ATM Skimming 101: How to Keep Safe

April 27, 2009— -- Sean Seibel thought it looked just like any other ATM -- at least at first.

Earlier this month, the 33-year-old Microsoft employee, who lives in New York City, stopped in the closest Chase bank to get some cash to pay his barber. But when he inserted his ATM (automatic teller machine) card in the machine, he noticed a bit of resistance.

The screen said the machine was unable to read his card. So he tried again. But a second time, the machine gave him an error message.

He was about to give up and try another machine, when a thought popped into his head. He had heard about devices that fraudsters attach to the outside of card readers on ATM machines and, though it seemed unlikely, wondered if that was the source of his problem.

"I'm looking at the thing and thinking this can't be – no way," he said. "There are all these stories and myths about it, but I actually found one in the wild."

With a combination of fear and exhilaration, he tried to pull on the green plastic surrounding the card slot and found that it peeled right off.

"I'm like WOW," he said. "My heart's beating fast but I'm also now freaked out."

Behind an extra mirror attached to the machine, he also found a hidden camera positioned right over the key pad, to capture the PIN codes as victims type them in.

He notified the branch manager who contacted bank security and later shut down the machine and alerted other area banks.

Three Skimmers Found in One Week

But that same week Nick McGlynn, a 26-year-old photographer, also spotted an ATM skimmer at a different Chase bank in New York City. He had just read about Seibel's experience on a technology blog, when he walked by a set of Chase ATMs that looked peculiar.

"From the window, I could see a mirror centered on one ATM but no mirror on another," he said.

A woman was using the machine, but he politely asked her if he could check on something. When he pulled at the mirror, it came right off and, like Seibel, he found a hidden camera behind it.

According to the blog the Consumerist, in one week, three of its readers -- Seibel, McGlynn and another man in Los Angeles -- each found a different ATM skimmer, raising questions about the frequency of this supposedly rare kind of crime.

And though experts say hard data on the phenomenon is difficult to come by (banks are wary of reporting incidents for fear of alarming customers), some think changes in the industry are making bank ATMs in the United States increasingly vulnerable.

Losses From Skimming Total $1 Billion a Year

"ATM skimming has been and will continue to be the number one type of ATM-related fraud," said Tracy Kitten, editor of ATMMarketplace.com. "It's something that the industry has been fighting for a very long time."

The fraud involves accessing bank accounts by capturing the data off customers' bank cards. Criminals attach skimming devices over the card slots on ATMs to steal the information as the machine reads the card's magnetic strip.

Hidden cameras -- like those recently found behind extra mirrors -- record victims typing in their PIN codes. More sophisticated criminals use wireless keypad overlays, that transmit a person's PIN to a nearby laptop, instead of the cameras.

Once criminals have that information, they can send it to others who can make illicit transactions anywhere in the world.

The U.S. Secret Service estimates that annual losses from ATM skimming total about $1 billion each year, or $350,000 a day.

Kitten and others emphasize that ATM transactions are mostly secure. According to the ATM Industry Association (ATMIA), just .0016 percent of the billions of worldwide ATM transactions are affected by crime or fraud.

But they also think that as Canada and European countries abandon the magnetic strip system for a microchip-based approach that is thought to be more secure, ATM fraud in the U.S. could increase.

Consumers Not Responsible for Charges or Withdrawals They Didn't Initiate

For their part, banks stress that they are taking the necessary precautions to protect their customers.

"Consumers should know that they would not be responsible for any charges or money taken out that they didn't do," said Tom Kelly, a spokesman for Chase.

As for the skimming attacks recently reported in New York, Kelly said, "There are a number of security measures that we take that we can't really talk about. We've stepped up our efforts."

Consumers Concerned About ATM Fraud

Still, despite assurances that their money is safe, U.S. consumers say ATM security is a major concern.

A February study commissioned by Level Four, an ATM software company, found that 67 percent of American adults would consider switching to a competitor if their bank suffered an instance of ATM fraud.

Steven Lund, president of Level Four Americas, LLC, told ABCNews.com that rising fraud in many European countries is what led them to replace the magnetic strip technology with the "chip and PIN" approach (also known as EMV for Europay, Mastercard and Visa).

But, "since the U.S. has not adopted EMV, it's our feeling that we'll see increasing fraudulent activity," he said. "Criminals will go to where to commit fraud is easiest."

The ATMIA says that countries that have adopted the chip and PIN technology have reduced cash losses, but because of the major expense involved in rehauling the system and the relative rarity of ATM skimming, U.S. banks have been reluctant abandon the magnetic strip.

Bank ATMs More Vulnerable Than Stand-Alone ATMs

Lana Harmelink, chief operating officer of the ATMIA, also told ABCNews.com that another change has increased the vulnerability of ATMs stationed at bank branches.

As ATMs located in grocery and corner stores (and stand-alone machines on the street) switch to technology that encrypts the PIN pad, criminals are finding it harder and harder to hack into those machines, she said. Also, because they're often positioned near a cash register, under the watchful eye of cashier or store owner, it's more difficult for fraudsters to install skimmers without being caught.

"We're seeing it move from ATMs off-premise to ATMs at banks," she said. "Banks are more the target."

Bank ATMs are also more highly trafficked, which means a bigger potential payoff for the criminals, she said. In a given month, a convenient store ATM might see 150 to 200 transactions, while a bank branch ATM might have 1,500 to 2,000 transactions.

Anticipating an increasing threat, security and surveillance firm ADT Security Services unveiled new antiskimming technology just this March.

Each year, the company hosts a symposium for its biggest banking customers and said that, more recently, interest around skimming has grown.

Tips to Stay Safe From ATM Skimming

"We did notice over the last couple of years that more and more of our customers were beginning to raise concerns about skimming," said Hank Monaco, vice president of commercial marketing for ADT.

The company's antiskimming system is invisible from the outside, but detects the presence of skimming devices near the card entry slot and alerts the bank without disrupting the transaction.

As the technology is new, Monaco said he couldn't disclose how many banks use their system.

But as banks ramp up their security measures, he and others recommend that customers do what they can to secure their transactions.

6 Tips for Consumers: Spotting ATM Skimmers

1. Be aware of your surroundings. Be extra careful of machines in dark areas or in places that don't look well guarded and monitored.

2. Pay attention to the front of machines. If it looks different from others in the area (for example, it has an extra mirror on the face), has sticky residue on it (potentially from a device attached to it) or extra signage, use a different machine and notify bank management with your concerns.

3. Notice how it feels to type in your PIN code. If it's difficult to punch the keys or you feel resistance, it could mean that a keypad overlay is present.

4. Cover your hand as you type in your PIN. If a camera is present or someone is trying to look over your shoulder, this will obstruct their view.

5. If you think the area around the card entry slot looks peculiar, pull on it. If it comes off or loosens, alert bank management but try to leave the machine as you found it. Leaving the evidence in place could help authorities track down the criminals.

6. If you find a skimming device, in addition to notifying bank management, the ATMIA says to notify local law enforcement.