Credit-card, debit-card risks grow as thieves 'skim' your numbers

Crime, Law and JusticeCrimeCyber CrimeBusinessTechnology IndustryTheftRestaurant and Catering Industry

Without a gun, without a knife, without breaking into the bank he preyed upon, a young man in a baseball cap and sunglasses stole thousands of dollars from clueless customers at an Orlando SunTrust.

When he thought no one was looking, police say, he placed "skimmers" — electronic gadgets that surreptitiously steal credit- and debit-card information — on at least three ATMs in Orange County in November. By the time one of the devices was discovered last month at the SunTrust branch on Kirkman Road, 59 card numbers had been stolen. Within six weeks, nearly $10,000 went missing from 17 accounts, investigators say.

The breach is just one example of a growing crime that costs an estimated $1 billion to $2.5 billion nationally each year, according to private market research and the U.S. Secret Service, which investigates skimming and other identity-fraud crimes.

Law-enforcement officers in Central and South Florida are seeing more of these crimes as increasingly sophisticated crooks discover this high-tech way to make easy money. Nationwide, skimming has risen 10 percent annually during the past three years, the Secret Service says.

Organized groups of thieves, some with ties to Eastern European gangs, employ a hierarchy of criminals from Web-forum administrators to vendors to buyers, said Jim Glendinning, assistant special agent in charge of the Secret Service field office in Orlando.

"There is tremendous potential for mass victimization," Glendinning said.

No business with a card swiper is immune. ATMs, gas pumps and restaurants are prime targets, said Lt. Dan Purcell, who supervises the Seminole County Sheriff's Office division that includes computer and economic crimes. But a hot-dog cart at Universal's Islands of Adventure, a Walt Disney World resort and the College Park Publix also have been victimized.

Similar cases of ATM fraud using skimmers have popped up across South Florida in the past year.

In July, police arrested a Delray Beach man after surveillance videos showed him tampering with ATMs at banks in Miami-Dade, Broward and Palm Beach counties. Police said he installed skimming devices that allowed him to pull information off customers' cards and use it to tap their accounts, ultimately taking $45,000. He had been arrested on similar charges in 2008.

Sgt. Jay Leiner, head of the Broward Sheriff's Office economic-crimes unit, said recently that ATM thieves have become increasingly sophisticated. BSO deputies once arrested a man who had ordered an entire ATM facade online, planning to swap it with one at an existing machine.

Another thief tried a different tactic, Leiner said. He rigged a hidden overhead camera at a Weston supermarket, then installed a skimmer into the ATM, allowing him to photograph users entering their PIN numbers while the skimmer stole their card information.

In a case still being investigated, two dozen skimmers with 50,000 card numbers on them were stolen by an organized-crime group, the Secret Service said. The thieves skimmed card numbers from gas pumps from Jacksonville to Orlando, then used cloned cards to buy gasoline and sell it to commercial construction sites in Central Florida, said Sgt. Kevin Stenger of the Orange County Sheriff's Office computer-crimes unit.

As criminals grow more tech-savvy, their profits are skyrocketing. The average bank robbery yields $4,500, said John Pearce of ADT Security Services, which manufactures anti-skimming devices. During the average skim, a bank loses $33,000, he said.

"It's very lucrative," Stenger said. "And it's also relatively low risk because white-collar crime is not punished like a crime of violence. Chances are you're not going to go to prison unless you've done it quite a bit."

Multiple methods

The scam works several ways. Hand-held scanners smaller than a pack of cigarettes, commonly used by crooked restaurant workers, can illegally swipe cards, and the information can be downloaded to a laptop. Card readers can be positioned inside gas pumps in seconds and can't be detected externally. Fake facades can fool ATM customers into unwittingly giving up their account information.

"Quite a bit of this goes on, and it is difficult to track," Stenger said.

The reasons vary. Often, groups of 20 to 30 people are involved, each getting a cut, law officers say. Those at the highest level typically own the equipment used to make counterfeit cards. Those lower on the chain buy the cards and use them to make purchases in the cardholder's name until the issuing bank catches on. It's tough to connect all the parties — and there may not be a direct connection, investigators say.

Scammers pay associates or dishonest employees to place skimmers from Miami to MetroWest and beyond. More-advanced devices can send card numbers via text message to bosses who could be sipping a piña colada on a distant beach, said Doug Johnson, vice president of risk management at the American Bankers Association.

Then there's the lag time that can occur between skimming and spending. By the time some customers realize someone has been dipping into their accounts, a billing cycle or two may have passed. At that point, the skimming device has long since been removed.

Another problem is that multiple jurisdictions are frequently involved, requiring a lot of investigative time, money and coordination.

Finally, many customers don't report the breach to law enforcement. Some don't realize they've been ripped off until their bank contacts them. Because banks are liable for the losses in most cases and reimburse cardholders, the financial institutions are considered the primary victims and often investigate on their own.

It's difficult to predict where the swindlers will strike. Like any business operators, they want the biggest bang for their buck, so they frequently choose high-volume locations, ADT's Pearce said.

"Bad guys don't care whether it's a big bank or a little bank as long as it's an ATM that can be compromised," he said.

The answer may lie in technology. In Europe, many cards use "chip-and-pin" technology: microchips instead of magnetic stripes, making it harder to steal information, said Michael Lee, chief executive of the ATM Industry Association. The cost of replacing or modifying readers and cards remains a deterrent to conversion in the U.S., experts say.

One simple weapon is a silent alarm such as the one triggered in December at a Regions Bank on Kirkman Road in Orlando when a skimmer was installed.

But with hundreds of thousands of ATMs, banks have to decide which machines are most likely to be exploited because they can't afford to install anti-skimming devices on all of them, Johnson of the bankers association said.

Some gas stations, where an unscrupulous former employee could use a stolen gas-pump key to open pumps at sites nationwide, are considering tamper-proof locks, site-specific keys and pump seals, according to Paul Elliott, assistant special agent in charge of the Secret Service in Jacksonville.

In the meantime, consumers' best defense is vigilance.

"It's your basic blocking and tackling you can do as a consumer to keep yourself from having the aggravation," Johnson said.

Staff writer Diane C. Lade contributed to this report. Susan Jacobson can be reached at sjacobson@orlandosentinel.com or 407-540-5981.

Copyright © 2014, Los Angeles Times
Comments
Loading