transaction. Whoopie, you've bought an 80cent pack of gum (on which only 20 cents profit at most), and are asking the guy to incur 50cents to 75cents worth of debit fees on his end. This is why some stores have a minimum purchase requirement to use debit.

Also, your definition of "no risk" may not be the same as mine. There have been instances in Canada where some of these scammers have set up shop in a real shop. This is how it's done. The first time they swipe your card through, they swipe it through a slot near the real one, and claim the card was rejected or didn't read right. The second time, the card is swiped through the real one and a the real transaction happens. All the while, the "clerk" is watching you enter your PIN, and he's got a copy of your card now. Perhaps this is why the store doesn't have a problem with giving you a cash advance and being hit by the vendor debit fees on such a small item.

I'm not saying that every instance where your card gets rejected is a scam, since it does happen that a card will be unreadable or rejected. I'm just saying there's still some risk involved.

2. Use your credit card to withdraw cash (but make sure that you pay it in the next billing cycle as cash withdrawls have very high APR) as the liability on credit cards is very low.

What, do you work for a credit card company? Unlike credit card purchases which hit you with interest only if you pay late, cash advances put interest on what you owe the instant you get the cash. You've already mentioned the high interest rate. Even if you pay quickly and on time, a credit card advance will have a nasty surprise attached.

Debit generally cheaper, mins are NG

IIRC Debit fees are generally cheaper than the credit fee for the same transaction - it's cheaper for them to let you do debit, and you can shop around for a bank that allows unlimited monthly debit purchases.
and
IIRC MC/V generally do not allow for minimum purchases for transactions - yes, the convenience store just lost 80 cents to make 20 on your pack of gum, but they just sold a case of beer or the 20 gallon truck fillup on 80 cents a minute ago. It more than evens out for most
and
If they are hand entering or mechanically imprinting your card, something's not normal, as they're the most expensive rates (as opposed to just swiping your card). Makes you go hmmmm...

Re:Here is what I do

1) Some merchants charge fees. Many don't as it's cheaper than credit.

2) Some merchants offer cashback as an _incentive_ to get your business.

3) If you clean out the register at a medium to large shop (small shops can be different), you've saved them the trouble. That's that much less cash for them to send out to be converted electronically. Also, it's less cash to send out on armored cars (depending on the size of the merchant).

4) For the places that eat the $0.20 fedwire (Automated Clearing House) fees, it's typically less than the cost of a credit card, and they often don't have to pay a percentage. Buying nothing more than a pack of gum means they lose money, but they run that risk with a Credit Card too.

Re:Mirror in case of /.

Forget sketchy ATMs! $500 was taken from my account using an ATM at a local bank branch machine, in a mall no less! Get this -- they caught the guy after he stole about $64,000 CAD, found out that he entered the country illegally and... sent him to prison? Nope. Our illustrious Canadian gov't deported him. They didn't recover any of the money either. Bastard's living it up in the Caribbean with the cash that he wired there before he was caught.

The bank ate the loss and gave us back our cash, but what kind of justice is it when scammers get to go free with the cash they stole?

Re:Mirror in case of /.

what kind of justice is it when scammers get to go free with the cash they stole?

The bank did not want to press charges as it would have been bad publicity. This was an easy decision for the bank as the criminal was going to be deported regardless.

Re:Mirror in case of /.

In Canada, it doesn't matter whether or not the bank "wants to press charges". If a crime has been committed, the police can proceed without anyone pressing anything.

Why?

Well, a prime example is if the mob is threatening someone to "withdraw" his charge. In Canada, it doesn't matter _what_ the victim says, if it looks like a crime took place, charges will be laid and courts will be involved.

I imagine this "story" about an immigrant was one of those mouth to ear stories, that tends to get altered every time it is repeated.

Re:Testimony

But the case will be built on the testimony of those involved - witnesses. If nobody wants to cooperate, what's Inspector Gadget to do?

Umm... go go gadget sodium pentathol?

-a

No kidding?

This makes Canada an ideal vacation place. I might spend Spring Break robbing Canadian banks. See ya soon.

Re:Mirror in case of /.

Your wrong. They didn't deport him, they sent him back to his riding...

And for those of you who failed to get the joke, check out the Federal government in Canada and the word Scandal.

