A few weeks ago, an American Express security official placed an urgent call to New York City-based Secret Service agent Tim Raymond. Someone in Miami had racked up at least a half-million dollars worth of fraudulent charges against more than 100 American Express accounts. The cards hadn't been stolen, so they had to be counterfeits--very good ones, since they had zipped past the security screens in the computers of the giant charge-card company.
The bad guys in Florida covered their tracks expertly, but the American Express computers spat out a curious fact. Every one of the victimized cardholders had recently dined at one of two New York City restaurants. Raymond and his partners visited one of them, a Brazilian steak house on Central Park South called Plantation, and with the cooperation of the restaurant's mortified owner, they looked around the employee dressing room. There, in an open locker, they spotted the likely culprit: a black box the size of a Palm Pilot, with a slit down the front and bits of Velcro tape on the back. Called a "skimmer," the device can read and store the data embedded within a charge card's magnetic stripe--not only the name, number and expiration date that appear on the card's face but also an invisible, encrypted verification code that is transmitted electronically from merchant to card issuer to confirm a card's validity at the point of sale. By copying that code, the counterfeiter has all the data needed to create a perfect clone of the charge card.
"Skimming is the biggest problem in bank fraud today," says Gregory Regan, head of the Secret Service financial-crimes division. "It's the bank robbery of the future. It's technically simple, point-and-click technology. And the equipment is cheap. If you skim 15 or 20 accounts, you can generate $50,000 to $60,000 worth of fraud, and nobody is going to know about it till the victims get their bills, 30 to 60 days after the crime. So the odds of getting caught are reduced."
Charge card-industry officials decline to say how much they are losing to skimmers--in part because they don't want to scare customers out of using their plastic. But an analysis of industry-published figures suggests that skimmers reaped about $125 million last year, and Secret Service agents suspect that the number is actually higher, with much of that plunder going to international crime rings. "It's not unusual," says Regan, "to see a card compromised in New York City or Washington and the numbers used overseas, in Taiwan, Japan or Europe, within 24 to 48 hours."