Something new has been added to the credit and debit card scams that have been stealing hundreds of millions of dollars for several years from unsuspecting consumers. The scammers have gone high-tech.
Their new trick is called “skimming,” aimed particularly at debit cards. The thieves have devised equipment that can record your account number and other information from the magnetic strip on your card as well as your personal identification number when you punch it into an ATM or the card machine at a gas pump, hotel, restaurant or supermarket.
The clever invention has transformed card thievery from retail to wholesale. The original system was to capture a credit-card account number by stealing a carbon copy or overhearing a telephone conversation. The thief would then charge merchandise and resell it to a “fence” or on the Internet to get money. Debit cards, which withdraw money directly from a bank account, were intended to prevent theft by requiring the user to punch in the secret PIN as a safeguard.
Now that thieves can steal the account number plus the PIN, they can create counterfeit ATM and debit cards in your name and completely empty your bank account.
Consumer Reports, in its February issue, tells how to protect yourself against this new sophisticated scam:
First, don’t use a debit card and type in your PIN at the pump. Gasoline stations are favorite places for the thieves to insert their skimming devices. If you must charge your gasoline, use a credit card, which avoids using the PIN and provides better protection from liability in case of fraud.
Second, use an ATM at a bank. The magazine quotes a spokesman for the U.S. Secret Service, which investigates federal financial crimes, as saying that a thief must be able to retrieve a skimming device to get the recorded data. So he needs an isolated place with little traffic and no surveillance cameras.
Third, monitor your bank account, and try to do it frequently online, not just on the monthly statement. Federal law limits to $50 your liability for fraudulent charges, if you report the theft or loss of a card within two business days. But there still will be a hassle, and a worse one if it involves a debit card. In that case, you won’t get your money until the bank completes its investigation and determines that a fraud had been committed.
There is nothing hypothetical about this new threat. The thievery is going on right now. A major payment processing company, Heartland Payment Systems, disclosed Monday that 600,000 or more could have been victimized. Losses and expenses are estimated up to half a billion dollars.
The company’s president said that it uses cutting-edge encryption to protect data it sends to the card companies. But the thieves’ “sniffer” software, as he called it, had been able to steal the data before they were encrypted.
So check your bank account and guard your card and PIN.