How does ATM skimming work?

Can you guess what kind of credentials it takes to purchase an automated teller machine online? If you guessed "none whatsoever," you're right! All it takes is a quick look on eBay to see ATMs for sale that anyone could buy. If the seller is irresponsible, the ATM could even retain a list of users along with their personal data [source: Siciliano]. Security flaws have been discovered in some older ATM models, and if they're not updated, it's possible to access their sensitive data with a default administrator password [source: Poulsen].

If hackers or skimmers gain access to the information stored on your debit card's magnetic strip, they may be able to make purchases without bothering to discover your PIN. ATM withdrawals require the PIN number, but online retailers don't need it -- and some of them don't ask for the debit/credit card security codes, either [source: Schwartz]. Skimmers who successfully obtain both your PIN number and debit information will transfer your data to a blank debit gift card, then use it at an ATM to make withdrawals [source: Schultz].

No matter how you look at it, ATM skimming is a serious problem. Between April and May 2009, a skimming operation targeted four Bank of America locations in Long Island, New York, stealing a grand total of $217,000 from 100 to 200 accounts [source: Gardiner]. And while it's important to be wary of skimming, keep in mind that banks like Bank of America will reimburse customers who find their accounts wiped out by thieves wielding skimmers and cloned debit cards.

If ATM skimming is so serious and high-tech now, what dangers do we face with our debit and credit cards in the future? The next evolution for credit cards revolves around RFID tags -- and those can be skimmed, too.

In 2006, a team of Massachusetts researchers built a simple device to read the data on RFID-equipped credit cards. RFID cards allow for a "tap and go" style of payment because the information is transmitted wirelessly. The worry, of course, is that data transmitted wirelessly can be intercepted or easily accessed from an outside source. The Massachusetts researchers were able to skim a name, card number and expiration date off an RFID credit card with their device, which they built with about $150 worth of readily available electronics [source: Schwartz].

Theoretically, a skimmer could build such a device and walk through a crowd, lifting information from nearby credit cards with RFID tags. But here's the good news -- the cards tested in Massachusetts were old, first-generation models with little or no security protection. Newer cards use encryption or transmit "dummy numbers" that are only good for a single transaction [source: Schwartz]. To date, there are no reports of RFID tag skimming. Of course, as RFIDs become more and more prevalent in credit cards, who knows what inventive skimming methods hackers will develop. Read on for more information on how ATM machines and how to protect yourself from identity theft.