US Bankcard Services Industry Blog

Tuesday, July 5, 2011

NEWS for You: Thieves Swipe Debit Card Data

Thieves tampered with the retailer’s debit-card processing equipment at about 80 stores from Massachusetts to Washington, according to the chain’s corporate parent, Michaels Stores Inc. and in 20 states whose bank accounts were looted after they had used their bank debit cards at the retailer.

The thefts apparently involved the use of electronic devices called skimmers that allowed crooks to record information from shoppers’ debit cards and steal their personal identification numbers, or PINs. In Irving, Texas, company said Wednesday that it uncovered almost 90 improperly altered debit-card processing devices called PIN pads.

Thieves were able to use the stolen data to create duplicate debit cards and use them at automated teller machines to steal money directly from victims’ bank accounts, primarily in denominations of $500. The fraud scheme in early May after police departments around Chicago began receiving reports from consumers alleging their bank accounts had been looted, primarily from thieves using ATMs in California.

The company said it is working with federal and state law-enforcement authorities are working together with private companies and merchants. Some locations have been replacing all of its 7,200 card-processing terminals as a precaution. The U.S. Secret Service, which investigates financial fraud, said that it is investigating the Michaels incident. The scam resembles one perpetrated last summer at Aldi Inc. grocery stores in a dozen major cities across the country, and highlights what experts says is the growing appeal of debit cards to criminals.

Fraud involving debit cards, PIN numbers and card processing equipment has increased fivefold over the past five years, said Avivah Litan, a payment-fraud analyst at Gartner Research. While gangs initially targeted bank ATMs, such schemes have expanded to include card processors at gasoline pumps and now at retail chains.

A type of debit card embedded with a microchip instead of a magnetic strip is considered more secure and is standard issue in Europe. But U.S. retailers have resisted the cards because of the cost involved in replacing existing card processors to read the microchip.

To capture the cards’ PIN numbers, thieves often place tiny cameras, as small as pin heads, on the processors or install a membrane over key pads that can record keystrokes. In either case, a thief must have physical access to the store. The devices are typically homemade, put together by easily obtainable electronic parts, said Julie McNelley, a fraud and risk analyst at financial consultancy Aite Group, who recently attended a U.S. Secret Service presentation on debit-card fraud where the electronic devices were displayed.

Even the police in Plainfield, Ill., began receiving complaints earlier this month from consumers about strange transactions. They are set to meet with federal investigators soon to share what they have learned.

"It’s frustrating when you can’t really do anything for them other than direct them to the federal government," he said of local citizens.

"It is happening everywhere, and these financial criminals are becoming quite sophisticated in their methods."

How debit card skimming works

USBSI offers 24/7/365 multi-lingual support and fast merchant account approvals and assists with fraud prevention, please call us at 888-525-8558 or on the web visit US Bankcard Services, Inc. or drop us an e-mail.