Re:Mirror in case of /.

Ah, yes. This is one of those irregular verbs, isn't it? I Sponsor, you Lobby, he Bribes?

Re:Mirror in case of /.

So what? 64k canadian is what like 4 dollars?

Easy as Ebay

This is a growing trend. Along with other questionably legal items, you can find a card reader from Ebay [ebay.com] for a fraction of what you can scam.

What ever happened to "Stick 'em up??"

Questionably Legal??

There are plenty of legitimate uses for magnetic stripe readers. Why, here at the University of South Carolina we just installed 3 $1,200 newspaper machines to limit the free newspaper program to students and faculty. I suppose you also think taxing blank CD-R and giving the proceeds to record companies is a good idea, because nobody would ever want to, say, back up data with them.

Re:Easy as Ebay

That's not questionably legal in any way; that's for a cash register. Many registers nowadays are just PCs and use one of those (generally affixed to the keyboard) to process credit card transactions. In fact, the legality of all of the items involved in the fraud is unquestionable. Turning them into the fraudulent device and attaching them to the ATM, however, is just as unquestionably illegal. (FYI, in case you're unconvinced about the Ebay auction, you can walk into any office depot and buy the gadget you linked [officedepot.com].)

Re:Easy as Ebay

Not brain surgery but more sophisticated than a tape head connected to a serial port. Since the speed of the card over the head is expected to have a wide speed range, the reader has to have its own adaptive clock circuitry in it to decode the card, and THEN it's converted to rs-232 or CMOS level signals.

Questionably Legal???

There are a myrid of legal uses for stripe readers, including computer and home security, and making really cool copies of your bank cards*

I have a friend who has a reader who does this.. he takes a plastic generic card with a cool photo on it, with a blank stripe, and copies your ATM stripe onto it. Fully functional, totally customized ATM card.

You should see the looks he gets using his "superman" debit card.

Re:Questionably Legal???

Sounds cool... but just out of curiosity, is it legal to make your own ATM card?

Re:Questionably Legal???

Sounds cool... but just out of curiosity, is it legal to make your own ATM card?

To make? Sure. Afterall, an ATM card or credit card is nothing more than a piece of plastic with a standardized magnetic stripe that repeats the same 16 numbers that are on the front of the card over and over.

To use? Uh... well, that's up to your bank. I kinda doubt they'd be to happy with it.

Re:Questionably Legal???

In some countries (or maybe only Norway), whenever your ATM card is used in an ATM machine, the machine writes a new unique code to the magnet strip. The next time you use the card, it must contain that specific code, or it is swallowed.

Sadly, the terminals used in stores cannot do this, so you have to use your card in an ATM every now and then, to make sure nobody has a copy of it (quite the opposite of the problem mentioned in this article).

Re:Easy as Ebay

This is a growing trend. Along with other questionably legal items, you can find a card reader from Ebay for a fraction of what you can scam.

What a good post 9-11 American citizen. You are right in calling it 'questionably' legal, unfortunately (for you) the answer to the question is yes it is legal. The government does not need to put Laws on everything that can do bad things, the laws should instead target bad things. DVD recorders should not be illegal...selling (or even just giving) a burned DVD of Star Wars should be illegal. Having a magnetic card reader is a great exercise in driver writing and or learning about it for POS apps (not piece of s&^t apps).

Re:Easy as Ebay

If you're going to go to the trouble to tell people that POS is not an acronym for piece of shit, you could at least have mentioned that it does does stand for Point of Sale (in this case)

If you've ever had to support them (particularly those that some PHB has picked out without consulting his IT people), you'll know that that's generally a fully dual-meaning acronym.

Re:I'll drink to that

Similar to the system we had when I worked at Kinko's, though it was based on an OS/2 server.

It was the graveyard shift's job to wait until around 3 a.m., when there were no customers in the store, to do the daily backup. It took about 15 minutes, and the entire POS system had to be shut down. (I was working graveyard in a giant location with a second floor, so there were 9 machines we had to go around and log out.) The drawers did not open while the system was shut down (there was no way to open them, as you had to log in to use the interface) but sometimes we would leave a cash drawer open in case someone came in just desperate to make their copies quick and pay cash and leave.

