I Found an ATM-Card Skimmer

I Found an ATM-Card Skimmer

I Found an ATM Card Skimmer

Overview

The device was attached to the ATM machine over the built-in reader. I didn't see any cameras on or around the ATM machine to capture PIN codes. Perhaps these guys are just getting in to the business.

Pictures

(click number to see image in flickr) 1.1 The first picture is just the plain ATM machine after the skimmer had already been removed. I wasn't about to put it back.2

1.2 What the normal reader looks like. Notice how it has a ring of LEDs around it and how recessed it is. The first sign of a skimmer is that the face of the machine is mostly flat but there's a large protuberance on it. Give that a little tug if you suspect something.

See also the residue where the Braille "Insert Card" sticker was that was relocated to the skimmer.

Note: Not all skimmers are as large as this one. See these Google results for lots of images of skimmers. Thieves are getting better at making them smaller.

2.1 This card skimmer is designed to adhere to the front of the ATM machine and skim the user's ATM debit card as it passes through to the real ATM card reader.

In the picture you can see a bit of the material they used to stick the reader to the ATM. It feels like a light-duty caulk. It doesn't have much sticking power. The device came off with just the slightest tug.

2.2 Notice the faux aging and the Braille "Insert Card" sticker they pulled off the ATM machine to add some authenticity. The crack with plastic substrate is what tipped me off. That and it's size.

2.3 The reader is pretty simple itself. The batter is still plugged in but you'll notice the no ring of LEDs.

3.1 The back of the skimmer.

3.2 The card reader with Micro SD card. I don't know what the little black buttons on the left do. Maybe reset switches. The black and white device on the right looks like a simple switch for cutting power to the device.

And no, I did not put the card in my computer or plug in the USB port. If this were my device, I'd laden it with an evil virus or trojan to deter tampering. If I could keep it I'd find a way to attach it to a computer. There's no way I wouldn't want to find out more. ;-)

3.3 The 720mah battery. That's about 1/2 the power potential of my cell phone. That's a lot a power for a simple device. Must be necessary for the reader and Micro SD slot.

3.4 The electronics. This is the part I'd like to get a close look of to see whether there are any identifiable ICs. Most likely, just bog standard Micro SD controller parts.

You'll notice there are two photos. There's an LED on the device that alternates between blue and red. It was not on initially when I pulled it off. It flashed like crazy for a while and then settled in to a steady state.

I don't see any obvious antenna so I don't think it's bluetooth enabled.

3.5 The USB port. Interesting that it has the USB port given that it uses Micro SD. Perhaps there's more going on that meets the eye.

3.6 The reader. Just a very simple reader. Your old Sony Walkman cassette player was ten time more sensitive and capable.

Footnotes


  1. The exterior of ATM machines looks like pot metal to me.

  2. Keep in mind, banks like Wells Fargo and Chase are not the problem. Thieves place skimmers on the lawful property of the bank to grab card numbers from unsuspecting patrons so they can then rob the cardowners of their lawful property, i.e, their money. Skimmers are crimes of opportunity. Today it's Bank 'A', tomorrow Bank 'B'.