Beware: Sophisticated 'skimmers' out to steal your card data at ATMs
Find a Conversation
|Fri, 02-11-2011 - 1:20pm|
Sophisticated thieves are using tiny card readers and pinhole cameras to steal debit-card information from Western Washington ATM users, ripping off hundreds of thousands of dollars in cash and merchandise.
By Mike Carter
Seattle Times staff reporter
Don't fall victim to a 'skimmer'
Bob Kierstead of the U.S. Secret Service offered these tips for consumers:
Don't be in a hurry: When using an ATM, look at the card slot to make sure everything appears normal and there are no wires or anything else unusual showing. Kierstead suggests giving the faceplate around it a wiggle to make sure it's secure and not a facade.
Look for anything unusual: Check around the PIN keypad and make sure nothing appears to be amiss. Are there any objects nearby that could hide a tiny camera?
Conceal your PIN: Kierstead suggests using your other hand to cover the keypad while you punch in your personal identification number.
You're in a hurry and you need cash. You stop at the nearest ATM, slip in your debit card, punch in your PIN, and voilà! You've been ripped off.
It used to be that thieves would rummage through the trash of businesses and banks looking for carbon copies of credit-card imprints.
Today, they install tiny electronic card readers — sometimes cleverly designed to look like the faceplate of an automated teller machine (ATM) — that steal the data of a credit card as it's inserted into the machine. The card readers, some barely larger than a postage stamp, can hold data from hundreds or even thousands of credit cards.
The card readers and the thieves who use them are known by the same name: skimmers.
In one recent Seattle-area case, two men, Ogvidiu Mateescu and Claudiu Tudor, also installed tiny "pinhole" cameras with a view of the ATMs' keypad to record the customers typing in their personal-identification numbers, according to federal prosecutors. In some cases, they hid the cameras in holders for brochures near the ATM, prosecutors allege.
The two Romanian men were indicted two weeks ago on charges alleging they ran a sophisticated debit-card skimming operation, installing the hidden card scanners and tiny cameras on dozens of Western Washington ATMs and then using the stolen information to obtain cash or buy merchandise worth hundreds of thousands of dollars.
According to charging documents and a federal search warrant unsealed last week, thousands of customers of at least seven banks in the Seattle area were victimized.
The grand jury accused Mateescu and Tudor of bank fraud, aggravated identity theft and other fraud-related crimes.
"If a skimmer can get one of these operations up and running on an ATM, they can pull in six figures in a very short amount of time," said Bob Kierstead, the assistant special-agent-in-charge of the U.S. Secret Service office in Seattle, which oversees a multiagency Electronic Crimes Task Force that is organizing the investigation.
Nine different devices
In one 30-day period in September and October last year, the Secret Service said nine different skimming devices were placed on Seattle-area ATMs owned by BECU. Agents say the credit union's machines are "popular with skimmers because of the way the card reader is placed on the faceplate," according to a federal search warrant unsealed Feb. 2.
In that month, according to court documents, cameras at BECU ATMs photographed "persons known and unknown" using stolen credit-card information to withdraw cash or purchase merchandise on 574 occasions.
"The known resulting loss amount to BECU customers during this narrow time frame exceeds $328,906, and, I expect, will increase as the investigation continues," wrote Secret Service Special Agent Malcolm Frederick. The accounts of 281 BECU customers were compromised.
BECU spokesman Todd Pietzsch said BECU purchases its ATMs from the same companies as most other banks and questioned the conclusions that the company's ATMs are any more vulnerable than others.
He acknowledged, however, that skimming is a "real issue" and that the company's security experts have been working with the Secret Service and law enforcement to help identify the thieves. The company is also employing new technology and modifying its ATMs to thwart the thefts.
According to the warrant and court documents, Mateescu and Tudor would remove the devices after a few hours or days, download the data skimmed from the card's magnetic strip, and then synchronize the time the card passed through the skimmer to the recorded time on the video of the customer entering the PIN. They would then imprint a new card with the data and, armed with the PIN, head for an ATM themselves to clean out the victim's bank account, prosecutors allege.
The warrant said ATMs at branches belonging to JPMorgan Chase, the Bank of America, Watermark Credit Union, First Tech Credit Union, Wells Fargo Bank and the Hong Kong and Shanghai Banking Corp. have been targeted. The charges said Tudor and Mateescu "can be identified at multiple BECU ATM locations, often on different days, actively participating in the placement of skimming devices."
The two men were spotted at an ATM in Renton on Sept. 19, allegedly placing and removing a skimming device that had been installed for just one hour, according to court documents.
Four days later, they were questioned by police at an ATM in Woodinville after someone reported they looked suspicious. King County sheriff's deputies later removed a skimming device and a pinhole camera at the ATM.
The men were arrested last November outside a motel in Renton.
Search of room
A search of Tudor's room turned up card readers, computers and other electronic equipment, according to the warrant. In a suitcase in the closet, investigators found numerous fake identification documents, including a Russian visa, a Swedish passport, a Slovakian passport and an Oregon driver's license, all bearing Mateescu's photograph using a variety of different names, the warrant said.
Tudor has pleaded not guilty in U.S. District Court in Seattle. Mateescu's arraignment is set for next Thursday.
Kierstead, the Secret Service agent, said he could not discuss the specifics of the case but said credit-card skimming is a sophisticated and serious threat. Thieves set these devices up on ATMs up and down the coast.
Even if they can't get PINs, the credit-card data sell on the black market for between $20 and $50 a number, depending on how fresh they are, Kierstead said.
And the technology is evolving, he said. The next big worry is Bluetooth technology, which could allow the thieves to install a device and obtain someone's credit-card information in real time.
Skimmers are also being seen more and more on self-serve gas pumps, Kierstead said.
Pietzsch, the BECU spokesman, said the company has installed anti-skimming software on most of its 180 ATMs in the area. Some machines also now have a device that "jitters" the card as it goes into the slot to make it harder for a card scanner to read.
Mike Carter: 206-464-3706 or firstname.lastname@example.org