How Anti-Skimming Sensors Work

[Mutt]

Anti-skimming sensors are hardware and software solutions used in ATMs and POS terminals to detect and prevent the installation of skimmers - devices designed to steal data from the magnetic stripe or EMV chip of bank cards. These sensors help protect card data such as the number (PAN), expiration date and CVV, which carders can use for fraud. For educational purposes, I will describe in detail how anti-skimming sensors work, their types, technical aspects, integration with other systems, effectiveness and limitations in the context of combating carding.

1. What are anti-skimming sensors and their purpose​

Anti-skimming sensors are devices built into ATMs or POS terminals that detect foreign objects (skimmers) or anomalies in the card slot, preventing data theft. They work in conjunction with other technologies such as Jitter technology, EMV chips and anti-fraud systems to protect against fraud.

Purpose:

• Skimmer Detection: Detects physical devices installed on the card slot or keypad that read magnetic stripe or EMV chip data.
• Data Theft Prevention: Protects data used by carders to clone cards or conduct transactions without 3D-Secure (3DS).
• Threat Alerts: Alert banks or ATM operators of a potential compromise.
• Security Enhancement: Complements anti-fraud measures such as GeoIP, Device Fingerprinting and 3DS.

In the context of carding: Anti-skimming sensors make it difficult to collect data from cards (dumps), reducing the effectiveness of skimming to create cloned cards or conduct online transactions.

2. How do anti-skimming sensors work?​

Anti-skimming sensors use a variety of technologies to detect skimmers by analyzing physical, electromagnetic, or behavioral anomalies in the card slot or ATM. Here are the main types of sensors and how they work:

a) Types of anti-skimming sensors​

1. Infrared (IR) sensors:
   • Principle: Emit infrared light and measure its reflection to detect foreign objects in the card slot.
   • How they work:
     • The IR sensor scans the slot, detecting the shape and material of objects.
     • Skimmers (usually plastic or metal) alter the reflection of light, which is recorded as an anomaly.
   • Example: A skimmer installed on an ATM slot blocks or distorts the IR signal, triggering an alarm.
2. Magnetic sensors:
   • Principle: Detect magnetic anomalies caused by the skimmer's magnetic head which reads the strip data (F2F encoding).
   • How they work:
     • Measure the magnetic field in the slot (normal level: 2750 oersted for HiCo strips).
     • Skimmers create an additional magnetic field, which is recorded as a deviation.
   • Example: A magnetic skimmer in a slot causes a 10-20% change in the field, which triggers an alarm.
3. Electromagnetic sensors (for NFC):
   • Principle: Detects unauthorized NFC devices attempting to read EMV chip data (at 13.56 MHz, ISO/IEC 14443).
   • How they work:
     • Monitor the radio frequency spectrum near the slot or NFC reader.
     • NFC skimmers (eg Proxmark3) create abnormal signals that are recorded.
   • Example: An NFC skimmer installed near an ATM generates a signal that the sensor classifies as a threat.
4. Mechanical sensors:
   • Principle: Detects physical interference with the slot or keypad (e.g. PIN interception pads).
   • How they work:
     • Microswitches or pressure sensors are used to detect changes in the slot design.
     • Skimmers or overlays change physical parameters, causing alarm.
   • Example: The skimmer pad on the slot increases the thickness by 1–2 mm, which is recorded by the sensor.
5. Acoustic sensors:
   • Principle: Analyze sound waves in the slot to detect foreign objects.
   • How they work:
     • They emit ultrasound and measure its reflection.
     • Skimmers change the acoustic profile, which is recorded as an anomaly.
   • Example: A skimmer in a slot changes the ultrasound echo, causing an alarm.

b) Technical components​

• Hardware:
  • IR sensors: Infrared diodes and photodetectors (e.g. in the Diebold Nixdorf Anti-Skimming Module).
  • Magnetic sensors: Coils or Hall sensors for measuring magnetic fields.
  • NFC Detectors: RF Antennas for Spectrum Analysis 13.56 MHz.
  • Mechanical sensors: Microswitches or strain gauges for pressure detection.
  • Controller: Microprocessor (e.g. ARM Cortex-M) for signal processing and alarm management.
• Software:
  • ATM firmware (e.g. NCR APTRA, Wincor Nixdorf ProBase) analyzes sensor data.
  • Algorithms identify anomalies (e.g. threshold for magnetic field: >10% deviation).
  • Example: Firmware detects an IR anomaly and sends a signal to the monitoring center.
• Power consumption:
  • The sensors consume 0.5–3 W, integrating into the ATM system without significant costs.

c) Work process​

1. Initialization:
   • When the ATM is turned on, the sensors are calibrated to determine the normal state of the slot (e.g. magnetic field, IR reflection).
2. Monitoring:
   • The sensors continuously scan the card slot or NFC zone.
   • Example: IR sensor checks reflection every 100 ms, magnetic sensor every 50 ms.
3. Anomaly detection:
   • The skimmer changes the parameters (for example, the magnetic field increases by 15%).
   • The controller detects the deviation and classifies it as a threat.
4. Reaction:
   • Alarm: The ATM sends a notification to the monitoring center (e.g. via SNMP protocol).
   • Lock: The slot is locked, preventing cards from being inserted.
   • Shutdown: The ATM goes into maintenance mode until it is checked by a technician.
   • Logging: Anomaly data is stored for analysis.
5. Notification:
   • The bank or ATM operator receives a signal (SMS, email, via the monitoring system).
   • Example: NCR SelfServ ATM detects a skimmer and sends an alert: Alert: Skimmer detected, ATM ID: 12345, Slot anomaly: IR reflection.

