An ATM skimmer, deconstructed.

You've probably heard the warnings about ATM skimmers, the little devices that can be put on an ATM to read your mag stripe and capture your account info.

This blog in the Netherlands has taken an ATM skimmer apart and shows in detail how it's put together. I thought I'd be able to spot a fake, but it's scary how real it looks. AT the ATM, look for anything out of the ordinary, such as mismatched paint, scratches, and ill-fitting components. If it looks like your cousin Larry made it in his garage, then it's suspicious. Luckily, ATMs serviced by banks have little chance of being hacked this way. Amazing that this one seems to be located on a street.

Click on each picture for a clear, larger version of the image.

Here's a picture of the device removed from the ATM:

and this is a closeup of the faceplate:






There's a tiny camera mounted inside of it. The aperture is where the man's middle finger is. While it swaps your magnetic stripe info, it also captures your fingers keying in your PIN.



See the camera lens hole?








And here's a shot of the ATM with the fake piece in place. Scary, isn't it? If you can read Dutch, head over to the original blog, which you can find here, as well as photos of the gadget's guts.

Positive Pay - Is it enough in these times? In the end, who gets hurt, really?

In these unprecedented times in banking, financial institutions now more than ever are reassessing relationships and in many instances, resetting the terms and lowering their risk with certain customers. In fact many financial institutions are demanding that certain customers change the way they do business.

Here's a scenario that the bank and company are trying to avoid; Outside a check casher, a fraudster waits for an innocent customer to arrive. The fraudster says, " Hey mister, there's a long line in there and you don't have all the time in the world. Let me cash this check for you. In fact, I won't charge you. I'll stay here and cash it with the rest of my checks." The innocent transaction takes place and the customer is on his way with cash in hand.

Meanwhile the fraudster takes the check, copies the check's microcoding with the company's bank and routing number. After a quick trip to the office supply store to purchase blank check stock, he then creates several other checks using the company's bank information. He hires a few people or in some cases, dozens of people to cash the fake checks all over town. He takes his 'profits' and hits another innocent person and company.

So who pays for this scam and the loss of thousands of dollars? If the checks clear through the banking system, the company typically ends up 'holding the bag' and absorbing the losses.

To curb this fradulant activity, banks offer a popular service called Positive Pay. From the Wikipedia definition of Cash Management "Positive pay is a service whereby the company electronically shares its check register of all written checks with the bank. The bank therefore will only pay checks listed in that register, with exactly the same specifications as listed in the register (amount, payee, serial number, etc.). This system dramatically reduces check fraud."

A bank's Cash Management Services organization is typically responsible for educating, selling and providing a Positive Pay solution to its customers. Once implemented many of the problems of check fraud disappear. But is the company totally out of the woods? What if this same fraudster hits again?

While it is true that fraudulent attempts may continue in some form, at least the bank and company are protected. With Positive Pay fraudulent checks are returned to the merchant. It's the grocer, check casher, liquor store or merchant that has decided to take the risk to cash the check. They then take the loss in this case. Somebody has to pay.

But there is more to the story, particularly for low income people. The 'unbanked' also takes the hit! Why? Because when the merchant cashes a fraudulent check from a company, the next man to attempt cashing a check may be turned away, or to make matters worse, paying an exorbitant amount just to get his hard earned paycheck cashed. Ultimately, who gets hurt, really?

And so while on the surface the company and bank have reduced their risk, what have they done to their workers, the individuals who are now paying more to get their checks cashed?

Companies must consider the ramifications of Positive Pay to the entire 'food chain' of payments. Some have looked to Directo paycards to help mitigate the risk and help their workers. Again, in the end, without a program like Directo, who gets hurt, really? Your workers, and you.

BH
http://www.directocard.com/

Debit Card Skimmer

Recently I picked up a news video clip online from Yahoo News that illustrated how easy it was to steal debit card information using some slick technology. see video . The reporter does a great job reporting on the problem.

She also points to the problems with the recent hacking of RBS Worldpay's systems, whereby sophisticated scammers stole identification information and replicated customer's debit cards.

We all need to be careful about how and where we use our debit cards. The Directo paycard program instructions teach customers how to be careful. Our payroll card system processes and personnel protect customers at all time.

But you can never be too careful where you use any debit card.

- BH