One time, we started the backup right after a couple left the store at about 3:30 a.m. They returned about five minutes later, and wanted to do something else. We apologized for the situation, but explained that we would be unable to accomodate them for a couple of minutes. The guy actually threatened to beat up my co-worker for telling him this. (Meanwhile, his girlfriend was mortified by his machismo.)

My co-worker, thinking on his feet, told him he couldn't "take it outside" with him because he was on duty. When asked what time he got off work, he promptly answered 9:00 a.m., and the guy promised to return. I managed to keep a straight face through this exchange, even though I knew for a fact that Bruce clocked out promptly at 7:00 each morning.

Re:Easy as Ebay

selling (or even just giving) a burned DVD of Star Wars should be illegal

I agree, and if that DVD is Attack of the Clones or Phantom Menace, selling any DVD of it should be illegal.

Re:Easy as Ebay

There are lots of good legitimate uses for card readers - things like swipe card doors, as used by the computer society here, or charging for photocopying (as used by the university)

Makes you wonder

Just how many ATMs have this equipment in place?

Bit of a worry really..

And just what recourse do victims have? Is there any way to get your money back, or is it gone forever?

Re:Makes you wonder

Is there any way to get your money back, or is it gone forever?

In the terms of my credit/debit card it says if I notify the bank within a reasonable time period of unauthorized transactions I get the money back. I suspect most banks have a similar deal.

Re:Makes you wonder

This happened to my friends - luckily they were both out of town at the time, and *used* each of their bank cards. The bank gave them an automatic, free overdraft for the amount taken, but it took them about a week to get the money back. (TD Canada Trust, in case you were wondering)

Banks are insured, y'know...but I have to wonder, if they weren't out of town (and able to prove it) would they have been so forthcoming?

Convenience or security...

This is the sort of thing that makes one wary about the convenience ATMs available in many cities; you'll save more than a surcharge by sticking to your own banking company's systems.

On a side note, this is probably the most clever fraud I've seen in a long while. Great that these folks ripped out the innards of the scam device.

Re:Convenience or security...

Well, not really.

The skimmer is attached to any arbitrary machine without the cooperation of the ATM owner.

So they can hit even your own bank's machines, if they so desire.

This is the best ATM scam since... well... the last ATM scam, where they put a complete ATM machine in place. Except they got caught because they tried to stiff their ATM machine supplier.

Re:Convenience or security...

Great that these folks ripped out the innards of the scam device.

I'm not so sure about that. When something similar happened in Norway some time ago, the police was alerted and put the place under surveillance. The culprits were caught in the act of removing the devices.

I think the people who removed it should have done the same, thus helping to catch the bastards. For all they knew, the place could already be under surveillance, giving THEM the blame for the crime...

Re:Convenience or security...

> the place could already be under surveillance, giving THEM the blame for the crime...

That was the brilliant part of their scam. After removing the device and cleaning out all the bank accounts, they posted the whole thing to the Internet to create a cover story in case they were watched!

shouldn't ATM machines be designed better?

How hard would it be for someone to design an ATM machine that would make it more dificulty to conceal a card reader... or better yet one that made it impossible to insert your card if anything is attached... it would seem that with some common sense a designer good create some pretty good safe guards... or am I just missing something?

Re:shouldn't ATM machines be designed better?

or am I just missing something?

Maybe the ATM designers just happen to be the same folks that are installing the cameras and readers. :)

Re:shouldn't ATM machines be designed better?

Even better would be the use of smartcards instead of current cards. The card simply has its own private key, the ATM machines/bank issue a challenge to the card and verify it against the known public key.

The private key is never divulged yet the authenticity of the card is known. There is no way to scam the system other than steal the physical card and know what the pin is. These really need to be adopted soon.

Re:shouldn't ATM machines be designed better?

"You have a reader that reads everything on the card on the way in, so they get the public key."

You don't send a key, you send a challenge that somebody with the private key can answer. There are challenge-response protocols that reveal zero knowledge to eavesdroppers. One of them works something like this: The card knows secret number X. The bank computer knows secret number X^2. (All arithmetic is done modulo a preselected large number with certain properties.) For one challenge, the card makes up a random number R and transmits (RX)^2. The bank flips a coin and asks the card for either RX or R^2. If the card really knows X, it can easily answer either question. In either case, the eavesdropper sees (RX)^2 and either RX or R^2, but, because of R, these are just random numbers -- if R is uniformally distributed (over the modular domain), then RX is also uniformally distributed; there is no information in it. An eavesdropper can learn what X^2 is, but the numbers are chosen so that it is (believed to be) extremely difficult to find X from X^2 (modulo the preselected number).

