HOWTO protect yourself from ATM skimmers

Brian Krebs, who has written many excellent investigative pieces on ATM skimmers, spent several hours watching footage seized from hidden skimmer cameras, and has concluded that covering your hand while you enter your PIN really works in many cases -- and that many people don't bother to take this elementary step.

Some readers may thinking, “Wait a minute: Isn’t it more difficult to use both hands when you’re withdrawing cash from a drive-thru ATM while seated in your car?” Maybe. You might think, then, that it would be more common to see regular walk-up ATM users observing this simple security practice. But that’s not what I found after watching 90 minutes of footage from another ATM scam that was recently shared by a law enforcement source. In this attack, the fraudster installed an all-in-one skimmer, and none of the 19 customers caught on camera before the scheme was foiled made any effort to shield the PIN pad.

Krebs goes on to note that this doesn't work in instances where the skimmer includes a compromised PIN pad, and it seems likely that if covering PINs became more routine that crooks would take up this technique more broadly. But for now, covering your PIN with your free hand is a free, effective means of protecting yourself from ATM skimmers.

A Handy Way to Foil ATM Skimmer Scams

• [Rock Hardwood]

  Waiting for some hipster crochet flip attachment for your sleeve to get featured on Boing Boing.

  Bonus points if it looks like a skeleton’s hand, or something other than just the top of a plain mitt.

• [dragonfrog]

  As has been pointed out before (somewhere?  Maybe via Schneier?), a fundamental flaw that allows the ATM skimmers to work is that every different bank and convenience withdrawal ATM company uses a different ATM design, with crazy knurls, whorls, flanges, bumps, divots, light-up panels, protruding widgets, etc.

  Try a google image search for “ATM” – ask yourself how you would recognize a skimmer that was minimally competently designed (used the right colour scheme, basically) attached to one you’re unfamiliar with.

  If ATMs were universally flat – no raised edges, bevels, indents – any skimmer attached to the face around the card slot would immediately stand out as unusual. Banks could do this, but they don’t, even though it would be effective. Instead we get advice that the banks know is perfectly useless, as 99.9% of their customers won’t follow it.

  • [Mark Duanburge]

     Conversely if atms where universal in design then it’d be easier for the thief to make a universal skimmer.

    • [dragonfrog]

      Possibly – though they could conceivably be non-universal, but also not full of logic-less nooks and crannies to help camouflage skimmers.

• [mikekstar]

  When are we going to get serious about ATM fraud and implement chip & pin systems like they use in Europe? 

  Also, another simple and free method you should do before using any ATM is to give the cowling surrounding the card slot a good tug before you insert your card.   

  • [Restless]

     This doesn’t help for the newer in-slot skimmers, unfortunately.

• [emacsomancer]

  That’s fine – they’ll just skim them from your brain then: http://www.schneier.com/blog/archives/2012/09/hacking_brain-c.html

• [theophrastvs]

  Why did the skimmer designer include audio?  just to pick up the self-confident whistling?  (“ey ralphie! ifurget, what’s my pin number again?!”)

  • [Spezz]

    Because dumb people have to quietly mouth the numbers as they type them.

    • [Antinous / Moderator]

      Or in my case, loudly hum Old MacDonald had a farm…

      • [echolocate chocolate]

        Hey everyone, Antinous’ PIN has a zero or a seven in it!

        • [Antinous / Moderator]

          No. You didn’t get it. Sing the song.

        • [echolocate chocolate]

          Old MacDonald had a farm,
          five-six-se-ven-eight

          No? OK, you are too smart for me.

  • [Adela Doiron]

     Some key pads have a unique beep tone for each number.

• [Adela Doiron]

  Or just not use ATMs. Plan out your finances and banking so that you can just go to a teller during normal hours for cash the old fashion way.  The amazing thing about being low income is I can’t afford to just withdraw a twenty randomly.

• [DataShade]

  Wasn’t there an article where some of the cameras use thermal vision and would check for heat signatures left after you pressed keys?

  So cover and maybe hold your hand down over all the keys for a second before you lift your hand away.

• [Kevin Liske]

  I use the technique spreading the palm and fingers of my right hand over the keypad and then using my index finger and thumb to hit the keys.  Not perfect, but obscures a great deal.

• [McGreens]

  Hang on, drive-through ATMs? Seriously?

  • [Will]

    Just what I was thinking. WTF, does america seriously have drive-through ATMs?!

    • [Antinous / Moderator]

      Funnily enough, they take up less space than a parking lot.