Thieves Get Craftier w/Skimmers

Watch Your Debit Cards: Thieves Get Craftier With Skimmers

Consider taking these precautions to protect yourself

By Anthony Giorgianni

Stealing debit card information using "skimmers" at gas pumps and ATMs is an old problem. But thieves are becoming more sophisticated at hiding the devices and getting around some of the fixes merchants have put in their way.


Among the newest tools are deep-insert skimmers, which disappear into the payment device card slot. Skimmers—electronic devices that thieves insert into ATMs and card readers—can record data stored on the magnetic stripe on the back of your debit card.

These newest skimmers are placed deep inside an ATM, behind the shutter of a motorized card reader, and are completely hidden from the consumer. Thieves often use them along with tiny cameras or other devices to capture cardholders' personal identification numbers when they punch them in on a keypad.

"As the last few years have proven, skimming technology and know-how have improved and are more accessible to the general population," says T.J. Horan, vice president of fraud solutions at FICO Card Alert Services. "So we will continue to see increases in compromises and the speed at which they occur."

A study this week from FICO Card Alert Services shows just how big a problem this sort of theft has become. FICO reported a 70 percent increase in the number of debit cards that were compromised in 2016 at ATMs and at card readers used by merchants. It also reported that the number of card readers at ATMs and merchant devices that were hacked rose 30 percent.

Consumers most at risk for debit card theft are those who use nonbank ATMs, such as the ones in convenience stores, and those who make purchases at out-of-the-way merchants, such as remote gas stations, says Michael Betron, a FICO senior product manager.

In addition to using skimmers, thieves also obtain debit card information by installing data-stealing software in card readers and through data breaches, where they hack into the main computer systems where card information is stored.

Some merchants may be able to catch thieves when they return to retrieve the skimmers. But newer versions can transmit data wirelessly to thieves, who then make duplicate debit cards to withdraw cash at ATMs or to make purchases.

If data is stolen from your card, you could find that your debit card was used to make unauthorized purchases or withdrawals from your bank account. The faster you act, the better. Depending on how quickly you notify the bank, you could be responsible for $50, $500, or the whole amount.

“People really need to pay attention," warns Katherine Hutt, a spokeswoman for the Better Business Bureau. "We have convenient access to our money 24/7, but so do scammers."

How to Protect Your Cards

Because it can often be impossible to detect whether a skimmer has been inserted into the card reader you may be using, consider taking these precautions:

Don’t use remote ATMs and point-of-sale terminals. ATMs that are in low-trafficked, poorly lit areas are vulnerable to being tampered with by thieves. So are gas pumps that accept credit cards at stations far from major highways. The safest ATMs, says Owen Wild, director of marketing for security solutions at NCR Corporation, are the vestibule and drive-up machines at your bank. But skimmers have been found even in some of those, he says.

Look for signs of tampering. Before using an ATM or point-of-sale terminal, try wiggling the keypad or card slot, says the police department in Portland, Ore. If anything seems loose, don’t use the device. Also look for keypads that appear raised or have an unusual color, the New York City Department of Consumer Affairs recommends. A thief could have placed an overlay on the keypad to record the personal identification number you punch in. Some gas pumps have security tape that forms a seal around the card reader. If the seal is broken, that could be a sign that the reader has been compromised.

Protect your PIN. Place your hand over the keypad when entering your personal identification number in case thieves have installed a pinhole camera to record it, the Better Business Bureau recommends.

Use a chip card. Credit and debit cards with chips offer better protection than those only with magnetic stripes, Wild says. But that’s only the case if you insert just the chip portion of your card into a reader. If you need to insert your entire card, a skimmer may steal the data from the magnetic stripe.

Check your transactions. Carefully examine your bank account activity online to see whether funds have been withdrawn that you didn't authorize, FICO says. You can also set up an alert so that you're notified when funds are withdrawn.