Could somebody pretend to know X? Instead of sending RX, they could make up a number S and send S^2. Then if asked for RX, they could send S, and it would pass the check. Alternately, they could spoof in a way that allows them to correctly answer a request for R^2. However, it is as difficult to be able to answer both as it is to find X from X^2, because being able to answer both gives you the information needed to find X.

Since a malicious person could spoof the test half the time, you repeat the test many times, say 30 for a one-in-a-billion chance of passing. Various caveats apply; search for "zero-knowledge proofs" for more details.

Re:How hard can it be.........

If anything around the card slot looks suspect - just get hold of it and pull!

Getting arrested for vandalizing an ATM: Priceless. :P

hunh...

Was this the pass through kind? how was the camera attached? If I used one hand to cover the other hand while keying the PIN would that "thwart" it? Great pix but I could also use a little more commentary on what to watch out for.

Re:hunh...

If someone could break into an ATM and install a camera and reader, why not just take the money inside instead of leaving all that gear around?

Aside from the fact that skimmers generally don't involve getting into the ATM at all, "getting into" the ATM is quite a bit different from getting into the cash safe inside. In fact, in any case where the ATM is serviced by an armored-car service, generally the owning bank can open the ATM but even they can't open the cash safe.

When I worked at the bank, we had someone take an ax to one of our brand-new ATMs. It was annoying all around because on his side, (1) it wasn't live yet, so there wasn't any money to steal, (2) he couldn't get into the safe anyway, (3) he cut himself trying; and on our side (1) the ATM itself was a loss, and worth more than the amount of money it could hold, (2) we'd *just* finished configuring and testing it and now had to start over, and (3) the video camera wasn't live yet so we didn't get to see the guy. (We did have some nice blood samples, and bloody fingerprints, but I never heard if anybody got caught/charged.)

Great plan

recover 800 pounds worth of equipment and incurr 2000 pounds of bandwidth costs bragging about it. The guy who lost the 550 pounds is going think that was nice compared to what just got done to him by slashdot.

That's silly

Making money by having an expensive digital camera to disguise it as ATM chrome, grabbing PIN numbers and making yes-cards out of the process is dumb. The guy would probably have made more money setting his hacked camera in some lady's shower and selling the videos on the net. Or gee, even selling the hacked camera itself to would-be private-eyes, as most of these folks are willing to spend a lot of money on any spy-ish electronic device, and it would be legal too.

Re:That's silly

Are you retarded? One day of skimming numbers and magentic strip codes would net you more than twenty accounts, probably containing thousands of dollars each.

This is how Skimmer works

in case you're wondering:

To accomplish this task, the thief places an electronic "skimmer" -- a card swipe device that reads the information on the card's magnetic strip -- on the ATM machine. Attached to the device, or placed discreetly elsewhere, is a small camera that captures the customer's PIN number when they enter it. The information is either collected by the device, or transmitted to a remote receiver. The thief then takes the codes and creates a counterfeit ATM card in order to empty the victim's bank account. Some skimmers can even capture the information and send it to the ATM at the same time. Since the machine works normally, the victim is unaware that they have just given a thief the key to their account. copied from here [state.fl.us].

Interesting camera

Why'd they use a Cybershot? I personally have a DSC-P71, but you could get a much cheaper camera and do the same thing.

Anyway, I remember reading an article (might-a been on /.) about buying an ATM and hacking the software to record the information for him. It's supposed to be much harder to find than this kind of "noticeable" trick.

Re:Interesting camera

This camera captures 15 seconds of video... Card goes in, activate a 15 second video grab... that should be more than enough to catch the 4-6 digit code most people use. (usually 5 seconds or less). the 500MB card means that you could save a LOT of those videos...

The biggest thing seems to have been the size...Once they ripped it out of it's housing, the camera wasn't much bigger than the batteries.

