ATM & POS Terminal Skimming
The United States Secret Service is the lead U.S. agency tasked with investigating access device fraud, a crime that affects consumers, businesses, and financial institutions. Skimming crimes account for hundreds of millions of dollars in losses annually to victims. Every year, the Secret Service responds to hundreds of ATM and skimming incidents by working closely with financial institutions and local law enforcement agencies.
Skimming incidents involve criminal groups installing hidden electronic devices that record cardholder information at ATMs and Point-of-Sale (POS) terminals. These incidents occur frequently at popular merchants, such as pharmacies, gas stations, and grocery stores. Criminals use the stolen (skimmed) debit or credit card data by re-encoding it on other cards for unauthorized ATM withdrawals or high-end purchases. Criminals may sell the stolen data from batches of cards to other groups.
Secret Service Alert on Skimming: Click here to download a Secret Service awareness flyer for education and distribution purposes.
ATM Skimming Devices
ATM skimming devices are typically inserted deep inside the card read slot of ATMs and are usually impossible to detect from the ATM’s exterior. These devices can be designed to capture both the data on your magnetic stripe and your card’s EMV chip (note: EMV refers to Europay, Mastercard, and Visa, the three payments companies behind the chip technology). While ATM companies are constantly developing security features to combat skimmers, criminals are always adapting to these security features and changing their methods to deploy ATM skimming devices. To limit your risk of becoming an ATM skimming victim as much as possible, consider taking the following steps:
• Utilize ATMs inside of financial institutions, interior bays with security cameras, or closest to the drive-up window. These ATMs are harder targets for criminals.
• Look for obvious signs of tampering at the ATM, such as inoperable/broken lights, raised PIN pads or loose edges, loose components or stickers placed in unusual locations.
• Always shield your PIN entry with another hand as much as possible to prevent your PIN from being recorded by a “pin-hole” camera.
POS Terminal Skimming Devices
POS terminal skimming devices are typically overlays that cover either the entire top exterior of the POS terminal, or just the keypad and EMV reader slot. These skimming devices can be difficult to detect because criminals will design plastic overlay shells that look identical to the top of the POS terminal and fit securely on the terminal. These skimming devices can be designed to capture both the data on your magnetic stipe and your card’s EMV chip. POS terminal overlay skimming devices will also capture all keypad entries, including your PIN, if a debit card is used. To limit your risk of becoming a POS terminal skimming victim, consider taking the following steps:
• Inspect the exterior plastic edges of the POS terminals and keypad for obvious signs of tampering. You can gently pull up on the corners of the terminal or the keypad’s privacy shroud. If any part of the terminal appears or feels loose, do not use this terminal and immediately bring it to the attention of the merchant.
• Some merchants will use seals on the sides of the POS terminals instead of a debit card to avoid potentially compromising your PIN and giving criminals access to your checking account.
• If possible, consider using a credit card at POS terminals instead of a debit card to avoid potentially compromising your PIN and giving criminals access to your checking account.
Additional Guidance
Businesses Utilizing POS Terminals or ATMs: Immediately take the POS terminal or ATM out of service to prevent data compromise, make notification to your company’s corporate security or loss prevention department, and/or contact your local law enforcement agency, who can retrieve the skimming device and appropriately handle the device as evidence.
Individual Cardholders: Immediately contact your card issuer’s fraud department to report the incident, ask the card to be deactivated, and ask that a new card be issued with a new PIN. Monitor the affected account closely. If you suffered a financial loss as a result of a skimming incident, consider filing a fraud affidavit with the card issuer and contacting your local law enforcement agency to report the incident. In the future, consider making purchases using cards that can transact through contactless payment (i.e. tap-to-pay) or with the card’s EMV chip, instead of the magnetic strip.