Feeds

Teensy card skimmers found in gullets of ATMs

Hi-tech fraudsters treading more softly, but gas still yielding bang for buck

Internet Security Threat Report 2014

A series of tiny and sometimes transparent card-skimming devices have been detected in ATMs across Europe, researchers say.

Boffins with the European ATM Security Team (EAST) have plucked out and displayed some clever thumb-sized skimmers that hide from victims' view by fitting in cash terminals' gullets.

The devices paraded in the EAST report European Fraud Update for 2014 (subscription required) were designed for NCR machines and contained pinhole spy cameras which together with the skimmer would provide felons with the magnetic stripe data and PINs required to replicate the cards.

One of the internal skimmers ditched the typical green fascade opting for a translucent colour, making it more difficult to spot.

Developers of ATM skimmers were at times ingenious in their bid to evade detection. KrebsonSecurity reported one style of skimmer that used audio waves to transmit captured card details which could then be decoded.

Use of mobile communications capabilities is also becoming more popular with skimmers, as it liberates fraudsters from the need to return to hijacked ATMs in order to retrieve fleeced cards or the data they bear.

Cruder cash claws, or cash trapping, still remained popular with thieves who inserted the devices to jam cash dispensers so that money can be picked up later.

The report reflected findings gathered at a meeting at the European Cybercrime Centre (EC3) in the Hague last month. The mini-skimmers were reported in one unnamed European country while others said skimmers were being left in ATMs for longer, between four to five days on average.

Chip and PIN credit cards were deployed in most G20 countries including Australia and the UK which made skimming more complex and expensive for fraudsters. However ATMs still supported outdated and vulnerable magnetic stripe reader cards due to slow adoption in the US where losses were highest, according to the report.

Eight countries reported attacks against unattended payment terminals at petrol stations and six had attacks targeting point-of-sale devices. Fraudsters had even removed ATMs returning it only after modifying the machine.

Brutish ram raids and ATM burglary were down in 10 countries with three large gangs busted by law enforcement. Explosive attacks however were on the rise with eight countries reporting the use of gas attacks and two having cash machines blown up with solid explosives.

The EC3 played a role in four large cross-border busts on criminal fraud gangs targeting online transactions, airlines, ATMs and document fraud. "In many cases the criminals transferred stolen funds to unregistered pre-paid cards for cash withdrawal at ATMs," the organisation said. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.