January 15, 2010

Pictured below is what’s known as a skimmer, or a device made to be affixed to the mouth of an ATM and secretly swipe credit and debit card information when bank customers slip their cards into the machines to pull out money. Skimmers have been around for years, of course, but thieves are constantly improving them, and the device pictured below is a perfect example of that evolution.

This particular skimmer was found Dec. 6, 2009, attached to the front of a Citibank ATM in Woodland Hills, Calif. Would you have been able to spot this?

This is a fairly professional job: Notice how the bulk of the electronics fit into the flap below the card acceptance slot. Also, check out the tiny pinhole camera (pictured below), ostensibly designed to switch on and record the victim’s movements as he or she enters their PIN at the ATM.

It’s hard to know whether this was a homemade skimmer, or one that was purchased from online criminal forums. Some of the skimmers sold on these forums are extremely sophisticated, incorporating features such the ability to send an SMS text message to the thieves’ mobile phone whenever a new card is swiped.

This type of fraud is actually far more common that you might think: A quick query on Twitter for “ATM skimmer” usually brings up plenty of local news reports about these devices being found on ATMs.

Practice basic ATM street smarts and you should have little to fear from these skimmers: If you see something that doesn’t look right — such as a odd protrusion or off-color component on an ATM — consider going to another machine. Also, stay away from ATMs that are not located in publicly visible and well-lit areas.

Update, 12:10 p.m: Mikko Hypponen from F-Secure sent in a few fascinating Twitter pics of other ATM skimmers that include ingenious ways to send the stolen credentials to the scammers.

If you liked this post, please check out my follow-up posts on ATM skimmers:,

ATM Skimmers Part II, includes an entire gallery of ATM skimmer images.

Would You Have Spotted This ATM Fraud? Delves into some of the rent-to-own skimmer models.

Fun With ATM Skimmers, Part III Examining the skimmer problem in Europe (+ more skimmer photos!).

ATM Skimmers: Separating Cruft from Craft Skimmer scammers are everywhere! Only buy your skimmer devices from real thieves!

Sophisticated ATM Skimmer Transmits Stolen Data Via Text Message Skimmers with embedded cell phones allow thieves to continue stealing credentials without ever returning to the scene of the crime.

Skimmers Siphoning Card Data at the Pump Skimmers aren’t just for ATMs.


257 thoughts on “Would You Have Spotted the Fraud?

  1. Pingback: Those Body Scanners… (and Other Security Stuff) « Pond'rings

  2. Pingback: Personal Financial Security – Skimmers « Underwriting Solutions LLC

  3. Pingback: ATM Card Skimmers Are Getting Frighteningly Sophisticated [Scams] | Peer Marketing Group

  4. Pingback: The Friday Shirk Report - January 29, 2010 | Volume 42 | TwistedSifter

  5. Pingback: Card Skimmers | D90 Tools & Techniques

  6. Pingback: ATM Security « The Flabbercast

  7. Pingback: » VIDÉO:Les pièges dernier cri des distributeurs automatiques de billet

  8. Pingback: ATM Skimmers, Part II — Krebs on Security

  9. Pingback: The next time you use an ATM,-- The Eagles’ Nest

  10. Frank

    Wow, didn’t know that these things got so invisible. Before reading this, I knew these devices existed and felt comfortable that I would recognise one. From now on I’ll use to hands to enter my pin code : one to enter the Pin and one to provide additional shield.

  11. Nessah

    Without any problem i should put my card in that reader. I think my money is not safe anymore.

  12. Qer

    Wow..amazing, i like this article. may be can be implemented in my country . hahaha

  13. Pingback: Credit Card Skimmer - Would You Have Spotted This?

  14. chojrak

    This is real problem. Why no-one discourage using ATMs if skimming devices are so popular? Cash is still ok, isn’t it?

  15. non ya business

    PERFECT example of why cash is so much better…. get out of the habit of using the cards, there NOTHING but trouble!!!

  16. John Public

    ya know two or three motorized metal prongs slowly but very strongly poking out of the surface of the machine near the slot once before and once after your card is inserted would pop this off.

    1. Pete

      John, I think the bad guys can drill holes 😉 But I agree that the card slot could be physically secured or even be monitored by a camera in the top of the housing.

  17. lide

    I guess this will be the good excuse to get a chip in your body, which looks like it’s not too far down the road. 666 doesn’t sound too strange now.

