They're waiting out there -- crooks and identity thieves, just waiting to skim your debit and credit card numbers. So they can skim thousands of dollars from your bank account.
Skimmers are small devices thieves install in or over credit-card readers that they use to capture the data stored in a card's magnetic stripe as the customer makes what is otherwise a legitimate credit or debit card transaction.
The information includes the credit card number and expiration date and the card holder's full name, according to financial literacy site The Balance (tinyurl.com/ydb2zwhe). The stolen information can then be used to make fraudulent charges either online or with a counterfeit card.
Skimmers show up most often on the card-swipe mechanisms on automatic teller machines and at gas stations, but they can be placed over almost any type of reader. Crooks also often place a small, hard-to-detect camera nearby to record people's PIN numbers.
"Anywhere you use your credit cards, you always need be aware of the machine that you're sliding it through," says Brooklyn Lowery, editor of CardRatings.com, an independent source of consumer information about credit cards founded in Little Rock in 1998.
"This is particularly true if you're still being asked to use the magnetic strip on the card -- whether your card doesn't yet
have the chip or the retailer isn't yet equipped to take the chip."
In recent years, credit and debit cards have come with embedded microchips that encrypt card-member information and make it more difficult to duplicate or copy.
"With chip readers, it's more difficult at this point," Lowery says. Of course, no system is theft-proof, and it seems crooks are often one step ahead, technologically, than the level of protection.
"Thieves are clever. I'm sure they'll find a way."
"The addition of the chips to the cards should help minimize these kinds of transactions," says Gary Sheppard, corporate security officer for Birmingham, Ala.-based Regions Bank, which has branches throughout the southeastern United States, including Arkansas. "Not completely, but it seems to be working fairly well, from what we see. With skimmers, predominantly at gas stations, people are still inserting or swiping those cards."
ATMs and gas stations are easy targets for skimmers because "they're also not really watched by a live person," Lowery says. Thieves tend to target the island farthest away from the storefront, the one hardest for station employees to monitor.
Restaurants have also occasionally been a source of skimming, "because you have to hand your card to someone."
"Any time the card is out of your sight, you have to be aware," she says. "Any time you swipe your card, you have to be aware."
Because of the way the laws are written, Lowery adds, debit card users are at higher risk than credit card users, "in terms of what they stand to lose," and you're much better protected from fraud if you use a credit card than a debit card. And either way you have a much better chance of recovering your money from thieves than if you're carrying wads of cash.
GAS-PUMP SKIMMERS
"If you are using your card at a gas pump, make sure that the housing where you insert your card is a tight fit," Sheppard says. The Balance recommends wiggling the card reader; if it's loose or it moves when it's jiggled, it's a pretty good sign it has been tampered with. Compare a suspicious credit card reader to the readers at nearby pumps; if something looks out of the ordinary, pay inside or go to another gas station.
The Balance also recommends checking the gas pump security seal. If it's intact, the label usually has a flat red, blue or black background, but if the seal has been broken, the words "Void Open" appear in white. If the seal is broken, it's a sign that someone without authorization has accessed the cabinet.
"The way the fraudsters get into the pump," Sheppard says, "it's my understanding that there's two universal keys that unlock the face of the gas pump." Crooks befriend or pay a gas station employee for the use of the key and install a device.
But even a close check won't guarantee there isn't a skimmer in place.
"The technology is changing, and now a lot of the real sophisticated fraudsters have switched to using a Bluetooth application," Sheppard says. "Those are a real problem, and there's no way for the customer to detect that.
"I personally had my card skimmed -- it was a Regions corporate expense card, after I purchased gas one morning. And that was probably due to a Bluetooth operation."
AT THE ATM
Jason Kincy, marketing director for Arvest Bank, provides these suggestions for customers looking to safeguard themselves against skimming at ATMs: "Before using an ATM, visually inspect it to see if anything looks suspicious. Look to see if the card reader seems bulky or designed differently from the rest of the ATM. Look to see if the card reader seems loose or oddly colored. If the ATM appears to have been tampered with, use another ATM."
