Pictured below is what’s known as a skimmer, or a device made to be affixed to the mouth of an ATM and secretly swipe credit and debit card information when bank customers slip their cards into the machines to pull out money. Skimmers have been around for years, of course, but thieves are constantly improving them, and the device pictured below is a perfect example of that evolution.
This particular skimmer was found Dec. 6, 2009, attached to the front of a Citibank ATM in Woodland Hills, Calif. Would you have been able to spot this?
This is a fairly professional job: Notice how the bulk of the electronics fit into the flap below the card acceptance slot. Also, check out the tiny pinhole camera (pictured below), ostensibly designed to switch on and record the victim’s movements as he or she enters their PIN at the ATM.
It’s hard to know whether this was a homemade skimmer, or one that was purchased from online criminal forums. Some of the skimmers sold on these forums are extremely sophisticated, incorporating features such the ability to send an SMS text message to the thieves’ mobile phone whenever a new card is swiped.
This type of fraud is actually far more common that you might think: A quick query on Twitter for “ATM skimmer” usually brings up plenty of local news reports about these devices being found on ATMs.
Practice basic ATM street smarts and you should have little to fear from these skimmers: If you see something that doesn’t look right — such as a odd protrusion or off-color component on an ATM — consider going to another machine. Also, stay away from ATMs that are not located in publicly visible and well-lit areas.
Update, 12:10 p.m: Mikko Hypponen from F-Secure sent in a few fascinating Twitter pics of other ATM skimmers that include ingenious ways to send the stolen credentials to the scammers.
If you liked this post, please check out my follow-up posts on ATM skimmers:,
ATM Skimmers Part II, includes an entire gallery of ATM skimmer images.
Would You Have Spotted This ATM Fraud? Delves into some of the rent-to-own skimmer models.
Fun With ATM Skimmers, Part III Examining the skimmer problem in Europe (+ more skimmer photos!).
ATM Skimmers: Separating Cruft from Craft Skimmer scammers are everywhere! Only buy your skimmer devices from real thieves!
Sophisticated ATM Skimmer Transmits Stolen Data Via Text Message Skimmers with embedded cell phones allow thieves to continue stealing credentials without ever returning to the scene of the crime.
Skimmers Siphoning Card Data at the Pump Skimmers aren’t just for ATMs.
Holy crap that is pretty amazing. I kinda want one! LOL
This is the standard that most ATMs in France have settled on as well, and yet twice in the past two months I have seen someone take their card as soon as it comes out and immediately walk away, leaving their money that’s dispensed a few seconds later. Lucky for them that I’m an honest person 🙂
ATM Machine is redundant….try again!
Yeah I’d like to think they’d catch em with cameras.
Biometrics will solve this problem. You cannot skim a fingerprint and reuse it the way credit card or debit card information is used.
People may be able to skim and develop some sort of format to reuse them in the future but I have been researching biomentric devices that do not read fingerprints as an image file.
Why do you think you can’t skim a fingerprint? After all, biometric readings need to be converted to digital information, and that digital information is what’s checked to see if it’s correct or not.
Step 1: Intercept and record the digitized fingerprint info.
Step 2: Re-submit the digitized fingerprint info later.
Step 3: Profit! (Ill-gotten, of course.)
I admit that it requires a bit more work than just snarfing a magstripe, but biometrics aren’t quite as bulletproof as many would like to suggest.
two problems with fingerprints:
1. you _can_ “copy” a fingerprint, see http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en
2. unlike an atm card, you cannot replace it when it has been compromized
Fingerprints are so pwnd!
http://www.youtube.com/watch?v=MAfAVGES-Yc;hd=1 😀
Great information. Thanks for educating me. I have never heard of this. I would like to repost this on StrongMothers.com
Lisa
I work at major bank in Toronto – one of the busiest. On one day in December we changed 80 cards for clients that used ‘compromised’ bank machines. Some were victims of theft, some did not have the cards dublicated YET.
We found in our branch three different skimmers within three weeks. I stood by watching one for hours waiting for someone to come back and pick it up (with a closed sign on).
They can be wireless so the skim-artists don’t have to pick them up at the end of the day. The busier the branch the more cards they can skim. The cover on the top of the keypad made it easier to hide the camera, so we removed it.
This isn’t made public by any of the Big Banks here – probably because it’s so easy to do, it would start a goldrush.
ps- i used to work at a different bank four months ago and hadn’t used my card in the last three months. Two weeks ago i logged into my webaccount and noticed someone stole my $500 limit from a bank machine i’ve never used….
the criminals will sit with the card data for months at a time to evade a connection to the source. consider a gas station attendent working for three months collecting cards. quit one day and for 24 hours print new cards with THREE MONTHS OF DATA. then have five people driving to machines withdrawling daily limits for the next week. the only problem is where to launder all the easy money
anyone know if the new chip cards are affected by this, in Canada the chip cards are pretty common by now.
Yes the chip cards as well.
be aware these are not the only skimmers, use caution at gas pumps, restaurants, supermarkets in short thieves are so elaborate a skimmer can be hidden in any point of sale machine, they can copy the front of the ATM and over lay it on top of ATM including buttons and even brochures, depending on ingenuity could hide camera. thieves then use computer to copy or clone you’re card, go to ATM before nidnight take out max amount, wait for midnight a new day and withdraw again they will clean you out. or sell all the info online, i found a persons identity for sale at $5
search videos key word skimmer
Brian, great article and pictures, also the update from the twitter. It would be great if we can try to identify one. Recently, our country was faxed by a large scheme of ATM fraud. People are talking more about Cards with intelligent chip attached, to avoid fraud.