    1. Jonathon

      Then won’t the bad guys kill just to get whatever part the chip’s implanted in?

  18. philip ort

    GREAT article!! Factual, clearly explained, timely, relevant & helpful. I’m sending it to my whole mailing list. Keep up the gd work

  19. Dibble

    In my last bank statement I found out that someone cleaned out my checking account. Thank God that I didn’t have but about $500 in there because of not having a job. Someone must have skimmed my card at my banks ATM because that is the only place I usually use it. I have gone over this in my mind over and over again and can not for the life of me know how this could have been done and now I see these sophistocated skimmers that these crooks use. It makes sense now. It only took the crooks abouts 3 days to clean out my $500 and they take money out twice a day so folks, if you have alot of money in your account beware that it doesn’t take long for them to clean you out. Like I said I didn’t know until I got my bank statement at the end of the month. I hope they catch these people!

  20. atmuser

    The ATMS I usually use begin transactions with a couple of screens touting various bank services. Maybe it would be possible for banks to create a screen that would show a picture of their ATM slot with a message that would say something like, “This is what our ATM should look like. If this one looks different do not use it and press [some button] to report it.” (I am assuming/hoping bank employees who service these machines inspect for tampering, but there might be several days between services.)

    1. Elizabeth Wood

      You know what I think I will pass this on to my credit union.
      Post it on the ATM machine. I will add to yours post what to the skimming device look like on the ATM nachines. Along with what it look like with out the skimming device on it.

      1. Elizabeth Wood

        I have mention to my credit union about leting people know of a skimming at ATMs. The respond was they have Cameras at each ATMs at all brach locations The main branch has all branch covered. The thing I want to get at is to educate the customers of being aware of skimming devices on these ATMs
        On youtube there are advertisement to sell skimmings devices to put on the ATMS. This is wrong. There should be a law against advertising devices for stealing money.

  21. Pingback: ATM Skimmers

  22. rubeN

    Some piece of shit skimmer drained my account for 500 bucks just recently. The vampire probably used a skimmer since the transaction showed up as an ATM withdraw.

    The thing is I didn’t know that these types of things existed and therefore wasn’t at all cautions when I would use an ATM. Now of course I know what these bastards do so I will be way more cautions.

    Banks need educate their customers that these things are out there looking to drain your bank account in a flash.

    1. Eileen

      Sorry this happened to you, it is scary to think this could happen.

      Yes, I agree that the banks should now be very alert. They should find a way to make their facility safe for their customers.

  23. Pingback: Under Attack! Threats to Deposit Accounts: an Interview with FICO Fraud Solutions — Payments Views from Glenbrook Partners

  24. Pingback: Instalación de un dispositivos para robar en cajeros « Mbpfernand0's Blog

  25. Pingback: ATM Skims – would you have figured them? « Roger Halbheer on Security

  26. Joe K.

    This is one reason I always enter my PIN (a) with my other hand over the hand that’s entering the data and (b) with several false keystrokes. Whether machine or camera, that should defeat most observers.

    1. Adam G.

      That wouldn’t have helped with a skimmer. It reads the data directly off your card. No amount of holding your hand over it is going to be able to bypass that.

      1. johnson

        dumbass hes talking about the pin. the pin isnt stored in the card.

        1. Eileen

          Why do you have to resort to name calling? I believe the devices can record keystrokes, thus making it possible for them to also record your PIN number.

          1. Not Joe K.

            Eileen, did you not take the time to read Joe K.’s comment? That is why people get frustrated.

          2. Eileen

            To Not Joe K-

            Yes, I did read it, I read the whole article. But who can say that the camera can’t read his keystrokes as he is holding his hand OVER the keypad? The cameras are designed to view from the side, and the criminals may be able to figure out his pin.

            But what really bothered me was Johnson’s ATTITUDE, his verbal abuse, and his need to degrade someone else. I just don’t think that is necessary, there is enough trouble with people getting their money stolen.

            We are discussing a real problem here and I don’t see any reason for potential victims, to FIGHT among each other, do you? That is not helpful, it is counter-productive in my opinion.

            If someone does not understand what is happening here with the ATM machines, why not correct their thinking in an appropriate kind way, instead of slamming them with verbal abuse. This ATM threat is, I think, new to most people and so we may not understand exactly how this is happening.

            I’m just sayin’.

Comments are closed.