The Balance also suggests you watch for card readers that stick out far past the panel and pin pads that are thicker than normal. "In addition to a skimming device, thieves may place a fake keypad on top of the real one to capture your keystrokes," the website explains. "This way they can capture your PIN or billing ZIP code in addition to your credit- or debit-card details. Use a bank-operated ATM, which is less likely to have a skimmer, rather than an ATM at a store or gas station."
Sheppard suggested Regions customers should always check the housing on the card reader at the ATM.
"One of the most obvious [things] is, if a device has been placed on top of our card insert, it's generally another housing that's molded to fit -- easy on, easy off," he says.
"There's a light where the card goes into that's illuminated and blinking, usually. In most cases, those [fake] housings will cover the illumination that it takes for the card to be read. That's usually a telltale sign that most people are not aware of."
Card readers are easy to get and relatively inexpensive, as a quick Google search revealed. Dell, for example, sells one for $60, with free shipping. Most have legal, legitimate uses -- for example, if you run a small business and need to hook up a reader to your laptop so you can process credit cards from remote sites.
But there are also plenty of questionable or even skeevy products out there. Plastic housings for ATM machines are all over eBay, in a wide variety of colors. And we ran across a complete skimming kit, complete with instructions -- in not very good English. It's just over $2,000 for a full kit, $1,900 without the credit-card writer, and they only take payment in Bitcoin.
"You used to have to go to the Dark Web" to find products like these, Sheppard said.
Moreover, "The people doing these types of nefarious acts, they have a [computer] program already in place, already orchestrated so when that information is collected, they want to move [it] as quickly as possible. So they have other people on the Internet or oftentimes on the Dark Net, that are purchasing the credit-card information.
"They take that and have already purchased [blank] credit cards and they download that information onto their own magnetic strip. It's called 'cloning' -- they clone the customer's card -- so in five minutes they can be using that card." They can start making fraudulent purchases online even quicker than that.
Sheppard says Regions has been among the leaders in the banking business "in initiating our own anti-skimming devices at our ATMs. ... We get an alarm that would notify us of the potential that a foreign device had been placed at that location."
BE A WISE CONSUMER
A Little Rock Regions customer who reported his card was skimmed -- probably at a gas pump -- got his money back in a few days, and some advice from the local branch bank: "Regions Bank recommended a second checking account for incidentals, such as groceries, gas, etc., tied to the ATM card. This account should be separate from direct deposits such as paycheck, Social Security, etc. So you would have two checking accounts and transfer money from the checking account with the direct deposits [or savings] to the 'incidentals' account."
Evelyn Mitchell, a Regions senior vice president and the head of the bank's media relations and issues management, says that's not a bankwide policy.
And Sheppard admits that while a second account would accomplish isolating debit-card purchases in one tight location, "I really don't think that's really necessary to go through all that, to set up a second account," he says. "Someone might be a little overzealous, trying to be helpful, and came up with that one on their own."
Arvest's Kincy and Regions' Mitchell emphasized that their banks work with customers on limiting and recouping money lost to card fraud.
"Our team looks for any unusual activity on an account, and flags those transactions and notify the customer," Mitchell says. "If most of the customer's transactions are in Little Rock and all of a sudden there's a transaction in New York or Canada or Singapore, that's a flag.
"But we know that if our customers monitor their account statements and balances and activity, particularly online, they can catch it if there's a transaction they didn't authorize. And there's a Zero Liability Policy in conjunction with Visa, to refund any fraudulent charges."
If you see anything suspicious on your statement or in monitoring your account online, report it to your bank immediately. "As soon as they know you're compromised, call the number on the card," Sheppard says. "The quicker we know about it, the quicker we can shut things down."
You may be able to "shut things down" yourself. Regions recently introduced a feature for mobile banking customers that allows them to lock and unlock debit, credit and prepaid cards. (You may have seen the TV commercials -- they involve fainting goats.)
"Your best line of defense is just to be an aware consumer," Lowery says. "You need to not just use the card and pay your bill once a month and walk away; you need to check your statements from time to time, at least weekly, making sure what's on that statement is a purchase you actually made.
"If your credit card company calls you and says, 'Hey, we have a fraud alert, we're not sure about this purchase,' respond to it," she says. "Don't ignore it. Make sure that is a purchase you actually made. That's going to be the best way to catch if something has gone wrong with the card."
Style on 09/09/2018