Personal security: ATM skimming

[Purplehood]

Every instance where my card started getting hit with fraudulent charges was immediately after using a Debit-card at Pay-pump at an unfamiliar gas station.

I have instituted two measures that seem to work so far:

- Use credit button on the button instead of debit
- Have my banks send me "Alerts" by text and e-mail for every transaction (credit/deposit, transfer, deduction and ATM) over $1.00.

I get alot of e-mail and texts, but I get to review my expenditures on a daily basis when they are fresh in my mind.

[seamusTX]

I suspect it was a credit card skimmer device because I only use the card at 3 places normally, and that station I had never been to before.

That makes sense.

The credit-card company should figure out a pattern if that is going on—which they don't seem to for small-scale fraud. Apparently it's too difficult to pursue fraud cases in third-world countries (no insult intended to Singapore, but their legal system is fairly opaque).

The only other possibility is that your CC information was hacked out of some other vendor's database. That has happened.

- Jim

[MasterOfNone]

Every instance where my card started getting hit with fraudulent charges was immediately after using a Debit-card at Pay-pump at an unfamiliar gas station.

I have instituted two measures that seem to work so far:

- Use credit button on the button instead of debit
- Have my banks send me "Alerts" by text and e-mail for every transaction (credit/deposit, transfer, deduction and ATM) over $1.00.

I get alot of e-mail and texts, but I get to review my expenditures on a daily basis when they are fresh in my mind.

One thing you may want to consider. I NEVER use a debit card. I use a credit card and pay it each month instead. If a credit card is compromised, you report it and are not harmed. But if your debit card is compromised, your money is gone until it gets resolved.

[chasfm11]

Every instance where my card started getting hit with fraudulent charges was immediately after using a Debit-card at Pay-pump at an unfamiliar gas station.

I have instituted two measures that seem to work so far:

- Use credit button on the button instead of debit
- Have my banks send me "Alerts" by text and e-mail for every transaction (credit/deposit, transfer, deduction and ATM) over $1.00.

I get alot of e-mail and texts, but I get to review my expenditures on a daily basis when they are fresh in my mind.

One thing you may want to consider. I NEVER use a debit card. I use a credit card and pay it each month instead. If a credit card is compromised, you report it and are not harmed. But if your debit card is compromised, your money is gone until it gets resolved.

[OldCurlyWolf]

Sometimes the nice waiter/waitress will scan your card when he/she takes your card back to run the tab.

As a server, I resent that!
In most restaurants, the payment terminals are within sight of customers and leave little opportunity for a server to do something like this. Also, I think the incidence of servers doing something like this is very low; we're more likely to write in a bigger tip after you leave, assuming you don't take the receipt or copy of your credit card slip with you. I never have, but I've heard of others who have done it. Always take your copy and check it against your statement!

Most are honest, but it does happen.
BTW, to increase the tip can be construed as CC fraud, a felony, instead of simple misdemeanor theft.

BTW II, I never leave a tip on a CC. Always cash. and I scratch through the tip area and total the ticket at the bottom. If I don't know you I am not give going to you a chance to be a thief.

[VMI77]

I wonder who is manufacturing these devices. They are not garage projects.

http://www.dealextreme.com/products.dx/ ... c%20stripe" onclick="window.open(this.href);return false;

$18 and up, with free shipping.

Those are just readers.....the skimmers depicted in the previous link are designed to fit over the existing ATM reader and not be obvious.

[VMI77]

Other than the tips given, how does a complete innocent/novice protect oneself from this stuff?

These devices are usually put on outdoor or unattended ATMs. Using ATMs in bank lobbies should avoid them for the most part.

You can also take a close look at an ATM and recognize the characteristics. The card reader is usually flush with the front panel. If you see a kludgy-looking card reader like the ones in the photos that ELB linked to, pass it by and maybe call the bank.

Also check your bank statements as soon as you get them. I found a credit-card fraud to the tune of about $5,000 that was never explained.

- Jim

The article links to this pic of a skimmer set up --I don't think most people would detect it: http://twitpic.com/4pko1

The individual components are depicted on the links from this page: http://twitter.com/mikkohypponen/status/1725581579

Also, check these out, they're pretty sophisticated, I doubt I'd be able to tell unless I was very familiar with the particular machines: http://krebsonsecurity.com/2010/02/atm- ... s-part-ii/

[VMI77]

And watch out for these at gas pumps ---this article says some are installed inside the pump and not detectable from the outside: http://krebsonsecurity.com/2010/07/skim ... -the-pump/

[seamusTX]

Also, check these out, they're pretty sophisticated, I doubt I'd be able to tell unless I was very familiar with the particular machines: http://krebsonsecurity.com/2010/02/atm- ... s-part-ii/

Those are scary. I also probably would not notice, especially if I was using a machine in an unfamiliar location and in a hurry (which I admit I sometimes do).

This stuff has to be done by organized criminal gangs. As I said above, they are not garage projects.