Do you have any opinion on this? If yes, please share… 🙂
PS: Would definitely visit this site more often… 🙂
Thanks in advance…
Someone cast that plastic case and did the engineering and assembly of that that skimmer. I suggest a law by which manufacture or importation or possession of a skimming device, or the act of attaching one to an ATM, or using one to capture information necessary to make a fake card all should be made a felony. Brian and commenters, what do you think?
USING one to commit fraud is already fraud, so no new law is needed.
POSSESSING one should not be illegal, because the device itself is valuable for academic study by the people fighting against this kind of crime. Erecting legal barriers which only impede the law-abiding is wrong-headed.
Remember, it’s the act, not the tool, that is the crime.
That’s just backwards and moronic thinking. If the vast majority of the use of these items is illegitimate, with legitimate use such as study being in the minority, then make the possession and manufacture illegal and allow exceptiosn by permit for the legitimate users. If you let this go uncontrolled, they will be easy to obtain and use with no repurcussions for those who manufacture and supply these tools of theft.
What are you suggesting this law would do? How would it be enforced? Laws without enforcement only stop honest people from doing things. (To Rick’s point, researchers)
If you’re caught installing one of these, or removing one, you will be prosecuted. If you are randomly stopped and have one in your possession, you may not, but how often do you think that happens?
To those suggesting that law enforcement should prosecute sellers of criminal devices consider (even if you disagree with Rick’s point above that commission and not possession of tools is the crime) the exponential cost (many of the perpetrators are overseas; arrest one and there will always be others to fill he void; internet transactions are expensive to track/trace) to law enforcement. This problem is (not yet) widespread enough to justify that kind of expense and I, for one, would not want my tax dollars spent so frivolously.
YIKES TOO
Why use ATMs, I’m in Europe but why use ATMs when the stores take cards?
As long as you give the ATM your card it doesn’t matter if you have a chip or not since it is possible to read the strip anyhow.
Leave checks and ATMs use cards in the shop.
If you’re buying petrol after hours you have to use your card, you can’t go into the store. If you want to withdraw cash after hours, same thing. You may not be able to avoid using the cards altogether.
There are numerous cases of readers in stores being compromised as well — plus in stores, it’s much easier for them to capture your PIN as well, since the version used in stores replaces the whole keypad as well as card reader.
The number of comments which have been left about ‘finding one in the wild’ bring out one question.
How easy are these to pull off? One guy mentioned taking 10 minutes to see if he could pull off the card reader. Are they easy to pull off, or does it take a bit of effort? If I pull on one and it doesn’t come off with a good tug, does that mean it’s safe?
Why bother with a skimmer? Buy one of those “independent” ATMs (like the kind you find in gas stations or Quikie Marts), and collect all the card data and PINs you want. All it will cost you is $100 (max) per card swipe.
Ahahahahahahahahaha! Good one.
Is it the reason that in Europe, they are using smart chip, so the reader is authenticated by the card before any operation can be done… So illegale reader means that the card will refuse to work…
my question is, why the customers of a bank (card users) have to live in fear and suspicion, why cant the banks themselves keep an eye on their ATM machines, or have they a financial gain or stake in these skimmers?
Every bank got a camera on every ATM to keep an eye on the customers, dont they spot somebody who is mounting a skimmer on their machine?
Soon it will be safer to keep your cash under your matress and get a shotgun.
Unfortunately, the camera on an ATM will only work when a card is put in the slot. To have them work on a motion sensor or something would require more expenditure on the security system. Bear in mind, the security system on an ATM is NOT there to protect you. It’s there to protect the bank. Protecting yourself is up to you.
Several years ago charges started showing up on my credit card from Russia. We had recently returned from a trip to France where we used ATM’s a lot. Never did know how the Russian criminal got our card number and pin info. I think this probably explains it. As an example, I was charged for plane tickets from Moscow to Minsk, two places I’ve never been.
Sell all models of atm skimmer 1400 euro
for contact me email me here : deal.make@yahoo.com
Wow, didn’t know that these things got so invisible. Before reading this, I knew these devices existed and felt comfortable that I would recognise one. From now on I’ll use to hands to enter my pin code : one to enter the Pin and one to provide additional shield.
Without any problem i should put my card in that reader. I think my money is not safe anymore.
Wow..amazing, i like this article. may be can be implemented in my country . hahaha
This is real problem. Why no-one discourage using ATMs if skimming devices are so popular? Cash is still ok, isn’t it?
PERFECT example of why cash is so much better…. get out of the habit of using the cards, there NOTHING but trouble!!!
ya know two or three motorized metal prongs slowly but very strongly poking out of the surface of the machine near the slot once before and once after your card is inserted would pop this off.
John, I think the bad guys can drill holes 😉 But I agree that the card slot could be physically secured or even be monitored by a camera in the top of the housing.
I guess this will be the good excuse to get a chip in your body, which looks like it’s not too far down the road. 666 doesn’t sound too strange now.
Then won’t the bad guys kill just to get whatever part the chip’s implanted in?
GREAT article!! Factual, clearly explained, timely, relevant & helpful. I’m sending it to my whole mailing list. Keep up the gd work
That’s why I never use an ATM.
Your girl Mary 🙂
In my last bank statement I found out that someone cleaned out my checking account. Thank God that I didn’t have but about $500 in there because of not having a job. Someone must have skimmed my card at my banks ATM because that is the only place I usually use it. I have gone over this in my mind over and over again and can not for the life of me know how this could have been done and now I see these sophistocated skimmers that these crooks use. It makes sense now. It only took the crooks abouts 3 days to clean out my $500 and they take money out twice a day so folks, if you have alot of money in your account beware that it doesn’t take long for them to clean you out. Like I said I didn’t know until I got my bank statement at the end of the month. I hope they catch these people!