All About ATM Skimmers

http://krebsonsecurity.com/all-about-skimmers/

by qiqing • 12 years ago

69 49 12 years ago

pwang• 12 years ago

What I don't understand about this is... why don't ATMs just put a damn motorized door in front of the card reader slot, or alternatively stick out a tray that you put the card in. The door approach makes it so that the thief has very small time window in which to install the skimmer. The tray approach can make it so that a simple internal image of the empty tray can determine if anything is ever left on it which is out of whack.

Yes it costs a little bit more, but CD-ROM drives have been doing both of these approaches for ages, and it would make the installation of a skimmer reader much, much harder.

MichaelApproved• 12 years ago

It costs more but it's also likely to break often and would be a liability. The tray could snap off or a finger could get stuck in it. How annoying would it be if the machine is constantly out of order?

A machine that deals with the general public on a scale of tens of millions has to be rock solid. People can behave really strangely (think drunk people) and all kinds of ridiculous outcomes can happen.

terminado• 12 years ago

In NYC, there seem to be crews that scout out unmanned subway turnstiles, and in the event of a fairly lonely one (I'm looking at you, 116th St. stop on the Bronx-bound B/C), the vending machines (which are built like tanks) somehow inevitably fail to accept bills, coins, credit cards, or any kind of money at all, actually. And guess what; In these situations, if you're caught without a Metrocard, there's usually a helpful street urchin on site, ready to swipe you through the turnstile for a reasonable fee.

I'm not saying this is what will happen to a CD-ROM-style tray approach, I'm just trying to add some context to the idea. Machines exposed to enclosed, semi-public areas have to withstand a lot of deliberate, brutal sabotage, that'll make you scratch your head, and ask why on earth?

With that in mind, protruding parts and orifices generally don't fare well with machines subjected to the abuses of the general public. I think it'd probably cost more that a little bit extra...

hellweaver666• 12 years ago

I recently had a similar situation at the Gare du Nord station in Paris. We were trying to purchase tickets for the train when this guy comes along and forcefully takes over the machine saying it doesn't take credit cards (which we knew it did because we've used them before). He changed the language back to French and proceeded to buy the cheapest metro ticket available then asked us to give him cash based on the more expensive distance we actually wanted to go. Luckily, we didn't have any cash, he even offered to accept pounds or dollars! Eventually after skulking off we went back to the machine and worked it out. If we had taken his tickets we likely would have been picked up by one of the frequent ticket inspections and given a hefty fine.

xnull2guest• 12 years ago

Designing a skimmer-proof ATM is much like designing a squirrel-proof birdfeeder. It looks good on paper but you never know what these guys are going to do.

Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable.

ZoFreX• 12 years ago

Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable.

It's been done. As has creating an entire fake facade and putting in front of the real ATM.

coreymgilmore2• 12 years ago

Adding any deterrent (more, better, larger, etc.) seems to me like a "chicken or the egg" game. ATMs get stronger security, scammers develop better methods to skim. Skimmers improve, ATMs get better security. It becomes a viscous circle of who can outwit the other for a longer time and prove more successful.

Personally, I am more interested in improving security via credit card chips or contactless payment (cards or phones). Chips alone would heavily improve security due to the inherent cost (hopefully) of cracking the chip's data.

m-app• 12 years ago

Don't want to come over as a nitpicker, but the correct term here would probably be a 'cat-and-mouse game'.

Sanddancer• 12 years ago

Too many moving parts that can break, pinch and mutilate. Plus, given previous attempts, it would only block crooks for a fairly small amount of time before they figured out how to counteract it. The best course of action here is to get rid of the sixty year old tech and finish moving to chip and pin, where there is no magstrip to skim.

zephjc• 12 years ago

According to http://www.tomsguide.com/us/chip-and-pin-credit-cards,review... "U.S. retailers have until Oct. 1, 2015, to install chip-and-PIN compatible card readers at stores. After that date, merchants will be held liable for any fraudulent charges resulting from misuse of magnetic-stripe cards."

jkimmel• 12 years ago

At least in Orlando, the new Bank of America ATMs have a slot loading mechanism that takes your card in automatically (as in, you gently place the card in the slot and a motorized mechanism pulls it in).

