ATM Data-Skimming Threats Are On The Rise In C-Stores

ATMs in convenience stores have become a prime target for criminals using so-called skimming devices. A quick Internet search shows dozens of cases within the last year, across the country. It is a sign of the times that common street criminals are now engaging in data theft, trading in their traditional guns and knives for high-tech devices. Carried out by lone criminals or organized crews, skimming has is now a significant threat to both ATM operators and consumers. Although exact figures are not available, news reports tell the story of a distinct trend.

In Norfolk, VA, four independent ATMs were recently found to have skimming devices attached to them. The NYPD has reported a marked jump in skimming devices in Queens, with the number of detected devices quadrupling in the borough in just one year, jumping from 16 in 2014 to more than 60 in 2015. And in Lincoln, NE, police arrested five teenagers with suspected ties to a Romanian crime organization that may have been placing skimmers in as many as 17 states. The youngest of the group was reported to be only 13 or 14.

SUSPECTS:Corpus Christi, TX, police released in June 2015 this image from surveillance cameras of two suspects who are allegedly about to install a skimmer at in convenience store ATM.

The crime is as insidious as it is ingenious. Unlike the well-publicized hacks of large databases that compromise financial data of millions of card holders in a single theft, skimmers are devices that fit seamlessly into an ATM card slot to capture critical information one consumer at a time. An accompanying camera hidden nearby records the PIN as the customer enters it. The thieves then transfer data onto "cloned" cards for their own use, or they sell it online at a "carding shop" where it can be purchased by criminals around the world.

It is not difficult to see why convenience stores, like payment readers at gas pump areas before them, have become a target for the high-tech criminals. They provide a "target-rich" environment for skimmer thieves. According to the experts, gas pumps offer several advantages for device attachment, not the least of which is greater use and the ability to make a quick getaway if detected.

"It's certainly an issue that retailers are watching," said Jeff Lenard, vice-president of strategic industry initiatives at the National Association of Convenience Stores. "Right now the focus is largely at the pump, but that could change. ATMs are just as vulnerable to skimming as gas pumps."

The vast majority of the nation's 150,000 convenience stores offer ATMs, though many locate the machines away from high-value floor space near the cashier. Some even locate the machines outside for expediency, but out of range from the watchful eyes of store employees and security cameras. Thanks to rapidly evolving skimmer technology, a thief requires only a very short amount of time to install a device. As law enforcement officials have noted, a high-tech thief can install one in just a few minutes.

SKIMMER TECHNOLOGY:Although not looking particularly sophisticated, this skimming device fits neatly into the card slot of an ATM to capture consumer data from a card's magstripe. The technology is now within easy reach of street criminals via the Internet sales.

Unlike bank ATMs, convenience stores often lack the same high level of security that would lead to rapid detection of illicit devices. Even if captured by security cameras, the footage is rarely reviewed unless a specific problem is reported. It may take days or weeks before a consumer realizes their card has been compromised or be able to pinpoint the origin of the data theft. That said, many consumers are robbed without knowing when or where they were victimized. And even if they can accurately account for their card usage, the thieves are long gone by then.

Another problem arises with ATM operators themselves. Route personnel are typically not trained to spot or check for skimming devices, so compromised machines could remain active for weeks before one is identified. A machine that looks and seemingly operates perfectly fine during a routine service call, or through remote monitoring, could contain an active skimmer.

There are some basic precautions ATM operators can take in the fight against skimmers. These involve a new set of service protocols for route personnel. Traditionally, route personnel have focused on the cashbox, obvious signs of vandalism and attempted break-ins. But with the proliferation of skimmers, security awareness now must extend to the whole unit, including keypad, card slot and the entire fascia.

"There are several ways to minimize the likelihood that they will be the target of a skimmer," Lenard explained. "First, they should check all of the dispensers as part of their routine service. To look for external skimmers, they should scrutinize the keypad -- see if it is raised or feels loosely connected. For internal skimmers, they should look to see if the dispenser door appears to have been pried open." Lenard added that ATM operators might also want to use security tape over a machine's doors. If this tape is tampered with, it will look different.

Lenard advises that if a skimmer is detected, the machine on which it's placed should be taken offline immediately. And the skimmer must be left in place because the ATM is now a crime scene for local law enforcement authorities to investigate. NACS is taking the skimmer problem very seriously, since c-stores are targets for skimming at both ATMs and fuel pump terminals. The NACS website now includes a primer on skimmer technology, which lists precautions ATM operators can take.

Evolving Technology

Skimmers, like so much technology today, are evolving quickly. Early skimmers required complex retrofitting of ATMs, often necessitating "inside" accomplices to help criminals rig machines, or to cover for them. While these types of ambitious retrofits still happen, the most basic of skimming devices are far easier to install and don't require inside assistance or access.

Today, whether the skimmer is the type that slides into a card slot or includes a replacement fascia (front) of the machine, the sophistication of these unlawful devices has increased dramatically both in design and function. For instance, the false fronts that conceal the magstripe reader and accompanying camera are virtually indistinguishable in color, materials and design from factory original components in a wide variety of makes and models of popular ATMs. The most advanced of the felonious devices employs a wireless connection to transmit stolen data to the nearby thieves.

CRIME IN ADVERTISING:Ads like this promote skimmer devices to would-be thieves around the world. By using encrypted Hushmail to correspond, both thieves and suppliers are assured privacy. Such sites pop up and then vanish with alarming regularity.

While a few data-skimming devices are homemade, most employed today originate from Eastern Europe and Asia. Openly advertised in the darker corners of the Internet, they are shipped anywhere in the world and formatted to nearly any machine. They ship with instruction manuals in multiple languages. According to one expert, the devices cost upwards of $2,500 apiece, though thieves can expect a quick ROI if they place them on the right machine.

For ATM operators, the theft of customer data is far more damaging than if the thieves had broken into the machine's cashbox. A compromised machine quickly leads to compromised credibility. Data thefts, as many of today's largest retailers can attest, call into question the security among consumers who are well aware of the dangers of data theft. And that is indeed bad for business.