Can you let your spouse see your PIN? (ATM card skimming & why the cash machine is not so friendly)

If your weekend is anything like ours, it involved a trip to the ATM machine. (or as we like to call them “magical machines of love”).  Drive up, take 90 seconds to press some buttons and presto! Money comes flying out.  Does life get any better?  Well, it turns out that these machines might actually be too magical.  Unfortunately, ATMs have the capacity to show love to other folks too (and with your account numbers, no less!)

Thanks to what is referred to in the industry as “card trapping” or “skimming,” it just so happens that your friendly neighborhood ATM can be altered to give your numbers AND your PIN to strangers.  And, with not much effort on their part.  Skimming happens when somebody sneaky (and without much regard for the law, I might add) attaches one or two devices to the ATM machine that you are about to use. 

Here’s how the game works

Someone buys a “skim your local ATM for card numbers” kit – don’t laugh, they are available all over the web – and finds an ATM machine to attach it to.  The kits are designed to fit onto the machine and look like they belong.   The first device is placed near (or inside or around) the slot that you put your card into.  Though it seems inconceivable, it is actually possible to do this without being detected.

Here’s an article with some good pictures of skimmer attachments.  The piece that goes over (or near) the card slot records the information embedded in the electronic strip on the back of your card (name, account number, etc.) then transmits that info to the scofflaw who is hovering nearby with an electronic device recording the info in real time.

The second device is usually a tiny camera placed somewhere near the keypad.  That camera only wants to record your PIN as you type it into the keypad.  After the bad guy gets home, he’ll be able to make a new ATM card that thinks it belongs to you.  How often does this happen?  Too often as a matter of fact.  Skimming costs the global banking industry close to Two Billion Dollars a year.  It’s clear that the skimming community is not going away anytime soon.  The Jan through April skimming losses were higher this year than they’ve ever been  – growing a whopping 174% from the same period in 2014.  

Shouldn’t these be easy to spot?

You would think so.  But, what’s the use making a device to steal ATM card numbers, without making it just a little hard to find?   As it turns out, skimming machines are NOT easy to see.  The good thing, however, is that they are designed to be temporary.   Because the criminal needs his equipment back, he has to be able to remove it from the ATM quickly.  (think: glue that is strong enough to hold it there for a few hours – but not strong enough to keep you from ripping it off of the machine) 

Unfortunately, all skimmers were not created equal

Since the equipment that the con artists glue to the machine has to be easy to remove it is possible to thwart their efforts by taking it off yourself.  Before you insert your card, you can jiggle the card slot and keypad to see if there is any hanky-panky going on.  That might actually do the trick with some of the older, bulkier skimmers.   But, lately, some skimmers have taken on a much slimmer approach.  Unfortunately, some more current skimmers are being made, to fit INSIDE the card slot   (good luck jiggling those) 

Editor’s note of lost opportunity: when I see something like this I wonder how many of the world’s problems could be solved if these fools would just use their powers for good instead of evil.  If they would repurpose the ingenuity it took to make a skimming tool to fit INSIDE the card slot how hard could preventing droughts and hunger be? Oh well…..

Am I liable?

If someone skims your ATM numbers and PIN and takes cash out of your account, you’re not liable. (which probably means that you can expect to get your money credited back to your account).  BUT, this factoid comes with two conditions. The first and most important: you have to tell your bank as soon as you know that something’s amiss AND you have to do it within 60 days of when the thieves take your cash.  (The Electronic Funds Transfer Act (EFTA) requires that you report a lost or stolen card within 48 hours.) 

But, a card that was skimmed is neither lost nor stolen.  Since you continue to use your card (after all, you won’t have any idea that your card got skimmed) figuring out how to fix it can quickly become a giant mess.  This of course makes it even MORE important for you to check your balance frequently and go through your monthly statement very carefully to make sure that only YOUR withdrawals are the ones that are showing up.

How to keep your ATM card from getting skimmed?

