Tip sheet
Kent Harris/SwitchYard Media
Written by Scot Meyer
SwitchYard Media, Inc. - contact | website
Designed and produced by Kent Harris
Tin Can Rocket, LLC. - contact | website
A production of SwitchYard Media, Inc.
Photo Credit: Courtesy Diebold
Is your ATM safe?
ATMs offer convenient access to your cash 24/7. And that also makes them a tempting target for criminals who have found ways to use technology to tap into people's accounts and steal their money.
The Global ATM Security Alliance, an industry group, says such crimes affect only a tiny fraction (less than 0.2%25) of the roughly 49 billion ATM cash withdrawals made worldwide each year. But ATM fraud still costs the U.S. banking industry about $60 million a year.
"We've seen a significant increase in activity in the past 18 months or so," says Jim Pettitt, the director of ATM security and planning at Diebold, a cash machine manufacturer. Two "skimmer" operations discovered in May in New York, for example, had raked in nearly $2.3 million from bank customers.
The threat: Skimmers who modify an ATM to capture your card data and personal identification number, then clone your card and access your account.
What to watch for: An ATM that looks different from its neighbors or has ill-fitting or mismatched parts.
What you should do: Use machines in bank lobbies or that are under video surveillance, which are less likely to be tampered with.
Photo Credit: Courtesy APACS
Reading your fortune
The first things skimmers need are your name and account number, which they can get from the magnetic strip on your bank card.
They can do this by using a card reader of their own, installed over an ATM's built-in reader. Less sophisticated scams may use separate readers with signs or stickers directing consumers to use the bogus one instead of, or in addition to, the one mounted on the ATM.
Thieves also can employ advanced devices that transmit skimmed card data via cell phone. That way they don't risk detection or arrest by coming back to retrieve phony card readers or other devices.
The threat: Bogus magnetic readers that can capture data from your bank card.
What to watch for: An ATM with a card slot that is hard to use, sticks out more than usual or seems loosely attached.
What you should do: Switch to another machine.
Photo Credit: Courtesy APACS
Caught on camera
The would-be thief also wants your personal identification number, or PIN.
One way to get it is by installing a small video camera that can record your keystrokes as you punch in your code. Tiny cameras have been found hidden on ATMs themselves or mounted nearby.
An ATM was spotted recently in Manhattan with an extra security mirror mounted above it; that mirror hid a video camera with a view of the keypad. Cameras have also been found mounted in brochure holders near ATMs.
The threat: Hidden cameras that can record your PIN.
What to watch for: A tiny hole in an ATM's housing or in an object near the machine.
What you should do: Don't use an ATM that has unusual features.
Photo Credit: IdentityTheft.info
Finding the key
Another way for a crook to get your PIN is by overlaying a device on top of a legitimate keypad.
Such fake keypads are thin and can look and feel much like the real ones they are covering. And each key press on the overlay triggers the real key below it, so your transaction proceeds normally.
As a result, you may not suspect that anything is wrong, but all the while the overlay is recording your keystrokes, storing the digits for later use.
The threat: Keypad overlays that record your PIN when you type it in.
What to watch for: A keypad that seems loose or looks different from those on other machines.
What you should do: Try to wiggle an ATM's keypad and card reader before you begin a transaction, and don't use the machine if either feels loose.
Photo Credit: Courtesy Diebold
Sneaking a peek
Some thieves use a low-tech approach to get your PIN called "shoulder surfing." It involves someone standing behind or beside you who watches you type in your code.
For that reason and others, it's a good idea to be alert when you use an ATM, keeping an eye out for anyone loitering by the machine.
Also, the American Bankers Association recommends that you cover your hand when punching in your PIN. Get in the habit of doing it even when no one else is around, because the same technique also may thwart any hidden camera trying to record your keystrokes.
The threat: People trying to watch you enter your PIN.
What to watch for: Someone loitering near an ATM or standing close while you use the machine.
What you should do: Cover the keypad when punching in your PIN. Don't use the machine if you notice a suspicious person nearby.
Photo Credit: Courtesy Diebold
False friends
If the ATM you're using doesn't return your card, be careful if another customer steps up and tries to help you. Sometimes a scammer will pretend to offer assistance as a way to trick you into revealing your PIN.
Also, do not give your PIN to anyone who phones you or e-mails you. Often thieves will steal a card, then contact the cardholder, pretending to represent the issuing bank or the police. Their real goal is to get a PIN number to go with that card.
You can also make their job harder by memorizing your PIN, rather than writing it down and keeping it with your card.
The threat: Pretenders who try to trick you into revealing your PIN.
What to watch for: Someone who, in the guise of being helpful, asks you for your account number or PIN.
What you should do: Don't give out your PIN. Be suspicious if someone asks for it.
Photo Credit: Courtesy Diebold, IdentityTheft.info
Other scams
ATM makers say a thief may use a device that looks like part of a card reader to trap your card, with the aim of retrieving it after you leave. If this happens to you, don't re-enter your PIN. Instead, report the matter to your bank or credit union right away.
Another trick involves putting a false front on a machine to intercept the cash you're withdrawing or depositing.
And ATMs are not the only machines being tampered with by thieves. Phony card readers have been found on DVD rental kiosks and on card-activated pumps at gas stations.
The threat: Other credit or debit card machines that may be compromised.
What to watch for: Skimming devices attached to card readers or devices that trap your card or intercept your cash.
What you should do: Exercise the same caution as you use with other card machines.
Photo Credit: Courtesy Diebold
Countermeasures
Banks and ATM manufacturers are doing what they can to prevent skimming. Some banks in Europe have started issuing cards that use chips, rather than magnetic strips, on the theory that such cards are harder to read and clone.
ATM manufacturer Diebold has developed a sensor system for detecting the presence of a skimmer. Diebold and NCR, another ATM maker, also have developed machines that intake cards in a jittery motion meant to prevent skimmers from working. Still, the threat is constantly evolving.
"We have an internal task force, and we do try to stay one step ahead," says Jim Pettitt, the director of ATM security and planning at Diebold. "But there is no silver bullet."
The promise: Banks and ATM manufacturers are taking steps to thwart skimmers.
What to watch for: Newer machines that have technology to prevent skimming.
What you should do: Take heart, but don't let your guard down.
Photo Credit: Courtesy Diebold
The best defense
By knowing what to look for and being alert whenever you use an ATM, you may be able to spot skimming devices and avoid being scammed.
But because thieves are getting more daring and the technology available to them is getting better all the time, even the most careful consumer can be fooled.
That's why banks recommend that you regularly check your account balances by going to their online banking sites, by phone or by printing out statements at an ATM. That way you can quickly spot unauthorized transactions or fraudulent use of your cards.
The threat: Someone who steals your card information and uses it to access your account.
What to watch for: Unexpected charges or other irregularities on your bank statement.
What you should do: Notify your bank immediately.
Photo Credit: SwitchYard Media
Act, don't hesitate
If your card is lost or stolen, or if you find that someone has been making unauthorized withdrawals from your account, you should report it to your bank right away.
Remember that your liability for fraudulent use of your card depends on how quickly you report the loss. Wait longer than 60 days, and you could be on the hook for the whole amount.
The American Bankers Association recommends that you keep a list (in a safe place) of card numbers, PINs, expiration dates and the toll-free numbers of your banks. That way you can report any problems quickly and easily.
The threat: You are protected by law when thieves access your account, but only if you report losses promptly.
What to watch for: Missing funds from your account or a missing card from your wallet.
What you should do: Contact your bank immediately if your card has been lost or stolen, or if funds are missing.