At $1000 per setup, thay'd only have to catch 2 cards to get their money back. After that, the rest is profit.

Explains a lot

This could explain why the people in front of me in ATM queues always take so long.

I'd always assumed they were incompetant morons. Perhaps they are just security concious and are waiting 15 seconds before typing their pin in case a camera is recording.

Re:Teller versus ATM

I seriously wouldn't have an idea as to how to get money from a teller. You like show your ATM card or something?

Re:Teller versus ATM

Well, at my bank you go inside, fill out a withdrawal slip (which is very much like a check, but you also have to write your account number on it).

Then, you get in line behind a large number of old people and people who can barely speak English, and for variety, some old people who can barely speak English-- all of whom have little idea of what they want/need, and all of whom will actually try to haggle with tellers over a few cents of interest.

After waiting for a very long time and getting irritated at the stupid things you overhear the people in front of you say, it's your turn. You give the withdrawal slip and a photo ID (usually a driver's license) to the teller, and they process it and give you your money.

If ATMs didn't exist so I could avoid all of the above, I would probably keep my money in my mattress. The bank needs a special express line for people who are under 50 years old, can speak English well, and have very simple transactions to make. Just like the post office needs one for people who have well-packaged, correctly-addressed outgoing mail and the cash to pay for postage in hand-- because that's another place I hate standing behind clueless retards.

~Philly

Try a bank/post office in one

Seriously, the German national post office is also one of the largest banks in Germany. Makes sense on a certain level - every little town already has a post office, so why not just add bank services to the existing office.

But, here's the problem: not only do they offer banking and postal services at the same wickets, they also don't seem to have discovered the marvelous North American method of having one line up for multiple tellers. You don't really appreciate having the first available clerk can always help whoever has been in line longest, until you live out the alternative.

So, you go to the post office with your single envelope, correctly addressed, just needs to be weighed and have postage slapped on it... You have to carefully scan the lines, and suss out the people waiting. That fellow with the big fat envelope - is he mailing something in bubble wrap, or is it full of unsorted petty cash and small cheques that need to be deposited into three different accounts? That lady with the shopping bag - is she checking her PO box, or remortgaging her house?

Re:Teller versus ATM

I seriously wouldn't have an idea as to how to get money from a teller. You like show your ATM card or something?

I can only think of one place to press in my PIN on a teller, and I'm sure she'd slap me.

Another interesting link:

Saw this recently on memepool.com:

http://www.utexas.edu/admin/utpd/atm.html [utexas.edu]

Idea!

Have all Slashdotters run around ATMs and check for card skimmers. If found, remove card skimmer, take home, disassemble, build into $anything, add keypad and have your own PIN access system to $anything! All the while doing the rest of the world a favour by taking away card skimmers! Woot!

Re:Idea!

This was modded funny, but Vigilante anti ATM-scammers may be a good idea. Freelance geeks who get cool toys in return for making the world safer. Win-Win situation.

This only works with poorly designed ATMs

My bank uses ATM machines that suck the card completely into the slot, with only a little bit of a metal guide plate exposed below the slot. (Typically, they have a label with arrows printed on it that's affixed just beneath the slot, as well.) If you tried to add some sort of reader device to the front of the ATM, covering the original slot and plate, it would be fairly obvious it didn't belong there. I'm sure it might fool *some* clueless people - but it would surely be ripped from the machine pretty quickly, as someone a little more clueful realized what was going on. (After all, it would obscure part of the label, making it obvious it wasn't part of the original ATM machine.)

I have a feeling these card skimmers only work on specific models of ATMs (most likely, the little privately owned units you see in restaurants and gas stations, as opposed to actual bank-owned ATMs).

Re:This only works with poorly designed ATMs

If you look at the site amarodeeps linked to in his comment [slashdot.org], a cardstealer like the one shown would be able to steal swipes without too much difficulty. If you haven't seen the ATM before and don't know what it is supposed to look like, it will look quite natural. Most folks don't use the same ATM often enough to remember that the card guides on the sides weren't there last time.

Death of the PIN

I wondered how long the four digit ATM PIN would last. I also realized that with the phone-cameras, it would be fairly simple to snap a shot of someone's PIN over their shoulder.

Could this be the death of the PIN? What's next - biometrics? Will this last only as long as it also cannot be spoofed?

