How does ATM skimming work?


Skimming RFID Credit Cards
RFID cards allow users to "tap and go" when they pay because the information is transmitted wirelessly.
RFID cards allow users to "tap and go" when they pay because the information is transmitted wirelessly.
Getty/Thomas Cooper

In 2006, a team of Massachusetts researchers built a simple device to read the data on RFID-equipped credit cards. RFID cards allow for a "tap and go" style of payment because the information is transmitted wirelessly. The worry, of course, is that data transmitted wirelessly can be intercepted or easily accessed from an outside source. The Massachusetts researchers were able to skim a name, card number and expiration date off an RFID credit card with their device, which they built with about $150 worth of readily available electronics [source: Schwartz].

Theoretically, a skimmer could build such a device and walk through a crowd, lifting information from nearby credit cards with RFID tags. But here's the good news -- the cards tested in Massachusetts were old, first-generation models with little or no security protection. Newer cards use encryption or transmit "dummy numbers" that are only good for a single transaction [source: Schwartz]. To date, there are no reports of RFID tag skimming. Of course, as RFIDs become more and more prevalent in credit cards, who knows what inventive skimming methods hackers will develop. Read on for more information on how ATM machines and how to protect yourself from identity theft.

Related HowStuffWorks Articles

More Great Links

Sources

  • ADT. "ADT Anti-Skimâ„¢ ATM Security Solutions." (Oct. 6, 2010).http://www.adt.com/medium_large_business/security_solutions/solutions_by_industry?wgc=financial_institutions/anti-skim
  • ClarkHoward.com. "ATM skimmer scam back with increased sophistication." July 27, 2010. (Oct. 13, 2010).http://clarkhoward.com/liveweb/shownotes/2010/07/27/18931/
  • Gammon, Katharine. "ATMs by the Numbers." August 24 2009. (Oct. 6, 2010). http://www.wired.com/culture/culturereviews/magazine/17-09/st_atms
  • Gardiner, Sean. "$217,000 'Skimmed' From ATMs." June 9, 2010. (Oct. 5, 2010).http://online.wsj.com/article/SB10001424052748703302604575295082741170878.html
  • Krebs, Brian. "ATM Skimmers, Part II." February 2, 2010. (Oct. 5, 2010). http://krebsonsecurity.com/2010/02/atm-skimmers-part-ii/
  • Krebs, Brian. "Fun with ATM Skimmers, Part III. May 7 2010. (Oct. 5, 2010).http://krebsonsecurity.com/2010/05/fun-with-atm-skimmers-part-iii/
  • Krebs, Brian. "Would You Have Spotted the Fraud?" Jan. 15, 2010. (Oct. 5, 2010).http://krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/
  • McCullagh, Declan. "Security researcher demonstrates ATM hacking." July 28, 2010. (Oct. 4, 2010)http://news.cnet.com/8301-1009_3-20012019-83.html
  • Patton, Phil. "The Bucklands Boys and Other Tales of the ATM." (Oct. 6, 2010).http://www.wired.com/wired/archive/1.05/atm_pr.html
  • Poulsen, Kevin. "Former Con Man Helps Feds Thwart Alleged ATM Hacking Spree." May 4, 2010. (Oct. 4, 2010).http://www.wired.com/threatlevel/2010/05/thor/
  • Schultz, Jennifer Saranow. "How to Spot an A.T.M. Skimming Device." June 9, 2010. (Oct. 5, 2010).http://bucks.blogs.nytimes.com/2010/06/09/how-to-spot-an-a-t-m-skimming-device/
  • Schwartz, John. "Researchers See Privacy Pitfalls in No-Swipe Credit Cards." Oct. 23, 2006. (Oct. 6, 2010). http://www.nytimes.com/2006/10/23/business/23card.html?_r=2
  • Siciliano, Robert. "ATM Skimming Identity Theft Reaches $1 Billion in Losses." Sept. 9, 2009. (Oct. 6, 2010).http://www.huffingtonpost.com/robert-siciliano/atm-skimming-identity-the_b_280100.html
  • Siciliano, Robert. "NY ATMs Get Whacked: How Secure Are You and That ATM Transaction?" June 10, 2010. (Oct. 6, 2010).http://www.huffingtonpost.com/robert-siciliano/ny-atms-get-whacked-how-s_b_606019.html
  • Walters, Chris. "Here's What A Card Skimmer Looks Like On An ATM." April 19, 2009. (Oct. 5, 2010).http://consumerist.com/2009/04/heres-what-a-card-skimmer-looks-like-on-an-atm.html
  • Zetter, Kim. "Video: Bank Customers Foil ATM Skimmer." Sept. 24, 2010. (Oct. 6, 2010).http://www.wired.com/threatlevel/2010/09/skimming-video/

More to Explore