Meduza continues a series of joint materials with Tinkoff Bank. This time we are publishing a text from the Tinkoff magazine about skimming: about how scammers attach various devices to ATMs, read your PIN code, and then remove everything that can be taken from the card. It is unpleasant and dangerous, but skimming can be fought.
It happens like this: you find yourself in an unfamiliar place without money. You see an ATM in the alley. Withdraw cash. A few weeks later, you receive an SMS: someone in Cape Town is also withdrawing money from your card.
You call the bank, block the card, but the money has already been withdrawn. Whether they will be returned or not depends on the bank. You'll have to figure it out and waste time. You may have to call the Cape Town police.
This is called skimming: fraudsters steal card data, then make a duplicate and cash out. The danger lies right here:
To steal the contents of a card, fraudsters need to copy two things: the magnetic stripe on the card and the PIN code. To do this, they have three devices in their arsenal.
Skimmer. This is a homemade magnetic tape reader. Fraudsters attach it to the ATM card reader. Sometimes the skimmer is camouflaged so well that even a bank employee cannot recognize it.
Hidden cameras. Fraudsters attach them to the ATM or hide them somewhere nearby. A miniature camera is pointed at the ATM keypad and records customers entering their PIN. It’s not easy to distinguish the camera, because the bank’s security service also installs them.
Overhead keyboard. Fraudsters install a fake keyboard on top of the original one on an ATM. The fake one remembers everything you type and transfers your keystrokes to the real keys. The ATM responds to taps as usual, so the substitution is difficult to notice. Then the criminals take the tag, decipher the recording and find out the PIN code.
How to understand that an ATM is dangerous
Inspect the ATM before inserting your card. Look for suspicious signs.Overlays for the card reader. If a skimmer is installed on the ATM, the card first passes through a special reader and then enters a regular card reader. Look to see if there is a cover on the slot into which the card is inserted.
If the ATM has an anti-skimming pad (a translucent plastic piece), try swinging or rotating it. The real one will be firmly attached to the ATM. The fake one loosens, moves away and wobbles.
Usually, scammers install spy devices for several hours because they are afraid of inspections by inspectors. Therefore, they use simple fastening methods - tape, glue, honestly.
Often, scammers leave marks: cracks, adhesive smudges and chips. It's best not to use an ATM whose card slot looks like someone has poked around with a screwdriver or poured glue on it.
False panels and black dots. Fraudsters make fake panels, install video cameras in them, and then quietly attach them to the ATM: on the money dispenser, under the visor or under the screen. There are cases when the camera was hidden in a stand for advertising brochures of the same bank.
Feel free to examine the surface of the ATM. Touch the panels. Usually the fake ones don't hold up well. If something is loose, take a closer look at the part.
A bad signal is if you encounter a miniature depression on a flat surface, which from a distance looks like a black dot. Take a closer look: perhaps this is the peephole of a video camera.
Convex or different tone keyboard. Fraudsters do not always have the opportunity to paint counterfeit parts in the color of the ATM. The discrepancy in color and tone is easy to notice.
Most often, a false keyboard is glued with glue or double-sided tape. Therefore, when typing the keys, there is a slight play. The cover seems to “move away” from the ATM.
If the keyboard has a different texture, sticks out, or is wobbly, try prying it off with your fingernail. If the ATM is attacked by scammers, you will see a real keyboard under the cover.
If the ATM is old, with chips and worn panels, and the keyboard looks like new, this is also a bad sign. It does not happen that banks change the keyboard separately from the ATM body.
How to choose an ATM
You can never encounter skimmers if you follow a few rules.No: unfamiliar ATMs. Try to withdraw money from one ATM. It is ideal if you remember what it looks like (especially the keyboard and card reader).
No: street ATMs. There it is easier for scammers to install a reader or record on camera how you enter your PIN code.
No: ATMs are in dark places. Even if the ATM is indoors, lack of light is bad. You may not notice suspicious details. If you have no choice, turn on the flashlight on your phone and inspect the ATM.
