I spent the past week vacationing (mostly) in Southern California, traveling from Los Angeles to Santa Barbara and on to the wine country in Santa Ynez. Along the way, I received some information from a law enforcement source in the area about a recent ATM skimmer attack that showcased a well-designed and stealthy all-in-one skimmer.
The skimmer pictured below is the backside of a card acceptance slot overlay. It was recovered by a customer at a bank in the San Fernando Valley who called the cops upon her discovery. Police in the region still have no leads on who might have placed the device. The numeral “5” engraved in the upper right portion of this skimmer suggests that it was one in a series of fraud devices produced by this skimmer maker.
Backside of an all-in-one ATM skimmer found this year at a bank in the San Fernando Valley area of California.
The skimmer appears to be powered by a phone battery, which connects to the card reader device and to the circuit board for a video camera. Here’s a close-up of the video card+skimmer connection.
Flip the device around, and you can see the tiny pinhole where the attached camera peers through the skimmer front to capture timestamped footage of victims entering their PINs.
Notice the pinhole for the built-in camera, upper right.
Of course, looking straight on at the skimmer as it would appear attached to a compromised ATM, it might be difficult to spot the pinhole, as shown in the following picture.
A few tips about ATM skimmers and skimming scams. It’s difficult — once you’re aware of how sophisticated some of these skimmers can be — to avoid being paranoid around ATMs; friends and family often tease me for stopping to tug at ATMs that I pass on the street, even when I have no intention of withdrawing money from the machines.
Still, it’s good and healthy to be somewhat paranoid while at an ATM. Make sure nobody is “shoulder surfing” you to watch you enter your PIN. A simple precaution defeats shoulder surfing and many other types of video-based PIN stealing mechanisms: Cover the PIN pad with your hand or another object when you enter your PIN.
If you are withdrawing cash after hours, visit only well-lit ATMs and those that are in plain view of other public spaces. In the unlikely event that you discover a skimming device attached to the ATM, alert the bank or proprietor immediately. Do not attempt to walk away from a compromised ATM with a skimmer in hand. For one thing, thieves who place skimmers often lurk nearby to prevent such occurrences. Also, consider how you might explain to a police officer that the device you just removed from the ATM is not yours. If you must leave with evidence, take a picture of the compromised ATM using your mobile phone (and if you get a nice picture, please consider sending it to me!).