takehome:
To skim your card, they need to copy the mag strip and get your pin. Therefore:
- Cover your fingers when you key in the PIN. Be especially wary of privacy covers that cover your fingers.
- Try to only use the ‘chip and pin’ chip: avoid putting your card in a device that takes in the entire card.
Sometime in 2018 or so I received a WhatsApp message reporting a friend’s card had been skimmed at a specific ATM. I was between projects, so I drove out to take a look. Note that the image above was taken some time later, after I realised I only had close-ups.
I was initially skeptical, as my understanding was that a card skimmer would be some kind of ‘front end’ placed over the machine. I recognised the design of this ATM (I use others with the same bank), so I was initially very skeptical.
It was only when I touched around the slot that I could feel a rough edge that did not seem right and later found I could lift up this part with my finger nail. I think the visible part of the skimmer is translucent plastic that picks up the green colour from the surrounding lighted plastic - but could be wrong.
The give-away is the cracking in the plastic - maybe from solvents in the glue they used, or from having to force the slot open to get the skimmer in.
Also the imperfect edge of the skimmer inside the more exposed part of the slot is (barely) visible.
Next part is they need to get the PIN as well. Took me a long time to find it but should have been obvious that there is only one place the camera could be.
I thought the long grey part was correctly part of the ATM (and the bank staff I brought said it was) but it’s not. I think it provides cover for a battery and electronics, and is unnecessary as part of the finger cover for the ATM.
Definitely this finger-molded region is not standard equipment, so that is the other give-away.
Here they had to colour match the rest of the material and did a good job to my eyes. Still hard to tell that the longer section is part of the skimming system given where the rough edges are.
Above are photos of the finger guard some months later, with the skimmer removed.
The ‘chip and pin’ system is better because the reader presents a challenge that the chip must process along with the PIN and generate the correct result electronically. No skimmer will copy that circuit in the time to make a purchase, but copying the mag strip on the back is trivial.
The take-homes for me are
- Don’t accept ‘normal wear-and-tear’ around the card slot without a closer look and a good prodding feel.
- Be especially wary of ATMs with the convenient finger cover as they provide a great place to hide a camera.
If you covered your fingers with another hand (like they tell you to but I didn’t before this) that would likely solve the problem completely.