Skim deep

By Sarah Modlock

2 August 2005

I'm not sure what the Romanian is for 'Gotcha!' but I bet it would have come in handy when police snared the eastern-European card-cloning gang who netted £643,000. The arrests in February this year recently led to deportation and prison sentences totalling 22 and a half years for the five Romanian illegal immigrants who bled our cash machines after cloning 1,233 bank cards.

The gang of four men and a woman fitted false fronts and pinhole cameras to a number of cash machines across London. The camera captured the personal identification numbers (PINs) of unsuspecting customers while a skimming device built into the false front captured the electronic details of the cards. The information was then downloaded onto a computer and turned into counterfeit cash cards within hours. Scary huh?

The fraudsters then made rapid withdrawals from as many accounts as possible overnight. They were caught by a surveillance operation run by the banking industry-backed special police squad, the Dedicated Cheque and Plastic Crime Unit (DCPCU) following a tip-off from banks and cash machine network operator LINK, who had identified that a number of cash machines were being targeted.

The reason for sharing this tale of crime and punishment is to highlight the practice of 'skimming' and help you make sure that your bank account does not become a statistic on a police report (although I'm pretty sure the fun police would love to freeze my assets).

Skimming is the rather elegant term describing the theft of data from the magnetic strip on your bank or credit card which is then used to create a cloned card and withdraw funds from your account. In a smash-and-grab world, it takes several more brain cells and not a little patience to set up the technology which looks, sounds and works like a cash machine and raises no concerns for the customer while collecting valuable information. But as the figures illustrate, many see it as more than worth their while to take the risk.

False front

Bank customers have become used to checking for fake card slots placed over genuine units but the latest trend of fitting an entire false front can include intricately designed full-front panels with a slot for cards and one for receipts. To add insult to injury, some even carry credit card logos and have stickers warning against card fraud.

Examples of "false fronts"

Cash points - ATMs in modern parlance - are not the only targets though. Fraud is often carried out in restaurants, shops and petrol stations where someone on the thieves' payroll will swipe your card twice - once for the genuine transaction and once more through their special strip-reading machine. This is why we are always urged not to let our cards out of our sight. Many restaurants now bring hand-held payment machines to the table so that you can see where you card is at all times.

In the year to December 2004 fraud by skimming at cash machines grew by 85% and has been the fastest growing form of fraud over the last 18 months, says the Association of Payment Clearing Services.

When the long-awaited 'chip and PIN' system was rolled out, one of the many anti-fraud benefits it had was the way that card information was encrypted in the chip instead of the un-coded magnetic strip, making the new cards very difficult to copy. This should prevent skimming altogether but there is another problem. While some banks have updated their ATMs to read only the encrypted chip on a card when possible, other banks' ATMs read the un-coded strip regardless of the type of card.

'At the moment most banks are targeting their most fraud-prone ATMs for the trial of the chip reader,' says Sandra Quinn of APACS. 'Most fraudsters will try and withdraw cash just before and just after midnight, so that is the time of day most banks are trialling the chip-reading technology. Gradually the industry is switching to machines which only read the chip where one exists,' she explains.

It doesn't look likely that ATMs will all be modernised until every single credit and debit card in the UK is chip and PIN. In the meantime I don't think it's cynical to imagine that banks will want to cover their loses by raising charges. After all, someone has to pay. The Banking Code protects customers if a fraudster has cloned their card and swiped their cash, although the process can take weeks to sort out and can be maddening - especially if the theft pushes the customer over their overdraft limit, automatically incurring bank charges and leaving them without money.

Customers who query charges on their account are asked to sign a declaration form specifying the transactions for which they are not responsible. To deter people from falsely claiming they are fraud victims, banks insist on thoroughly investigating transactions the customers deny are theirs. So don't reach for your bank's fraud hotline unless you are sure you didn't make a drunken, late-night withdrawal for another quick round of Champers and a curry. Equally, if you say you were in Wiltshire when cash was withdrawn in Cheshire they could well ask for receipts or mobile phone records to prove your whereabouts.

Protect your plastic

You may be in a hurry or have other things on your mind when you use an ATM but aim to pay careful attention to the machine to avoid being duped by a false front. Until technology can defeat the criminals, it's essential to use your cards carefully:

•  If an ATM appears to have been tampered with then don't use it and report it to the bank.

•  If the machine does not return your card, report it to your bank immediately.

•  Don't be distracted by anyone around you and shield your PIN when you punch it in.

•  Never let your card out of your sight in shops, restaurants and petrol stations.

•  Check your statements and credit records carefully for signs of fraud.

•  Cut up any unused - or 'sleeping' - credit card accounts which could be the target of thieves.

Avoid using ATMs in Banbury, Oxfordshire. The pretty market town became the skimming capital of Britain after APACs revealed that every one of the 28 cash machines in town had been targeted by thieves since February.