British police have uncovered the latest security threat to ATM cardholders, a threat so simple from a thief's perspective that it's pretty much guaranteed to come to America — if it hasn't already.
Security-savvy ATM users have known for years now to watch out for illegal “skimmers” — electronic devices placed over a legitimate ATM-card reader to steal personal identification numbers (PINs) and other information from any swiped cards.
Many of these skimmers are small and thin enough to escape a typical ATM user's notice (unless that sharp-eyed user knows exactly what to look for) — but a thief hoping to use a skimmer generally needs either technological ability sufficient to build his own, or criminal “connections” sufficient to buy one.
However, as Security Affairs reported yesterday, the latest criminal threat to ATM security has no such barriers to entry. An off-the-shelf iPod hidden behind a panel with a pinhole drilled in it is all it takes to make a pinhole spy camera capable of recording the PINs of anyone who visits that particular ATM.
Though there's a little more to the scam than that. Apple's iPods have been on the market for years, but only last January was the first such incident of this particular iPod-based ATM spy camera scheme discovered in Gatley, Stockport (a suburb of Manchester, England). As the oft-sensationalist Daily Mail reported last January:
These pictures show the lengths criminal gangs are going to in an attempt to steal card details at ATM machines - as a trick of using hidden iPods as spy cameras continues to spread.
It involves strapping the musical device to the roof of a cash point and setting it to record video of a person inputting their personal identification number (PIN).
The iPod is concealed in a specially-designed fascia with the camera recording through a pinhole-sized gap.
A fascia is simply a long, thin board covering the area where a wall joins a roof or ceiling — the architectural equivalent of a beveled edge, more or less.
So long as the thief has a few minutes of privacy, it's very easy to attach an iPod to the roof or upper wall of an ATM cash point, hidden behind a fascia of the same color. After installing this hidden camera, the fraudsters then slip a thin piece of plastic into the actual ATM card slot.
Now they're ready to pull their scam, which works like this: a victim walks to the ATM, inserts his card and types his PIN, unaware of the hidden camera recording this information. Meanwhile, that piece of plastic in the card slot traps the card inside the ATM. So the victim can't get his card out of the machine, and eventually leaves – most likely to contact the bank and complain about a faulty card-eating ATM.
Once the victim leaves, the thieves go to the ATM, retrieve the card from the slot and the PIN from the video recording, and use these to withdraw cash from the victim's account.
When British police discovered such a setup at a Barclays ATM, they immediately removed the device and informed Barclays, which in turn urged its customers to keep a sharp eye on their accounts and immediately contact the bank if they notice any signs of fraudulent activity.
And if you're an American ATM user, regardless of who you bank with, you need to do the same thing.