In a sure sign that identity thieves are developing more sophisticated techniques, dozens of debit card holders from at least three New York banks have found that money was improperly withdrawn from their accounts, but that their cards never left their wallets.
The thieves, who are still being sought by state and federal law enforcement agents, apparently used devices at nonbank automated teller machines probably at small markets and convenience stores, authorities say that skim the information from a cards magnetic stripe and simultaneously record the customers personal identification number, either with a hidden camera or a false cover on a PIN pad.
Spokesmen for Citigroup Inc. and J.P. Morgan Chase & Co. confirmed that some customers have fallen prey to this scheme, and Dime Bancorp also said some customers may have been victims. Chase and Citi spokesmen said the companies are working with law enforcement to catch the thieves who appear to be working as a sizable crime ring and will restore any money stolen from customers.
According to the New York Post, which broke the story over the weekend, millions of dollars have been stolen by a group of coast-to-coast identity thieves who skimmed information from debit cards, looting some cardholders accounts of as much as $15,000. But the report suggested that police were close to capturing the thieves, adding that authorities, coordinated by the Secret Services Financial Crimes Division, have been tracking the problem for more than a year, when it first cropped up outside New York City.
We were notified by the authorities of an alleged fraud scheme involving certain nonbank ATMs, said Cathy Keary, a spokeswoman for J.P. Morgan Chase. We have identified a small number of our customers who may have been affected, and immediately blocked those accounts and notified the individuals. We are fully cooperating with the authorities on this investigation and will continue to monitor account activity.
Mark Rodgers, a spokesperson for Citigroup, said: We and other banks are aware of some isolated discrepancies and we are working with law enforcement authorizes in their investigation. Were working with any customers who may have been affected to resolve the issue as quickly as possible. We regret any inconvenience our customers may have experienced.
But it appears that fraudsters are getting more clever in stealing peoples card information particularly their PIN codes.
Reginald Berry, the director of product management for HNC Software Inc. in San Diego, said that the rigging of ATMs is a worldwide problem and has become very hot in the last two or three years.
In the early days of card skimming, Mr. Berry said, fraudsters would place a false card reader over the normal slot. They would also use a camera to record the cardholders PIN. But this technique was far from perfect, because they would have to match each cards information with the correct PIN.
And the technology was cumbersome, Mr. Berry said. For example, when a card was ejected from a machine, the customer might have noticed that the card was more difficult to remove.
More recently, Mr. Berry said, thieves have developed skimming devices that are more elegant in terms of design, so they look like they belong on the ATM.
Fraudsters can now place exact-duplicate PIN pad overlays over actual PIN pads. This device is made very thin, Mr. Berry said. And within it is a transmitter and a chip to record the PIN. So when the cardholder presses down on the PIN pad, both the overlay and the actual PIN pad record the PIN. The transaction goes through, but the cardholders information is recorded on the false PIN pad and immediately transmitted to the thieves.
The fraudsters then fabricate duplicate cards with the cardholders information and use the copied PINs to withdraw cash at other ATMs, Mr. Berry said.
