ATM Security : Would You Have Spotted the Fraud?

[radhak]

Something to keep in mind - seems to be a easy fraud :

http://www.krebsonsecurity.com/2010/...ted-the-fraud/

[dbhost]

Do the banks or the feds actually prosecute the folks that are committing these crimes?

[radhak]

Do the banks or the feds actually prosecute the folks that are committing these crimes?

If they catch them! Of course the fact that they seem to be advertising on YouTube should make it easier...!

[Alex Franke]

Here's a related story from last year -- you have to be pretty sure of yourself to place one of these at hacker conference. :-o

http://www.wired.com/threatlevel/200...tches-hackers/

[herb fellows]

Hmmmm.... The only thing he mentioned about spotting one is an off color piece of plastic.
However, the one shown is perfectly matched in color. So there is no way an individual would know, as far as I can see.
It would seem using one in a public place where it would be harder for the crooks to change it over would be your only 'defense'. Presumably it takes a while to make the change to the phony one. Does anyone know any different? Scary stuff, IMHO.

[vaking]

Yes, banks do prosecute for ATM and credit card fraud and they do take measures to catch those that try. For starters - ATMs have cameras installed by banks and they take pictures of everyone walking over to the machine. So it is very likely the person installing such card reader will get on the camera himself/herself before he even gets his first card number.

[crokett]

Vaking, how often are the tapes reused? Just because the person installing the reader gets himself on camera doesn't mean anybody will see it.

[woodturner]

Vaking, how often are the tapes reused? Just because the person installing the reader gets himself on camera doesn't mean anybody will see it.

Many banks use digital cameras and systems now, and the digital recordings are archived for at least a year, often much longer.

Nonetheless, there is always a risk when using ATMs, and debit cards and ATM cards do not have the legal protections provided for credit cards. Some banks do voluntarily offer similar protections, so it pays to "shop around".

Personally, I don't use ATMs, because in my opinion there is no way to make them absolutely safe. In this cashless society where one can purchase nearly everything with a credit card, I rarely even carry cash anymore. I pay for everything by credit card or online bill pay. On those rare times I do need cash, I go to the teller at the bank.

[os1kne]

Many banks use digital cameras and systems now, and the digital recordings are archived for at least a year, often much longer.

No matter what type of recording system the banks use, it is a recording system (not live-monitored by a human). They'd need to have a good idea of the date/time that the skimming device was installed in order have a shot at catching the person. The skimming units appear able to be attached/detached to/from the ATM in a matter of seconds - so someone would need to closely monitor the video to even notice.

Depending on the location of the ATM and the skill of the people that fill/maintain the ATM, one of these units could go many weeks without notice. If someone were to know the schedule/frequency of the ATM filling/maintenance - they could simply remove the unit prior to filling and reinstall it after. With the wireless transmitters that are built into these units, the bad-guy will be difficult to identify/catch even if you discover the unit.

[herb fellows]

Wait a minute. This thief is 'smart' enough to do this, do you think he's going to pose for a picture? Going out on a limb here, but I believe he would be smart enough to either hide his face or disguise it, so to me any recording device is worthless.
Woodturner, I'm 180 degrees from you. I use atm's, but I don't do online banking, because I think that is riskier. I guess they're both risky, it's just a matter of choosing your poison, or avoiding it altogether, which is probably the smartest thing to do.

[sparkeyjames]

I use atm's only from my own bank. They are built in such a manner as to make placing a card reader over the slot absolutely obvious to anyone who has used one of the banks atm's in it's "normal" as installed configuration. As for online banking I use it often (as in daily) and have no qualms about doing so. I use a fairly secure OS (Linux) with Firefox in it's private browsing mode. Under no circumstances do I use Windows or Windows plus a Microsoft browser for anything involving a password. In my opinion you have to be crazy to do so given the many thousands of ways a Microsoft OS and browser can be hijacked. The only thing under windows I have that has a password is Steam (valve software) for a lot of my games and only then because it does not effectively run under Linux. If done with the utmost care online banking is extremely safe.