I wasn't sure of the reasoning for this initially, but my assumption is that it makes it more difficult to skim. The actual 'swipe' in which the mag strip is read seems to occur inside the machine, so a skimmer would need to be mounted with the machine opened up.

function_seven• 12 years ago

Couldn't the skimmer be mounted externally and read the stripe as the motor pulls it in?

dfox3• 12 years ago

That does not deter skimmers in any measurable sense. Most of the ATMs in Europe pull your card in by motorized mechanism and still skimmers are occasionally found on them.

jzzskijj• 12 years ago

Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense. My European credit card still has a magnetic stripe just because I might go to USA. In this side of Atlantic Ocean many stores, bars, gas stations etc. have a card reader in which the card goes only a few centimeters in to read the chip.

mikeash2• 12 years ago

They are going to chips now. (But not pin, so it's chip-and-signature. Not quite as secure, but still much better than a magnetic stripe.) I have two credit cards with chips already, and expect all of them to switch within a year as changes to fraud liability rules coming into effect late 2015 essentially force everything to change over.

deathanatos• 12 years ago

Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense.

What about a chip-and-pin card prevents a skimmer from either monitoring or emulating the radio conversation between the card and the terminal (and thus capturing the card number) and another keypad skimmer from capturing the PIN?

It seems to me that the problem is that everything required to conduct a transaction is handed to every merchant and/or untrusted machine of the merchant. (Compare to public key cryptography, where I remain in possession of a private key.) What about chip-and-pin changes that situation?

dizzy3gg• 12 years ago

In the UK we have chip and pin but the ATM's do not use them, we get skimmed just the same. http://www.bbc.co.uk/news/uk-england-london-28879973

bobbles• 12 years ago

Alternatively they could take the approach of some ATMs in Australia and let you authorise the payment from your phone (using the banks app), not requiring the card at all.

jacquesm• 12 years ago

Because an ATM has to be proof against many things, not just skimmers!

For instance, there are jerks who would simply wreck them. In fact, the skimmers could simply wreck them until the non-asshole proof version was brought back and then happily continue to ply their trade.

It's like designing a vault, only it has to open up to total strangers who happen to have digital keys, and to complicate manners stuff has to go in as well as out and there is a whole bunch of user interface components strapped onto it.

Designing an ATM that satisfies all criteria is very much non-trivial and any 'why don't they 'x'' should be followed by a short period of thinking about what other boundary conditions need to be satisfied.

yoodenvranx• 12 years ago

In Germany the part where you put in your card is made of green transparent plastic which is illuminated from the inside. Inbaddition if is shaped in a way which makes it really hard to add some skimming mechanism in there.

blindfly• 12 years ago

Couldn't they just avoid all this fuss if you insert your card horizontally?

psykovsky• 12 years ago

Can't be done. They would have to change the arrows on all the cards... ;)

eloisant• 12 years ago

What do you mean?

pliny• 12 years ago

Imagine giving the ATM a high-five.

userbinator• 12 years ago

Someone at Diebold had the same idea, apparently quite recently: http://news.diebold.com/press-releases/diebold-stops-atm-fra...

driverdan2• 12 years ago

I've been saying this for 10 years. Pull the card in horizontally instead of vertically and read it inside the machine. Skimming problem solved.

This presents a non-trivial UI problem. Users are conditioned to only insert cards a certain way. Changing that can be very confusing. I guarantee a large percentage of users will try putting their cards in the "normal" way and get confused when it doesn't work.

ZanyProgrammer• 12 years ago

One of the more interesting ways of protecting ATMs that I've seen in the Bay Area is that (this applies more to bank branches) instead of ATMs being built into a wall and facing the outside, like they normally do, you need to swipe your ATM card to be allowed access to the room that the ATMs are located in.

brk• 12 years ago

That is usually just done to keep homeless people from using the ATM vestibule as a makeshift shelter. Almost any basic magstripe card will unlock the door to the ATM, it's not a level of fraud prevention.

michael_h• 12 years ago

That's what one of the examples pointed out [0]. They just put the skimmer on the door instead.

[0] http://krebsonsecurity.com/2011/01/atm-skimmers-that-never-t...

driverdan2• 12 years ago

That's not new or interesting. Many banks do this. The reader at the door doesn't check the card at all, you can use any mag stripe card to get in. Many don't even check the mag stripe. They just have a physical switch that's activated when the card presses against it.

chippy• 12 years ago

So what's the best way to inspect the ATM before use?

leni536• 12 years ago

Just put a smart card chip and the pin code entering mechanism on the card (or authentication token. It doesn't necessarily need to be a "card"). This way you don't have to trust the ATMs. (Or any other device you don't control. How many times do you buy stuff using your credit card?)

artr• 12 years ago

Commonwealth Bank in Australia does something like that. They have a feature in their iOS/Android app that lets you withdraw cash without a card. It generates a code on the phone and also sends you a 4 digit code via sms. Then you enter both codes to their nearest atm. Good for when you've forgotten your card or the atm looks dodhy.

rasz_pl• 12 years ago

You mean like rest of civilized world for the last >10 years? Whats next? NFC? free direct money transfers? you sound crazy

All About ATM Skimmers

Related Stories