Feeds

Teensy card skimmers found in gullets of ATMs

Hi-tech fraudsters treading more softly, but gas still yielding bang for buck

Providing a secure and efficient Helpdesk

A series of tiny and sometimes transparent card-skimming devices have been detected in ATMs across Europe, researchers say.

Boffins with the European ATM Security Team (EAST) have plucked out and displayed some clever thumb-sized skimmers that hide from victims' view by fitting in cash terminals' gullets.

The devices paraded in the EAST report European Fraud Update for 2014 (subscription required) were designed for NCR machines and contained pinhole spy cameras which together with the skimmer would provide felons with the magnetic stripe data and PINs required to replicate the cards.

One of the internal skimmers ditched the typical green fascade opting for a translucent colour, making it more difficult to spot.

Developers of ATM skimmers were at times ingenious in their bid to evade detection. KrebsonSecurity reported one style of skimmer that used audio waves to transmit captured card details which could then be decoded.

Use of mobile communications capabilities is also becoming more popular with skimmers, as it liberates fraudsters from the need to return to hijacked ATMs in order to retrieve fleeced cards or the data they bear.

Cruder cash claws, or cash trapping, still remained popular with thieves who inserted the devices to jam cash dispensers so that money can be picked up later.

The report reflected findings gathered at a meeting at the European Cybercrime Centre (EC3) in the Hague last month. The mini-skimmers were reported in one unnamed European country while others said skimmers were being left in ATMs for longer, between four to five days on average.

Chip and PIN credit cards were deployed in most G20 countries including Australia and the UK which made skimming more complex and expensive for fraudsters. However ATMs still supported outdated and vulnerable magnetic stripe reader cards due to slow adoption in the US where losses were highest, according to the report.

Eight countries reported attacks against unattended payment terminals at petrol stations and six had attacks targeting point-of-sale devices. Fraudsters had even removed ATMs returning it only after modifying the machine.

Brutish ram raids and ATM burglary were down in 10 countries with three large gangs busted by law enforcement. Explosive attacks however were on the rise with eight countries reporting the use of gas attacks and two having cash machines blown up with solid explosives.

The EC3 played a role in four large cross-border busts on criminal fraud gangs targeting online transactions, airlines, ATMs and document fraud. "In many cases the criminals transferred stolen funds to unregistered pre-paid cards for cash withdrawal at ATMs," the organisation said. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.