Automated Theft Machines

Crooks are getting better at stealing your ATM info. Why the U.S. is such a hot spot

By Yudhijit Bhattacharjee Monday, Jan. 17, 2011
    • Illustration by John Ritter for TIME

    One April evening in 2009, a Gray Nissan truck idled in a parking lot across from a Wachovia Bank in a Fort Lauderdale, Fla., suburb. A man wearing sunglasses and a baseball cap hopped out and walked over to the bank's ATM — but not to withdraw cash, at least not right away. With practiced ease, he quickly glued a magnetic-card reader onto the front of the machine, on top of the ATM's card-reading slot, and swapped out the light panel above it with one containing a tiny video camera.

    He and three accomplices returned several hours later to retrieve the camera and the card-reading device before driving to an apartment in Boca Raton for the next step of their operation. There, they downloaded dozens of ATM-card numbers from the device, matched each with a personal identification number recorded by the camera, and encoded stacks of magnetically striped plastic cards with the stolen information. With these cards in hand, the men could go to ATMs and merrily withdraw thousands of dollars from the accounts of unsuspecting victims.

    The FBI managed to catch this Florida foursome, whose members pleaded guilty to charges of debit-card fraud and identity theft and are now in prison. But scores of similar groups, many of them linked to East European crime syndicates, are operating throughout the U.S. Their handiwork — known as ATM skimming — is costing banks in the U.S. as much as $1 billion in losses every year, according to estimates by industry and federal officials.

    "We're seeing it from coast to coast — from California to New York and everywhere in between," says Kim DeLeo, a supervisory special agent at the FBI's headquarters in Washington. Vacation destinations like New York City, Miami and Los Angeles are hot spots, she adds. And the fraud is occurring not just at ATMs but also at gas pumps and other point-of-sale locations where customers swipe their card and enter their PIN.

    Although skimming is a global problem, debit-card holders in the U.S. are particularly vulnerable to it. In recent years, many European countries have given up on cards with magnetic stripes and started using ones with embedded microchips that are harder to skim. Canada is in the process of switching to these so-called chip-and-PIN cards. But the U.S. has no plans to convert, which security experts say makes it coveted territory for skimmers. "Fraud always migrates to the softest target," says Michael Lee, executive director of the global ATM Industry Association. "The more countries you have converting to chip-and-PIN, the greater the risks for the U.S."

    Recent trends in the U.S. support that notion. The number of skimming cases reported to the Secret Service, the primary agency for combatting electronic crimes, has risen by 10% every year over the past three years, according to A.T. Smith, assistant director of the Secret Service's office of investigations. Since 2007, the Secret Service has made more than 5,000 arrests in skimming cases, and the FBI has busted a good number of skimming rings too. And during this period, Smith notes, there has also been "a significant increase in the complexity" of the crime.

    In the '90s, skimmers were typically lone perpetrators who would lurk around ATMs, peeking over people's shoulders to obtain their PINs and hoping that these customers would forget to pick up their receipts, which in those days included an account number in its entirety. Now only the last four digits are printed, which means the bad guys have to work harder before they can dip into people's bank accounts. Fraudsters have started working in groups like the one caught in Florida, targeting hundreds of debit-card holders in a systematic fashion. They begin by using plaster or clay to make a molding of the front of an ATM. Then they build a plastic facade, "sanded down and spray-painted to match the machine so that it is virtually undetectable," says the FBI's DeLeo. In one recent case, the crooks' add-on had signs on it showing how to insert a card, an improvement over the actual ATM in terms of user-friendliness.

    The facade is used to hide a magnetic-card reader, which can be purchased online. Typically, a video camera is concealed in a light fixture or brochure holder overlooking the keypad, although occasionally the device used to capture the PINs is not a camera but a fake key panel overlaid on the real pad.

    To thwart such thievery, ADT Security Services has begun selling technology that can sense the installation of a skimming device and, in addition to alerting security, will jam the skimmer's ability to read a customer's card information. "We've installed this on over 1,000 ATMs for a major national bank," says John Pearce, a marketing director at ADT.

    But that's still a small fraction of the 400,000 or so ATMs in the U.S. Given that banks have to reimburse defrauded customers, why isn't the U.S. turning to chip-and-PIN cards? Because of the high cost involved, explains Doug Johnson, vice president for risk-management policy at the American Bankers Association. Not only would banks have to issue new cards, he says, but all the ATMs would also have to be upgraded, as would point-of-sale devices in millions of retail outlets.

    Until such a switch is made, customer awareness may be the best shield against skimming. That means guarding your security code by placing your free hand over the keypad as you enter your PIN and avoiding ATMs that have glue marks on them. "I probably look like a criminal when I go to an ATM, because the first thing I do is shake the thing to see if it's loose," says Joanne Madden, an FBI agent who has investigated skimming cases. "Then I check for a camera."