ATM skimming and shimming: Is your fleet protected?

Over the years, financial institutions have developed quite an appetite for ATMs. Given their ubiquity, you might say ATMs are to FIs what potato chips are to hungry teenagers: virtually impossible to have just one. Indeed, according to recent polling conducted by ATM Marketplace, approximately 22% of banks these days have more than 2,000 machines in their arsenal.

This is largely because ATMs are as do-it-all-for-you as ever before, with new features like predictive maintenance, cash forecasting and remote teller assistance. Many of these functions weren't available as recently as a decade or so ago.

But there's one thing about ATMs that remains unchanged — they contain vast sums of money. This fact, combined with their omnipresence, has fueled a rise in theft.

FIs have long been aware of skimming activity, where thieves surreptitiously attach readers to ATMs in order to strip card data. The customer's card swipe is all fraudsters need to wreak havoc. Banks and credit unions subsequently combat this activity through various measures including video surveillance — in the vestibule and in the machine itself — for behavioral monitoring and expanded use of chip versus swipe cards.

What is shimming?

Shimming, however, is a fairly recent FI phenomenon and, according to Consumer Reports, shimmers are similar to skimmers in that they can be hidden fairly easily. What makes these devices more problematic is they can read data from chip-enabled debit and credit cards.

According to David Tente, executive director for the nonprofit ATM Industry Association, shimmers enable scammers to not only steal identities, but make unauthorized purchases online once they craft counterfeit cards with the same magnetic strips authentic ATM cards feature. Adding insult to injury, both skimmers and shimmers can be difficult to spot, even if you've seen them before.

"About half the skimmers out there are invisible to people who don't know what they are looking for, and even to some of those who do know," Tente explained.

ATM fraud up 10%

Despite more widespread use of surveillance technology and greater awareness of illegal activity around ATMs, scamming remains rampant. In 2017 — the most recent year for which complete data is available — the number of payment cards compromised at ATMs and merchants rose +10% from the previous year, according to FICO. That's a slower rise than in 2016, but a concern nonetheless, especially given the fact that FIs are expanding their ATM fleets. Indeed, approximately 30% of respondents in the ATM Marketplace study said they planned to add to their total number of ATMs in the coming years, and increase their branch count.

FIs are not alone

It's important to keep in mind that skimming and shimming are not limited to ATMs. It's also on the rise at the pump. According to the Florida Department of Agriculture and Consumer Services, at least 1,200 credit card skimmers have been removed from fuel service locations throughout the Sunshine State so far in 2019, ABC affiliate WWSB reported.

Florida Attorney General Commissioner Nikki Fried noted in a news conference earlier this year that she's experienced such fraud on multiple occasions.

"I have had my credit cards shut down three times because of something like this down in South Florida," Fried warned. "There are rings of these criminals around the state."

Advise consumers to look for red flags

How can banks and credit unions specifically protect consumers? Here are a few suggestions from security experts who spoke with Consumer Reports:

Advise consumers to physically touch the card slot before they slide their card through. Skimmers and shimmers are external devices, so if there's movement or it seems loose, account holders should avoid using it and speak to bank personnel.

Another tell-tale sign of tampering is a keypad that looks 'off' in terms of color. Consumers should therefore be forewarned to steer clear if the keypad looks notably different than the actual unit.

Account holders should also develop a routine of going online to see their transactions over the past 30 to 90 days. If anything appears out of the ordinary, they should contact customer service and take recommended steps per their financial institution.

Invest in cardless technology

Cardless ATMs are increasingly popular, largely because the technology makes it much more difficult for fraudsters to steal data, as there is nothing to read. Over 50% of respondents in the ATM Marketplace study said they will support cardless transactions and single use PINs in the coming years.

A version of this story first appeared on BranchServ's blog.