Federal Prosecutors have charged two men with skimming a BECU ATM in Ballard. According to Seattlepi.com, Ion Armeanca, 44, and Dan Petri, 34, doctored the machine to steal account information and personal identification numbers (PIN) on November 30th. A Secret Service agent speaking at court is documented as saying the skimmer was set up on the 900 block of NW 45th St, Seattlepi.com is reporting. The agent told the court that the skimmer was set up for two hours and 14 accounts were compromised at a cost of $14,000.
The agent described the skimming scheme to the court, Seattlepi.com reports, explaining that a fake faceplate is placed over the card reader of the ATM with a device that can store information on the card’s magnetic strip. The suspects placed cameras above the keypad to capture the customers’ PINs. (Thanks Kurt and Tomas for the tip!)
900 block of NW 45th St can only be the BECU ATM outside the main entrance to the Fred Meyer.
I’ve had this happen to me before. From the sounds of it, it’s a fairly common occurrence.
Scary stuff. I bet the true cost is much higher than 14k if you count what the victims have to go through to clean up the identity theft repercussions.
I always hold one hand over the key pad when I input my PIN…. but I wonder if that works. It should block a camera view, depending on where the camera is positioned, but wonder if they have technology to detect the key logging… From the story, it sounds like these thieves didn’t, but anyone know if others do?
In order to keylog they’d need access to the innards of the ATM, which is much harder. 90% of these schemes are done with the faceplate over the card reader and a camera.
skimming actually involves installing a small piece of hardware over the card swiper to collect the numbers and PINs. one it’s installed, there is nothing you can do to stop it other than not use the ATM until the bank detects it.
a friend of mine who is a bank manager told me that skimming is very common on redbox video rental machines.
The ATM cards do not have the PIN on them, that is why they need the camera to capture you entering it. So always cover your hand when entering your PIN. Then it doesn’t matter if they steal the mag strip info from your card. Also note that now places want the “Security Code” from your credit card, printed on the front. That is because it also is not in the mag strip data and proves you have the card on you or at least have seen it and remembered it. Another thing you can do to slow them down is put a daily limit on how much cash can be taken at once from your account, like $200. You can change it online anytime if you need to.
I was one of the 14 accounts!! I am so glad to read this post–BECU contacted me concerning “multiple attempts to withdraw funds” a couple of days after this. The guy in front of me in line was taking forever and seemed fishy to me, but with ATM etiquette I didn’t stare. As soon as BECU contacted me it clicked into place and I knew he was the one who stole my information. Luckily (and thanks to BECU), nothing was ever successfully removed from my account.
Huh? Not sure which ATM machines you are talking about. Info from the ATM is transmitted over the Internet in encrypted form to a central (maybe regional) data center for authentication. The ATM does not store information itself, only cash. And any computer system acceptable to any government audit will not record passwords in a log. Duh! They are only used for authentication purposes. The user ID contact itself is recorded and what was done, but passwords are never stored except in the security file to compare to the one the customer is entering at the time of access. Not to mention there is an encryption key known only to the bank and even it is not stored on the ATM. The central computer passes that to the ATM to use so data is encrypted before transmitting it over the Internet. Only the central computer knows the encryption key it is using and it is dynamic, changing every time it communicates with the ATM. They are really tough to crack.
I will say this… BECU is great about catching fishy account activity! my husband’s debit card number was stolen and reproduced on a card in FL, and as soon as tehy started using it, they called us and we caught it right away!
As much as i dont like the idea of them keeping an active history on when and where we use our cards, it is comforting knowing that they are able to see unusual activity almost immediately!
These people should get the chair.
The tickle chair?
Exactly, meaning just tapping the ATM comms won’t work since it’ll all be encrypted, they’d need access to the physical keypad in order to keylog anything.