The latest on ATM card skimmer tech

[thewayne]

Good ol' Brian Krebs. In New York City, NCR and an unnamed financial institution have uncovered the latest generation in card skimmers. A card skimmer is a custom-made device that credit card thieves insert into AMERICAN ATMs (this is almost 100% an American problem because we won't get rid of the stupid magnetic strip and go to entirely chip-based cards) that has a strip reader and is inserted into the card reading slot of the ATM, so that when you insert your card into the machine, it captures the data on your bank card. A very cleverly-disguised card then captures your PIN that you almost never cover when you enter it. It's all stored in memory, then the thieves come by later with a Bluetooth transceiver, beam a code to the device, and it spews all the captured data back to them and clears itself.

These have been around for years and are most commonly found at stand-alone ATMs and at gas pumps. So what is new about this?

IT IS 0.68 MILLIMETERS THICK!

That is some pretty impressive engineering and manufacturing to make a skimmer that thin! To give you a comparison, your bank card is approximately 0.54mm thick.

NCR has some countermeasures to improve detection of these skimmers, but the best thing as always is to simply cover your hand when entering your PIN.

https://krebsonsecurity.com/2022/09/say-hello-to-crazy-thin-deep-insert-atm-skimmers/

Comments

[thewayne]

And that's the thing - it is entirely a USA problem because of Visa and Mastercard refusing to get rid of the magnetic strip!  Best way to safeguard your against any skimmer is to take your cards to a magnetic bulk eraser and wipe the strips!  If you run into a terminal that doesn't take strips, make sure you have a very large purchase and tell the merchant "Sorry, you need to update your equipment so as to protect your customers from theft."

[silveradept]

Which might make a point against large entities that can afford to upgrade their systems, but I suspect the article is right about a lot of smaller operations not necessarily being able to upgrade their equipment to take chip and contactless methods.

Of course, if I recall correctly, contactless payment cards are supposed to be vulnerable to NFC readers or something like that, which would also be an issue if card numbers are being stored anywhere in the card in plaintext, except for the physical numbers on the card.

[thewayne]

There's a sandwich shop in my VILLAGE OF 800 that uses a contactless chip reader from that outfit that spun off from Paypal.  It doesn't have to be outrageously expensive.  The credit card companies are being greedy and would rather eat the expense of card fraud than underwrite upgrades and save people headaches.  I don't know about NFC sniffing, I'm not sure about that tech because you need a two-way connection to read the crypto certificate embedded in the chip.  It's a passive chip that needs a field to get it to engage in communications.