What is an ATM Anti Skimming Device & How Does it Work?
It’s understandable that ATM security is a key concern for financial leaders. Every year, billions of dollars are lost to skimming attacks and other fraudulent activities. Not only do these attacks create tremendous financial burden to banks and credit unions, but they also erode the confidence of the communities who depend on ATMs for cash and other banking needs. As technology advances, so does the level of sophistication involved in these criminal acts, so it’s important to stay on top of the various options that you can deploy to protect you and the communities you serve.
As a consultative provider of equipment management solutions, Equips recognizes how critical it is to implement personalized security solutions. Regardless of the type of ATMs in your fleet, there are options to provide the safeguards you need to reduce your risks.
Here are some widely accepted options for the best anti skimming device and anti skimming software technology :
Jamming: prevents a skimming device from reading a customer’s card information. Anti skimming jamming devices emit random electromagnetic signals that interfere with the skimmer’s ability to record card data. Unlike sensors, they do not depend on detection, which makes them useful against both overlay and throat inlay skimmers.
Active-jamming devices offer the additional advantage that the ATM can safely remain in service (“active”) even with the skimming device present.
Active-jamming devices for motorized readers have been available for some time; however, a solution for DIP readers became available only last year, when TMD introduced the only such anti skimming device on the market.
Metal detection: Sensors can monitor for a metallic object attached to the bezel. If a skimming device is detected, the ATM is taken out of service until the threat is removed. This method often proves to be an effective anti skimming measure, but it also takes the ATM out of service. Unfortunately, this presents not only an inconvenience to those attempting to use it, but it can also cast doubt on the security of the institution.
Jitter motion: This anti skimming hardware distorts the magnetic strip from a card, rendering the information unusable. This technique brings the card in through an irregular stop-start “jitter” motion. This anti skimming option is only available for motorized card readers, not dip card readers. Unfortunately, the U.S. market widely moved to dip card readers over a decade ago because of the rate of people leaving their cards behind.
Unique sensors and bezel design: The physical shape of the card reader and fascia effectively prevents perpetrators from attaching a card skimming device around the ATM card reader or applying a false front. If tampering occurs and the detection sensor is covered or compromised, the ATM will be taken out of service. This was an early anti skimming defense of the major manufacturers. NCR designed a unique round bezel anti skimming device which was somewhat transparent and very difficult, at the time, for an overlay skimming device to be used on. Diebold introduced a new concept to the industry with their ActivEdge card reader, which has the user insert their card long-end first. Banks and credit unions have also developed more home-grown solutions for anti skimming devices, like a bank in the Northeast that fashioned a piece of polycarbonate to their machine to prevent a criminal from putting an overlay on their card readers.
There are many companies in the financial industry providing solutions for the different types of ATM card skimming. TMD, Tyco Integrated Security, ACG, and Cennox, to name a few, all offer anti skimming solutions that can be installed inside the ATM to deter some or all of these types of skimming. The major ATM manufacturers have also either created their own solution or partner with an established security company to provide a level of anti skimming device on each new machine.
Without taking the proper anti skimming precautions, you can lose ATM uptime, consumer and brand confidence, and thousands of dollars. Talk to an experienced Equips consultant today about ways to develop the best security path for your ATM fleet. We can offer insight on a number of anti skimming device strategies focused on delivering maximum security, availability and convenience, all customized to your specific business needs.
Ways to Prevent ATM Skimming:
ATM skimming is a practice that all financial business owners should be aware of and should take precautions against. “Skimming” refers to criminals placing a device either outside a card reader, in a card reader throat (throat inlay), or completely inside a card reader behind the shutter (deep insert) in order to obtain information from other customers’ ATM activities.
Skimming does not just occur at the ATM level. One of the primary attacks is at gas pumps where individuals are less suspecting. The criminal places the device in one of the three aforementioned areas and simply waits for customers to use the terminal. The device will not only capture the card information once a card is swiped, but if the criminal places a pinhole camera in the area facing the keypad, they can capture the PIN as well.
