ATM & POS Skimming
The Secret Service responds to hundreds of physical skimming incidents every year throughout the U.S. These skimming incidents investigated by the Secret Service account for more than $115 million in loss to victims and over 350 arrests between 2020 and 2021.
To perpetrate this crime, criminal groups will deploy skimming devices that surreptitiously record victim cardholder information at ATMs and Point-of-sale terminals at merchants such as pharmacies and grocery stores. This stolen card data is then typically either re-encoded on blank cards for the purposes of unauthorized ATM withdrawals, utilized for unauthorized purchases of high-value goods, or the data is sold to other criminal elements.
ATM Skimming Devices
ATM skimming devices are typically inserted deep inside the card read slot of ATMS and are usually impossible to detect from the ATM’s exterior. These devices can be designed to capture both the data on your magnetic stripe and your card’s EMV chip.
While ATM companies are constantly developing security features to combat skimmers, criminals are always adapting to these security features and adapting their methods to deploy ATM skimming devices.
To limit your risk of becoming an ATM skimming victim as much as possible, considering taking the following steps:
Utilize ATMs inside of financial institutions, interior bays with security cameras, or closest to the drive-up window. These ATMs are harder target for criminals.
Look for obvious signed of tampering at the ATM such as inoperable/broken lights, raised PIN pads with loose edges, loose components or stickers placed in unusual locations.
Always shield your PIN entry with another hand as much as possible to prevent your PIN from being recorded by a “pin-hole” camera.
POS Skimming Devices
POS skimming devices are typically overlays that cover either the entire top exterior of the POS terminal, or just the keypad and EMV reader slot. These skimming devices can be difficult to detect because criminals will design plastic overlay shells that look identical to the top of the POS terminal and fit securely on the terminal. These skimming devices can be designed to capture both the data on your magnetic stipe and your card’s EMV chip. POS overlay skimming devise will also capture all keypad entries, including your PIN, if a debit card is used.
To limit your risk of becoming a POS skimming victim as much as possible, consider taking the following steps:
Inspect the exterior plastic edges of the POS terminal and keypad for obvious signs of tampering. You can gently pull up on the corners of the terminal or the keypad’s privacy shroud. If any part of the terminal appears or feels loose, do not use this terminal and immediately bring it to the attention of the merchant.
Some merchants will use seals on the sides of the POS terminals instead of a debit card to avoid potentially compromising your PIN and giving criminals access to your checking account.
If possible, consider using a credit card at POS terminals instead of a debit card to avoid potentially compromising your PIN and giving criminals access to your checking account.
Mitigation and Prevention For Business Using POS Terminals:
Immediately take the POS terminal (or ATM) out of service to prevent data compromise, make notification to your company’s corporate security or loss prevention department, contact your local law enforcement agency, who can retrieve the skimming device and appropriately handle the device as evidence.
Mitigation and Prevention For Individual Card Holders:
Immediately contact the card issuer’s fraud department to report the incident, ask the card to be deactivated, and ask that a new card be issues with a new PIN. Monitor the affected account closely. If you suffered a financial loss as a result of skimming incident, consider filling a fraud affidavit with the card issuer and contacting your local law enforcement agency to report the incident. In the future, consider making purchases using cards with can transact through contactless payment (i.e., tap-to-pay) or with the card’s EMV chip, instead of the magnetic strip.