ATM bug-detection should be a profitable area of research for the next few years.

Re:Death of the PIN

Could this be the death of the PIN? What's next - biometrics? Will this last only as long as it also cannot be spoofed?

The advantage of a PIN over biometrics is that you can always change your PIN.

Once someone finds out how to fool a biometric scanner into returning your biological data; you're hosed. You can't gouge your own eyes out and replace them with new ones.

Any security system whose keys can't be changed is fatally flawed and should not be used -- ever.

Alternative approach

Hate to be a party pooper but didn't you consider leaving it there and calling the cops ?

If you had they might have been able to bust the individuals concerned and saved some innocents down the track a lot of grief.

This way you got 800 quid's worth of stolen electronics, the thief wrote off some capital investment and a couple of thousand /.'ers got some pre-pubescent excitement. Wahooo.

Interesting!!

A couple of months ago my Hotmail account was besieged with spams offering to show me how to make my first million by installing and servicing their ATM machines. I kept wondering if they wanted to make me a shill for some skulduggery like that described in the article. The interesting part was that the ATM's so advertised would be located "in my area," which they had pinpointed at Washington, DC (not far from here).

Like others here, I've become very leery of using ATM's located anywhere but at banks. I've been driving on long trips a great deal recently, and I've also learned to be a bit discerning about card-swipers in gas stations and even grocery stores I'm not familiar with. It seems a safer bet to hit a bank occasionally to withdraw my allotment of yuppie food coupons ($20 bills) and spend those instead.

Anne

prevention ...

Most of the scams I have seen like this rely on recording your PIN based on what you type.

The earliest versions simply had someone peering over your shoulder, or using a camera/telescope mounted up and behind and stealing the original.

Get in the habit of 'embedding' your PIN within a larger number. Type this longer number too lightly to casue the pressure sensor to register and varying your pressure only on the 'key' digits. It won't fool decent resolution or close observation, but given the angles/lighting conditions and cheaper digitial cameas that are starting to show up, I am guessing that they are going to have trouble working out which hits are the real McCoy.

Sure it relies on making your case more difficult than your neighbours, but to an extent that is all most locks and security devices do. Sure it's paranoid, and it does take some effort to set up, but muscle memory handles most of the work after a while and these days I only get a few false hits. YMMV

Re:prevention ...

I always do this, although my method is a slight variation. I like it better, but people are free to try anything that works for them.

It's quite easy to do, and if you take the time to practice it each time you enter a PIN for a short while, it becomes second nature and you don't even need to think about it (leaving you free to scope out the area, the people around you, and yes, even look for cameras, as you should do at any ATM). I almost never have received a dialog about an incorrect PIN. Maybe it happened once (I've done this for years), but I can't remember any incidents of bad entries.

What I do is place more-or-less my whole hand on the keypad, with pretty much every finger and my thumb touching a key; and press the relevant numbers with different digits (fingers/thumb).

You hand barely moves when you do it right, and all the fingers, including the unused ones, kind of move a bit when you enter a number; it's really impossible to know which keys were pressed in which order. Try it.

Insert Your Card Machines Only?

The hack done (and those you usually hear about) work by modifying a machine where you have to insert your card. Does anyone know of the machines where you just swipe your card yourself are safe from this kind of tampering? I would think it would be VERY hard to add a skimmer without it being noticed unless you had enough physical access to the machine to take the cover off, make another little hole where the card swipes by and position the magnetic reading head in there, etc.

Still, very interesting to see. I'm quite suprised at the digital camera half of it. Of course something like using fingerprints or some other kind of biometric would make things much harder for the thief.

notify authorities?

i mean i know it does in the name of science and interest and all. But should'nt you have notified the cops? and the bank/owner of the ATM. the cops could have tried to lift prints. Maybe tracked down the persons doing this and arrested them.

Sure...

Drunk guy: Here, I took this from an ATM machine *hicup*
Police guy 1: Destroing private propriet while drunk uh?! You are under arrest!
Police guy 2: These gang ppl are getting even dumber!

this reminds me of

the story of the ATM machine left infront of a convenience store. People whould come up to it insert their card, type the pin and be presented with an error saying there is no more money left in the machine. A week later the machine disappeared. All the people who had used the ATM had given the data form their ATM cards and pin numbers to a fake machine that was logging the info!