Attacks typically occur during the weekends, especially long holiday weekends, when usage will be high and perpetrators are less likely to get caught. The device is typically deployed for a short period of time to mitigate the chance of it getting noticed and removed.
Many criminals have moved to Bluetooth technology, as there is an inherent risk in coming back to remove the device from the machine. If the bank has identified there is a skimmer on the machine, they might be laying in wait to catch the criminal. With Bluetooth technology, they can pull their car close to the ATM and capture all the data electronically without having to remove the device. This information is used to quickly replicate cards and distribute to their crime network for use before the cards have been identified as skimmed and cancelled.
Card skimmers and Bluetooth devices can be bought online along with easy-to-follow instruction videos. The cost has gotten low, the ability to obtain has gotten more widespread, and general know-how has increased. The average skimming attack can easily be $5,000 to $500,000 for one skimming event, whereas a bank robbery can be $3,000 to $10,000 because of cash limits in the tellers’ drawers. ATM skimming is much easier, boasts a higher reward, and has a lower risk of being caught.
We have a false sense of security now that we have chip cards and anti skimming wallets, leading us to believe that all is well and we are protected. However, if you notice, every card still has a magnetic strip where all the card data still resides. The best way to protect yourself is to stay on alert whenever and wherever you use your debit/credit card, especially an ATM or gas pump. Look for tampering, a loose credit card reader, or maybe a cracked fascia around a pump or ATM where a camera might have been inserted or device attached. Not using your debit card at the gas pump will prevent at least your PIN number from being taken. Since Bluetooth devices are often used, you can also do a quick search on your phone to see if something out of the norm is in your area.
There are many anti skimming devices out in the marketplace; however, many institutions have not widely deployed them, and gas stations are even further behind the curve. Some businesses deploy just basic detection anti skimming devices, which would only alert you that a skimming device might be present on the machine but does not prevent the card data from being comprised. This can take hours or even days for someone to respond to the message sent by the anti skimming device, leaving all their customers wide open for fraud. One type of anti skimming the institution can deploy is jamming (electronic field); this technology will jam the data so it cannot be captured once an event is detected. The problem with most anti skimming devices is that they are for the outside overlay type skimmers on the actual card reader, but now, many of the attacks are interior, or what we call “deep inserts.” For further protection, companies have deployed a deep insert plate that essentially takes up the “extra” space in the inside of the card reader to prevent the criminal from placing a sleeve-like device inside the card reader that captures data. Deploying active jamming during all transactions, not just after detection, and deep insert plates or retrofitted card readers to prevent interior skimming is a necessity.
Even with that, the best option is to always have a consistent practice in place. ATM owners should invest in anti skimming technology and anti skimming devices, and inspect the device daily. The customer must be aware and provide their own anti skimming precaution by checking the card reader for any foreign objects.
No matter what type of ATM you maintain, Equips can help you identify and obtain the best ATM security path for your business. Contact Equips today to speak with a knowledgeable representative and discuss a customized security plan.
Additional resources that address Anti Skimming Device ATMs:
“Payment card skimming remains a popular crime, and attackers can easily get into the business using a few inexpensive parts purchased over the Internet.” – Steve Orlando
“Credit card skimmers may have finally met their match. In New York City, we saw a surge in ATM skimming in the past few years, as evidenced by the increase in devices recovered by our agency, the NYPD,” he said. “In 2015, we recovered 48 devices, and two years later that number had doubled to almost a hundred devices in 2017. Correspondingly, our arrests more than doubled for the same period, from 48 skimming-related arrests in 2015 to 134 skimming arrests in 2017.” – University of Florida
“Any anti skimming solution that relies on detection should be thoroughly evaluated to make sure that the detection capability can be relied on,” he said. “Better still, active anti-skimming solutions that are not triggered by detection can be considered.” – by Suzanne Cluckey, ATM Market Place
“The bad guys are skilled, resourced and determined enough that sooner or later they will figure out exactly what we have done, so the ATM has to be safe against a knowledgeable attacker.” – by KrebsOnSecurity