Card Skimming On the Rise in Bay Area

If you have been listening to local Bay Area newscasts, you may notice increased reports from this last Memorial Day weekend of increased "ATM based thefts" in the South Bay.

These attacks are increasing in prevalence and are targeted at capturing your debit card and credit card numbers along with their associated PINs to execute unauthorized withdrawals or charges to your accounts. The thieves are counting on the fact that you are unlikely to be reviewing your credit card or debit account statements frequently enough to detect these events OR are likely to ignore withdrawals at locations you visit frequently because you can't remember the last visit. If you have multiple credit cards and bank accounts, this may mean checking activity weekly or daily amongst many accounts- something you know is time consuming and likewise, so do the thieves in betting you won't detect the activity.

Card skimming techniques vary from installing cameras to capture key strokes to actually modifying or installing "dummy" card readers, capture devices and key pads to capture data from the magnetic strips and/or keypads. There is evidence this activity is now increasing worldwide and domestically and was the reported vector in attacks orchestrated towards customers at a number of grocery stores (Lunardi's locally) and in variations of attacks that targeted credit card capture and transmission at POS terminals at grocery stores like Hannaford on the East Coast.

Other than being observant of general quirks in ATMs and card readers (admittedly difficult these devices all look different,) the next best thing it to check your account activity regularly for events that either fall out of a pattern or don't match your receipts. If you bank or credit card company offers electronic alerts, sign up for those as well.

This is also a reminder that attacks are not just via email systems but are now via other interfaces which you have traditionally trusted. Thieves continue to try and get around traditional password and pin authentication structures by targeting other weaknesses in systems.