An idea

PIN numbers and the way they are entered have terrible security implications.

Why can't you, say, have a 5 digit number and the ATM machine would ask you something like "What is your first, third and last number?" or "What is your first number plus your fifth number?"?

Or how about you have to look through a keyhole to see the ATM monitor so nobody else can see it. Then, before it asks you to enter your details, it shows you the mapping of the keys on the keypad. So, if you have a 9 digit keypad, it would shuffle the numbers around you look into the keyhole and see:

167
482
539

Then you'd press the button that is in the right position for each number.

Re:An idea

Because--and I know it's been said already, but it's important enough to say again--people are fucking stupid.

Of course, that shouldn't stop the bank from offering my optional security measures such as the ones you detailed above. Oh well.

Re:An idea

Because the Americans with Disabilities Act forces even drive-thru ATMs to have braille. Never mind the fact that the on screen displays aren't standardized and the prompts point to different buttons at different banks. Any system you come up with that requires a sighted person to operate will not work.

Rules for ATM Skimmers

Rule #1: Always remember which machines you've bugged so you don't accidentally expose your work during "investigations."

Rule #2: If you fail to follow Rule #1, act surprised and shocked at your "fortunate discovery."

Rule #3: If your work is exposed, especially in a Rule #2 setting, be sure to dismantle it so the destination can't be traced.

You idiot!

You idiot! You just stole your bank's security camera

Smartcards

Over here in Australia some of the banks have started a transition to Smart cards. The Idea being that it is a lot harder to duplicate a microchip than to fake a magnetic strip.

ANZ Bank [anz.com]

it also uses the Microchip as part of the auth for web banking. So what if they get your pin, how the hell are they going to duplicate the smartcard.

Re:Why use someone elses machine?

I know a few people who have delved into the 3rd-party ATM business. Note to non-Canadians: by law the bank has to let authorized independents access the Interac system. You go through quite a bit of verification; it's no way to scam anyone.

The machines usually cost near $C 10K each, I suppose it's possible to buy one for half that used.

The hard parts are:
You need a bunch to really make it worthwhile; one machine is too much trouble for the piddly returns you get.
They don't hold much cash; you have to refill often and it's going to be out-of-order (read: out of money) a lot if it's in a high-demand location. Try the 7-11 or a local bar.
You have to somehow get a good location; usually this means giving a half-cut to the owner of the business you put it in. Indoors, locked at night, basically.
You have to have the cash to keep it full; you need a float of a couple grand a machine, minimum. More is better, saves trips to fill it up, but you can start with that and fill it twice a day if you have to, till you start making money.
After you piece off your retail partner (for the location) you can gross 75cents a transaction. If it's really competitive (as it seems to be where I am) you might end up giving the store a buck to keep the machine on their premises. At 100 transactions a day, that's 75 bucks or less. A hundred transactions requires a float near 10K per machine, or alternately thrice-a-day refills. Now you know why you need to have a dozen or so to start; one machine is just as much trouble as 10, so you may as well make a full-time job of it.
Most of your machines won't average that many transactions. A hundred a week is apparently more common (they're everywhere; and each new one siphons off some of your traffic).
The guys I know recently sold them off; the two of them had 8 altogether. Too competitive, the damn things are everywhere and many bar owners, gas stations and convenience stores just buy their own and keep the whole buck-and-a-half.
They didn't make a killing; but if you were really into it and got up to 20 machines the income would be enough to support a full-time person. Hardly lucrative, but an enterprising individual can do OK.

How not to Get Scammed at the ATM

Here's some great tips on how not to get scammed at the ATM [lostbrain.com]. It's also got some images of a modified ATM...

Recent spat in Canada

These skimming devices were commonly detected in Canada (Ontario) during the last year or so.

They are becoming more and more sophisticated, and the police busted several people for it, and issued precautions for the public:

- Try to use machines in the bank branch you deal with
- Try to avoid machines in public places (malls, convenience stores, ...etc)
- Report anything that looks suspicious on a machine

Fonzy every Machine

This just proves that you should smack every machine a few times before and after you use it. If you smack it hard enough you get a few spare parts and protoect your credit. I have taken to kicking, shacking, and hitting every vending maching I use in the name of safty. BTW the same thing applies to people, but with them I have found poking with stick to be the best method.