While it’s nice to know that you won’t be liable if someone skims your card, having the law on your side isn’t exactly a magic wand.  If you get skimmed and tell the bank as soon as you found out, it will still be a while before the money makes its way back into your account.  Better you should keep from getting skimmed in the first place, yes?  If you want to be absolutely sure, you could walk into the bank, fill out a slip and wait in line every time you need cash.  (Of course, not wanting to wait in line is the reason why you’re using an ATM in the first place)  

    • Can everybody else see the machine?  Is there a camera?   Remember, the knuckleheads have to pick a machine that they can glue stuff to (and then take it off) without being seen.  Does the bank have cameras surrounding the ATM you’re about to use?  Is it in an area where it would be really hard to mess with without arousing suspicion? (like the hallway at the mall).  Stay away from a machine that is in a place where skimmers can be glued on and ripped off without people noticing.
    • Get money sometime other than the weekend.  Easier said than done right?  Conventional wisdom says that since the skimmer has to be attached and then DEtached easily, there has to be a period of time when bank employees are not around the machine.  This makes weekends the best time.  Start planning on taking money out of the ATM on Friday afternoon or Monday morning. 
    • Jiggle the Card Reader & keypad. This is the easiest thing to do.  Yes, before you put your card in, grab whatever is attached to the card slot and give it a slight tug.  If skimming equipment was attached, it’ll come loose and announce itself as something that the bank doesn’t want on the machine.  Why jiggle the keypad? If they don’t use a camera, it’s because they’ve placed an overlay on top of the keypad.  If the whole keypad moves back and forth, it’s your cue to find another ATM.
    • Cover your hand, while you input your PIN.  Don’t worry, we’re not suggesting that you hide your PIN from your spouse.  If there’s a skimmer that uses a camera, the best way to frustrate the entrepreneur who wants to steal your money is to cover your hand whilst you type in your PIN.  Not the easiest plan when you’re at a drive-up ATM to be sure.  Can’t reach with both hands?  Maybe you should get out of your car.
    • Check your statement.  Quick quiz: are you one of those people who uses their ATM card for everything?  Can you remember the last 3 times you used it and how much you spent? If you answered YES to the first question or NO to the second, please introduce yourself to your monthly statement and look at it very carefully.   Even if you only use your ATM card for cash at your own bank, you should be checking your statement carefully.   The law says that it is your duty to find fraudulent charges and call the bank as soon as you know or “should” know that there’s a problem.  If bad guys get your numbers and steal your cash and you HAVEN’T bothered to check your statement for two months, wave bye-bye to your cash.
    • Get in the habit of using the same machine.  This way, it will be easier to see if it’s been messed with or if a non bank-owned camera was added to the machine or surrounding area.  Using the same machine will also make it easier to tell if someone else is using your card when you go over your statement.  
    • Balance inquiry.  If your bank doesn’t charge for balance inquiries at the ATM, do this whenever you take cash out.  It’s a quick way to figure out if someone is helping themselves to your account.
    • Use a real ATM.  Admittedly this sounds like bonehead advice. But, who among us hasn’t used a stand-alone ATM machine at the mall or one that was not attached to a bank at least once?  Here’s how fake ATM machines work: you put your card in and follow the prompts like normal.  Instead of giving you money, the machine says something like “We are unable to process your transaction at this time.”  What you don’t realize is that there was no money in the machine.  It was only set up to get your PIN and card numbers.  The message might as well have said “We’re sorry, we can’t give you any money.  But, thanks for giving us yours!”  Since most banks charge you a fee for using a machine that is not “in their network,”  you should be trying to use your bank’s own machines anyway.  We couldn’t begin to tell you how to look at a stand-alone ATM to tell if it was put in by scam artists.  But, if you never use a stand-alone ATM that doesn’t have your bank’s logo all over it,  you don’t have to worry about who owns it.

Be a little more careful and make sure that YOU are the only one who gets to use your cash.

Posted by: Mark Wiseman (who once used a drive-up ATM in a driving rainstorm. He shut his window to wait for the cash and watched helplessly as the machine spit his moola into a puddle under his car)