Security News > 2023 > August > “Grab hold and give it a wiggle” – ATM card skimming is still a thing
Ironically, perhaps, bank cash machines, better known as ATMs, make a perfect location for card skimming equipment.
ATMs almost always grab onto your card mechanically and draw it right into the machine, out of sight and reach.
Rather than improving security this made matters worse, because the crooks simply fitted a hidden card reader to the door itself, thus leeching the data from cards of all banks before any customers reached the actual ATMs. Furthermore, the crooks were able to use a hidden camera in the lobby, rather than glued onto any specific ATM, to watch out for users' PINs.
Like the abovementioned MOVEit attacks, where companies had their trophy data stolen without their own computers being accessed at all, these crooks recovered ATM card data and matching PINs for multiple different banks without physically touching a single ATM. In another case we know of, the crooks secretly filmed PINs at an ATM on a bank's own premises by placing their surveillance camera not on the ATM itself, which staff were trained to check regularly, but at the bottom of a corporate brochure holder on the wall alongside the cash machine.
Skimming devices are typically made to order, typically 3D-moulded out of plastic to fit closely over specific models of ATM, and adorned with any words, symbols or brand marks needed to match the ATM they're going to be attached to.
2023-08-03: Cybercrime detectives on watch noticed two men approaching the compromised ATM. We're assuming that the bank deliberately took the comrpmised ATM out of service, thus not only preventing customers from actively being skimmed, but also suggesting to the crooks that if they wanted to retrieve the skimmer, they should act quickly before the ATM was visited for "Repair" and the device found and confiscated.