Fraud, identity theft grow at ATMs

By Bankrate.com

Before Jay Foley inserts his bank card into an ATM slot, he sticks his finger in. Then he wiggles it.

"If any portion of it wiggles with my pinky, I walk away, because odds are somebody has slapped a skimmer on the front," says Foley, the executive director of the Identity Theft Resource Center in San Diego.

"That applies to any kind of payment slot you might run across, such as gas station pumps. Those are favorite places for thieves to work now."

A skimmer is a device that reads and records all the account information stored electronically on the magnetic strip of an ATM card.

• Talk back: What type of identity theft worries you most?

Its mere existence is proof that if you thought familiar, ubiquitous automated teller machines were much too low-tech to attract high-tech cyberthieves, you need to think again.

Fraudsters have returned to ATMs in force as a favorite fishing hole for that prize catch: your debit card.

With a little light mechanical tampering, thieves can "harvest" your account details and PIN number in seconds, then use them to either produce a "clone" card or to simply shop online until your account runs dry.

"The number of victims we get from debit fraud or ATM fraud is growing every year, and it's growing significantly," Foley says.

Increased danger

ATM crime is increasing now that stepped-up fraud detection software on the credit card side has made signature cards more difficult to attack. Increasingly, thieves are preying on more-vulnerable PIN-based debit cards.

Doug Johnson, a vice president and the senior adviser of risk management policy for the American Bankers Association, acknowledges that ATM skimming may be getting worse.

ID theft by the numbers
Period	12 months
Number of victims	3 million
Total losses	$2.75 billion
Average loss	$900

Source: Gartner, August 2005

"We have seen some increase in reports of ATM skimming that have been reported by the media," he says.

Identity theft resulting from ATM and debit card crime is increasing, according to a 2005 study by Gartner, an information-technology research and advisory company.

Johnson reminds nervous customers that banks issuing debit cards cover most of the losses associated with skimming as a matter of course.

However, in some instances, debit theft can cause much greater financial damage than credit card fraud. While federal law limits your liability in credit card fraud to $50, that same limit applies only to debit frauds reported within 48 hours. After that, you could be out anywhere from $500 to the entire fraud amount.

Avivah Litan, a vice president at Gartner, says an August 2005 study by her company revealed $2.75 billion in ATM/debit card fraud losses over 12 months.

"ATM fraud is definitely on the rise," she says.

Though victims of credit card fraud might have to wrestle with their credit card issuers to remove disputed charges from a bill, debit card victims often face even greater aggravation.

With debit fraud, the thief actually drains the money directly from a checking account, leaving the victim to deal with bounced checks, missed payments and a downward-spiraling credit report while fighting with the bank to correct the wrong.

'Shoulder surfers' catch wave

Thieves compromise ATMs in a variety of ways. Most commonly, they attach a skimming device over the card slot of a legitimate ATM.

After the customer inserts a debit card, the transaction proceeds unimpeded while the thief electronically harvests the account data off the card's magnetic strip.

Crooks simultaneously record the PIN number during the transaction by using an inconspicuously placed camera or touch-sensitive keypad overlay on the keyboard. In some cases, a criminal may actually peer over the victim's shoulder (called "shoulder surfing") during the transaction.

Some enterprising thieves take it a step further and install phony ATMs, usually in out-of-the-way locations such as parking lots. At a recent security conference, Robert Morris Sr., a former chief scientist for the National Security Agency, said thieves have acquired old ATMs on eBay for as little as $1,000.

Foley says some thieves place an out-of-order sign on a working ATM that directs traffic to their nearby bogus ATM.

"Or worse, they put up a machine that says, 'We will clean the mag stripe on your debit cards. Just insert it here, and it will improve the transaction process,'" Foley says. "What you're plugging it into is a skimmer."

Continued: Safe ATMs?

 1 | 2 | next >