Americans’ PINs at risk for scams
New places and unfamiliar ATMs are fertile ground for 'skimming'
Lucy Soto
AJC
4:02 p.m. Saturday, June 26, 2010
As you head into summer travel mode, think about arming yourself against more than just the sun and the mosquitoes.
File Experts say the level of ATM fraud in the United States will increase as bordering countries Canada and Mexico move to the higher-security cards.
Watch out for ATMs. Grabbing that extra bit of traveling cash in a new city can turn into a costly headache.
Americans are still traveling: About 176 million passengers will take to the U.S. skies this summer, according to the Air Transport Association. Another 26 million are travelling internationally.
So, going to the World Cup before the finale on July 11? Going out West to visit wide open spaces? Be careful.
New places and unfamiliar ATMs are fertile ground for scams that cost consumers and the ATM industry about $1 billion in annual global losses.
“In general, tourists on vacation travelling tend to have their guard down,” said Mike Urban, an ATM fraud expert with Fair Isaac, the provider of FICO credit scoring. “You may not be as diligent as you normally are in certain situations. Criminals realize this.”
And that makes the situation ripe for “skimming.”
Skimming involves stealing the information from a card’s magnetic strip or pilfering a consumer’s personal identification number, or PIN. It’s the most basic of ATM frauds. It can involve a peek over a shoulder or crooks posting small cameras or using telescopic devices to see the PIN. Skimming also happens with fake card readers and phony ATMs.
Criminals are even taking it up a notch. The basic tactics are being replaced with attacks on software in ATMs and ATM networks, or criminals who “phish” for PINs using false telephone text alerts. Some steal account information to pose as consumers who want to change their numbers.
“Anyone at or headed to the World Cup needs to be very careful,” said Paul Henninger, vice president of products for Actimize, a risk management software company. “These national and international events, like the Olympics or the Super Bowl, are magnets for criminal activity.”
Banks use fraud detection systems to track user behavior over billions of transactions all over the world. But the systems can be thrown off when there’s a spike in unusual traffic, as with high tourist turnouts and variations in times and places of ATM usage that don’t fit consumer patterns.
As a consequence, events like the World Cup in South Africa give criminals a short window of cover.
“What fraud systems look for is strange increases in volume and amount of transactions,” Henninger said.
ATM fraud is a growing problem in the United States. A survey earlier this year found that 10 percent of all fraud victims in the U.S. experienced phony ATM cash withdrawals.
According to financial research company Javelin Strategy & Research, the number of records breached rose 16 percent in 2009.
Actimize surveyed financial services representatives in May 2009, and its report showed 70 percent of respondents saw an increase in fraud claims in 2008 compared to 2007. Of those, 58 percent had double-digit growth.
In the meantime, banks in other countries are moving toward new technologies to stem fraud. New chip-and-PIN cards have encrypted microprocessor chips that are more difficult to clone and require the user to enter a personal identification number.
Experts say the level of ATM fraud in the United States will increase as bordering countries Canada and Mexico move to the higher-security cards.
The encrypted smart cards have already become popular overseas where sophisticated skimming networks have flourished.
This can be a problem for U.S. travelers with their magnetic strip cards. Automated kiosks — like vending machines, bicycle rental racks in Paris, parking meters in some areas of London and toll and gas stations — accept only chip-and-PIN cards.
New York-based United Nations Federal Credit Union (UNFCU), a $3.1 billion institution with 88,000 members across 205 countries, has begun issuing chip-and-PIN Visa credit cards to its top-tier members who have had trouble using U.S.-issued cards overseas.
In May, a payment services director for behemoth retailer Wal-Mart touted its move to chip-and-PIN technology in its stores, a move that might nudge the U.S. to evolve from the magnetic strip card.
In the meantime, consumers, said Urban, need to be alert.
“It’s something that’s growing,” he said. “It’s certainly a global issue. Anywhere there’s an ATM and there’s a criminal that thinks they can get away with something.”
How to protect your ATM info
Here are a few tips to prevent ATM fraud and insights into how criminals steal your personal identification numbers.
- Always protect your PIN: Don’t give the number to anyone and cover the keypad while you are entering it.
- Beware of hand-lettered signs posted on the front of ATMs directing you to reinsert your card or enter your PIN multiple times.
- Look for the unusual — strange caps, wires or foreign devices on card readers. If anything looks damaged or like it has been tampered with, stop immediately and find an alternative ATM.
- If your card gets stuck or the cash doesn’t come out, contact your financial institution immediately by calling the number on the back of your card. This is something called cash- or card-trapping, in which criminals insert devices to collect the dispensed money or hold the card long enough to steal its information.
- If you travel abroad, tell your bank or credit union before you leave, so they can help if you need it while you are away. And make sure you carry all phone numbers for credit, ATM and debit cards in case they’re stolen and you need to call. Don’t, of course, carry them in your wallet or purse.
- When travelling, never use an internet café computer to check e-mail or bank accounts. If hackers compromise your e-mail password, they can get to your accounts by, for example, asking for new passwords via e-mail.
- Monitor your bank accounts. Many banks offer daily balance alerts, text message alerts for ATM usage and other instant account management tools. Make sure your bank has up-to-date contact information, including your cell number, so they can notify you if they spot anything unusual.