Yes: anti-skimming pads. Banks are at war with card fraudsters. For example, they install anti-skimmers on ATMs - special protective linings that prevent the reader from being attached.
The irony is that at first anti-skimmers were very similar to skimmers themselves. People are confused, so today anti-skimmers are made of transparent plastic. This helps the client see: there are no scanners, wires or boards inside the card reader.
However, scammers have learned to disguise skimmers as anti-skimmers. The same recipe will help here - don’t be shy to move the card reader before inserting the card.
Yes: ATMs inside branches. They are better protected and checked more often by bank security services. In addition, there are always many ATMs in branches: covering each one with skimmers is too expensive for fraudsters. At the same time, criminals sometimes specifically attack departments, because people think that nothing threatens them there.
Yes: “wings” for the keyboard. Such ATMs make it difficult to install false keypads and almost completely eliminate the possibility of recording the PIN code entered by a hidden camera.
Wings, unfortunately, also do not always protect against linings
Yes: ATMs with jitter. Jitter is an overlay on the card reader that causes the card to vibrate when input. If the ATM is equipped with jitter, then fraudsters will most likely bypass it: the “jitter” will not allow them to correctly copy the magnetic tape on the card. Without this, the whole scheme becomes meaningless.
True, there are problems with jitter. Firstly, most ATMs don't have them. Secondly, you cannot understand that there is jitter on the ATM until you insert the card. But you can first test an unfamiliar ATM using a discount card. If it vibrates when you enter it, then the ATM is safe.
Testing an ATM is an unnecessary step, but it can save you a thousand rubles, five, or fifty. Remember: for card data to get to scammers, you only need to use an infected ATM once.
Be careful: ATM in an office or shopping center. It is more difficult for skimmers to get to them. But there are cases when fraudsters bribed security guards, and they directed internal surveillance cameras at the ATM. Then the video recordings were transferred to the scammers, and they spied on the PIN codes. Always cover the keyboard with your hand.
Be careful: there are locks at the entrance to the bank branch. Many banks have branches with magnetic locks. You can enter there using any card with a magnetic stripe. Sometimes scammers place skimmers directly on the lock. It’s easy to deal with this: go in with a discount card.
Sometimes scammers attach a keypad to an external lock to enter a PIN code. This is also simple: if you are required to enter something at the entrance, they are definitely scammers - and desperate ones at that. Banks will never ask you to enter your PIN when entering a branch.
Caution: tourist areas abroad. When we travel, we don't know what the ATMs of foreign banks look like, so it's easier to deceive us. Fraudsters take advantage of this. Be careful, especially in Asia: Asian skimming kung fu is second to none.
How to enter your PIN code correctly
Cover your hand with your free hand when entering your PIN. Sometimes criminals don’t install cameras or overhead keyboards, but simply hire people to watch you enter your PIN code.
How to protect your money.
Switch to a chip card. Having a chip will not protect you 100%. The chip is really difficult to copy. But the ATM reads it, and in Russia not all ATMs can do this. Fraudsters know where to find outdated ATMs and withdraw cash using a magnetic stripe. Chips reduce risk, but do not reduce it to zero.
Connect SMS banking. Connect SMS about all account transactions to quickly respond to sudden debits. This will not help if you cash out at night or if your phone is turned off.
Set limits. Limit cash withdrawals in online banking. Fraudsters will not be able to withdraw the entire amount at one time.
What to do if you come across a skimming ATM
1. Do not take away false parts, do not detach them and do not attract attention to yourself.2. If this happens during the day and inside the branch, find a bank employee and calmly tell him about your suspicions.
3. If this happens on the street or at night, take your things and move away from the ATM. You may be followed from a car or on foot - get away from the pursuit.
4. Make sure there is no tail. Then call the bank that owns the ATM and describe in vivid detail everything that happened to you.
5. If you notice the skimmer after inserting the card, leave it in the ATM. Call your bank and block it, but only later, when you are in a safe place.
(c) https://meduza.io/feature/2015/11/18/grabezh-cherez-bankomat