- Jim

[LikesShinyThings]

As for the server/tip problem, I always mark that myself and I take a copy of my receipt. I manually match every transaction on my statement to the amount that I entered into Quicken. I've caught all kinds of problems, mistakes and otherwise, by doing that. Sometimes, the errors are my own data entry errors. Some of the others have been just bizarre and would have passed unnoticed if I hadn't made the statement balance work with my own balance.

Good to know I'm not alone. I love Quicken, being able to track where we've spent our money, etc, etc. Bonus is being able to catch immediately when something hinky goes down on the credit card - doesn't happen often, but man is it helpful when calling the credit card company.

[baldeagle]

Every instance where my card started getting hit with fraudulent charges was immediately after using a Debit-card at Pay-pump at an unfamiliar gas station.

I have instituted two measures that seem to work so far:

- Use credit button on the button instead of debit
- Have my banks send me "Alerts" by text and e-mail for every transaction (credit/deposit, transfer, deduction and ATM) over $1.00.

I get alot of e-mail and texts, but I get to review my expenditures on a daily basis when they are fresh in my mind.

One thing you may want to consider. I NEVER use a debit card. I use a credit card and pay it each month instead. If a credit card is compromised, you report it and are not harmed. But if your debit card is compromised, your money is gone until it gets resolved.

That's not been my experience. A few years ago I used my debit card to purchase gas while traveling to North Carolina. Five minutes after I purchased gas at a Pilot someone charged $5 and then $1000 to my debit card at a truck stop in El Paso. The Visa fraud department called me shortly afterward to ask if the charges were legitimate. I told them no and pointed out that the debit pattern clearly showed me traveling from Texas eastward, and that my last purchase was at the Pilot. Clearly the El Paso charges were fraudulent. The $5 charge was a test to see if the card worked, followed by the $1000 charge. The fraud rep agreed and the money was never withdrawn from my bank account.

I think Purplehood is correct about using the credit button. Some scanners will detect that your card is a debit card and prompt you for the PIN. All you have to do is hit cancel or no (depending upon the device), and then it will accept the transaction as a credit charge. Most pumps will now also prompt you for your zip code once it becomes a credit transaction.

His alert idea is a bit of paranoid overkill, in my opinion. If you really want to be notified daily, just login to your bank account and look at the transactions. For most people that would be preferable to filling up your email inbox with alerts.

[KD5NRH]

His alert idea is a bit of paranoid overkill, in my opinion. If you really want to be notified daily, just login to your bank account and look at the transactions. For most people that would be preferable to filling up your email inbox with alerts.

The only card I have that offers those alerts is one I don't use that often, and I have my alerts set to $50. That nets me about one text every other week, which is also a nice reminder to make sure I get those entered in the accounting software.

In fact, with the right email client, (Pegasus, maybe?) I would think you could set up an extra GMail account just to get those alerts, pull the amount and location from the message, and call a script to enter it directly into your accounting software within seconds after the purchase.

[Purplehood]

The credit vs. debit thing at the pumps has worked since I began to practice it.

My banks have been very helpful on the debit entries that I reported as fraudulent. In fact, they immediately freed up those monies and advised me that if they found the charges not to be fraudulent, they would recoup them. I haven't had any problems.

On the issue of overkill with the notices from the banks...I can live with it. After all, I asked for it and it seems to fulfill its purpose and makes me monitor my spending habits.

[C-dub]

After reading that it makes me want to go back to a cash-only transaction basis, but that would mean visiting tellers more often.

Other than the tips given, how does a complete innocent/novice protect oneself from this stuff?

I have also been considering this and more and more may go back to this method anyway. With the reduction in the amount a card company can change for each transaction they are already discussing ways to recover that lost income. Fees for just having a debit card might return. Cash is looking good again. I can't even remember the last time I was actually inside a bank, but I guess I could just go through the drive through and withdraw what I would need each week.

[chasfm11]

After reading that it makes me want to go back to a cash-only transaction basis, but that would mean visiting tellers more often.

Other than the tips given, how does a complete innocent/novice protect oneself from this stuff?

I have also been considering this and more and more may go back to this method anyway. With the reduction in the amount a card company can change for each transaction they are already discussing ways to recover that lost income. Fees for just having a debit card might return. Cash is looking good again. I can't even remember the last time I was actually inside a bank, but I guess I could just go through the drive through and withdraw what I would need each week.

Part of the problem with that is that some businesses no longer accept cash. The place that I buy gas does not. I also worry about making myself more of a target for someone who observes me paying the cash. Maybe that is just paranoid. I've personally noticed others who pay with cash and produce what appears to be large rolls from which to do it. If I can do that, so can others.

Personally, I'm willing to pay a reasonable fee to have a card which allows me to make purchases. I don't want to have to start searching around to find another ATM when the one at my regular bank malfunctions (as it seems to do from time to time.) When I consider extra trips to the bank to withdraw cash (which could also increase my value as a target) with the price of gas today, a credit card for purchases looks pretty good, even with the potential for fraudulent use and the hassle to fix that.