d) Integration with other systems​

• Jitter technology:
  • Anti-skimming sensors work in conjunction with Jitter, which creates vibrations or electromagnetic interference, enhancing protection.
  • Example: The sensor detects the skimmer, but the Jitter disrupts its operation.
• Antifraud systems:
  • Skimming data is transmitted to anti-fraud systems (Stripe Radar, Adyen) for transaction analysis.
  • Example: A card used at a compromised ATM is flagged as suspicious.
• Network Monitoring:
  • Banks use platforms (VisaNet, MasterCard SAFE) to track transactions from suspicious ATMs.
  • Example: A high rate of ATM failures (50 per hour) indicates a skimmer.

3. Efficiency of anti-skimming sensors​

a) Against physical skimmers​

• Magnetic stripe:
  • Sensors (IR, magnetic) detect skimmers that read Track 1/Track 2 (for example, 1234567890123456=2505101100).
  • Example: The IR sensor detects a plastic skimmer, blocking the slot until it is checked.
• EMV chip (contact):
  • Mechanical and IR sensors detect skimmers in the slot, preventing the reading of APDU commands (ISO/IEC 7816).
  • Example: A skimmer in a slot triggers an alarm due to a change in pressure.
• EMV chip (NFC):
  • Electromagnetic sensors detect NFC skimmers (eg Proxmark3) by blocking their signals.
  • Example: The NFC sensor detects an unauthorized signal at 13.56 MHz and disables the NFC reader.

b) Complementing other technologies​

• Jitter technology:
  • Sensors detect skimmers and Jitter disrupts their operation by creating vibrations or interference.
• EMV chips:
  • Dynamic cryptography (ARQC) makes chip cloning impossible.
• 3D-Secure:
  • Requires OTP, which is not available to carders even if the data is read.
• Antifraud systems:
  • GeoIP, Device Fingerprinting and behavioral analysis block skimmed data.
  • Example: Stripe Radar detects VPN (IP 104.28.12.45, NordVPN) and initiates 3DS.

4. Practical examples​

• Scenario 1: ATM Skimmer:
  • The carder installs a magnetic skimmer on the ATM for a Non-VBV card.
  • The IR sensor detects a foreign object, the ATM blocks the slot and sends an alarm.
  • Result: Data is not read, the carder does not receive PAN or CVV.
• Scenario 2: NFC skimmer:
  • The carder uses Proxmark3 to read EMV chip (Auto-VBV bin) via NFC.
  • The electromagnetic sensor detects an abnormal signal at 13.56 MHz and disables the NFC reader.
  • Result: Chip data cannot be read, card is protected.
• Scenario 3: Cloned card online:
  • The carder bypasses the sensors (for example, by compromising an old ATM) and obtains Non-MCSC card data.
  • Tries to use online data, but Radar detects suspicious IP (GeoIP: Nigeria) and requires OTP.
  • Result: Transaction is declined, card is blocked.

5. Limitations of anti-skimming sensors​

• Obsolete ATMs:
  • Not all ATMs are equipped with sensors (especially in developing countries).
  • Example: An old ATM without sensors allows a skimmer to read the data.
• Complex skimmers:
  • Modern skimmers (such as thin "deep insert" skimmers) may be less visible to IR or mechanical sensors.
  • Solution: Combination with Jitter and transaction monitoring.
• NFC skimmers outside the ATM:
  • The sensors only protect the slot or NFC zone of the ATM, but do not prevent swiping in a crowd.
  • Solution: Banks use biometrics and 3DS.
• Delayed response:
  • The alarm can be sent with a delay, allowing the skimmer to collect data before being blocked.
  • Solution: Regular checks of ATMs by technicians.

6. Integration with other security measures​

• Jitter technology:
  • Sensors detect skimmers, and Jitter disrupts their operation with vibrations or interference.
• EMV chips:
  • Dynamic cryptography (ARQC) makes chip cloning impossible.
• 3D-Secure:
  • Requires OTP or biometrics, blocking the use of skimmed data.
• Antifraud systems:
  • GeoIP, Device Fingerprinting and Behavioral Analysis detect skimmed cards.
• Monitoring:
  • Banks monitor ATM transactions, identifying skimmers based on anomalies (e.g. 50 refusals in an hour).
• Blacklists:
  • Skimmed cards are added to the Visa TC40, MasterCard SAFE databases.

7. Conclusion​

Anti-skimming sensors (IR, magnetic, electromagnetic, mechanical, acoustic) work by detecting foreign devices or anomalies in the card slot or NFC zone of the ATM. They effectively prevent theft of magnetic stripe or EMV chip data, protecting cards from skimming. In conjunction with Jitter technology, EMV chips, 3D-Secure and anti-fraud systems (Stripe Radar, GeoIP), sensors significantly reduce the effectiveness of carding, making data collection expensive and risky. Limitations (outdated ATMs, complex skimmers) are compensated by monitoring and blacklists, providing a high level of protection.

If you want to delve into other aspects, such as how banks use HSM to protect data or how to set up rules in Stripe Radar to combat skimming, let me know!