Consumers and Card Skimmers

The Consumerist has a brief writeup with some great pictures of the card skimmer that a reader found on a WAMU ATM. This sort of picture is an excellent way to help raise awareness - it looks quite persuasively real. As the reader notes, "there is a battery, flash memory card, and a mini USB port" on the back of the skimmer. Hopefully the police will set up a sting to catch the person who shows up to check the skimmer - if this were wireless it would be far more difficult to catch th perpetrator.

Cell Phone Jammers As A Skimming Control

Lets Japan points out that a Japanese bank has begun to deploy cellphone jammers near their ATMs to prevent skimming attempts that are increasingly using SMS messages from a cellular phone equipped reader device to phone home.

According to Lets Japan, "Chiba Bank installed phone signal-jamming devices at 4 unmanned ATMs at bank branches in the Tokyo metropolitan area Dec. 10. It is the first use of the device in a financial institution in Japan."

This isn't likely to occur legitimately in the US due to the Communications Act - the FCC rule can be seen here, and notes that, "Fines for a first offense can range as high as $11,000 for each violation or imprisonment for up to one year, and the device used may also be seized and forfeited to the U.S. government."

Good Disclosure Practices: RedBox announces a skimming exploit the right way

Skimming by placing a device on an existing reader to read credit card magstripes when they're swiped isn't new - it has been seen in the past at ATMs and other locations. It continues to happen, with varying levels of sophistication.

What is noteworthy is that Redbox reported it in a useful advisory including pictures of what the skimmers looked like - thus taking advantage of an issue to educate customers. They also show the attached blocks that help prevent identity thieves from attaching skimmers to the systems - addressing the question "what are you doing about it". The blocks are not a total solution, but they'll help prevent normal sized reader devices from being attached. Hopefully, monitoring the locations where the devices were found also leads to arrests.

Details of the discovery, and what the devices looked like can be found on Redbox's website at:
http://www.redbox.com/creditcardsecurity/