Dusting for Fingerprints

Is out of the question now. It is against the law to destroy a crime scene, or tamper with evidence. Regardless of police involvement, the person taking this device knew what it was, he therefore committed the crime of destroying evidence. The person who stole the card info just got away, but how about the people who just destroyed this evidence?

ATM security issues in Austin

The U.T. Police Department Web site has an interesting article [utexas.edu] about skimmers in use in the Austin area. Check out where they put the camera!

Skimmer with Radio Transmitter

The ones in Hong Kong use radio transmitters instead of flash cards. Here is a picture of one [imagedeposit.com] installed on an ATM. Pretty hard to see, huh? Also here is the police report:-

Crime Information : Skimming Device Installed in ATM (TW RN04000499)

Location : Two ATMs outside Hang Seng Bank, Tai Ho Road.

Facts: On 2004.01.05, ATM maintenance worker of Hang Seng Bank conducted a routine check and confirmed that 2 metal covers (of same design) were being 'fitted' onto the top ledges of two of the ATM machines.

The Skimming Device:-

• i) the metal covers, 60cm x 4cm x 2cm in size, painted in the same colour as the ATM, were installed perfectly onto the top ledge of the ATM panel;

• ii) a pinhole camera lens was installed inside the metal cover facing the screen panel with a view to reading the pin number. This was connected to a transmitter which has an emitting range of about 200M and could work for 9-12 hours with three 9-watt batteries, and

• iii) a false card reader was believed to have been fixed to the card slot of the ATM but had been removed prior to being discovered.

• iv) This is the first time that a device of this nature was placed in such a busy location. The device was first reported by a bank customer on 2004.01.04 but no action was taken by the bank until 2004.01.05. CCB will follow-up on this issue.

ATM skimmers, also in brazil

check out this story [snopes.com] and pictures of a skimmer at work in brazil.

Why are US banks still using magnetic cards ?

Many other countries have been using cards with embedded chips for something like the last 20 years: you cannot copy them and they can contain their own hard wired algorithms to test for challenge/response from the reader.

It may sound like a troll, but why is the US so conservative in regard to their money: card with only a magnetic stripe that you can copy with a 80$ reader, money in 2 colors on plain paper that you can xerox (almost [slashdot.org]) easily...

In Japan, ...

... they have some old ATM where the numbers are arranged in one loong row of large buttons ... completely impossible to hide what you're typing.

But then, their new generation of ATM's have a touch-screen LCD to display the number pad -- and the digits are randomly rearranged between uses. Now that's secure (but not so ergonomic).

Happened to me...

...almost.

Went to take some money out late one night. There were about three (eastern european) guys huddled around the machine fiddling. Went to get money out, and the machine held out to my card - you could see the card in the slot, but couldn't get it out. Guys reappear and tell me something like "Oh. I've seen this before. Press blah, blah, blah and enter your PIN" while standing over me. Hmm, I don't think so...

So, I step back call my bank, wait on hold for an age, and as soon as they hear me confirm to the bank I want to cancel my card, I get my card thrown back at me by said guys, and they scarper into a car that has subsequently double parked.

I reported it to the local police station, and they said it happens all the time, but it wasn't actually a crime until they withdrew money (!!!).

It's called a "Lebanese Loop". More info here:

http://hoaxinfo.com/atmscam.htm [hoaxinfo.com]

I see plenty of machines in London with glue residue around the card slot. This must happen all the time...

Yeah for fingerprinting at the very least

At the very least the cops, err... bobbies, might have been able to get a finger print or two, trace the purchase of the camera or the serial number on the SD card. Even if it doesn't lead to a direct capture, this sort of thing stays on record and can be used later when these scammers inevitably get nabbed for something else down the road.

Besides, what about the other victims? Now there's no evidence that they were scammed too. They might have to eat the loss themselves without some corroboration that they were scammed.

Also, the equipment may have cost the scammers more than this particular victim lost, but is this junk really worth much at all to the victim other than bragging rights?

Finally, aren't a lot of British cities brimming with cameras these days? If this stuff had been left in place it might have been possible to track the scammers when they picked the equipment up.