Stealing debit card information using "skimmers" at gas pumps and ATMs is an old problem. But thieves are becoming more sophisticated at hiding the devices and getting around some of the fixes merchants have put in their way.
Among the newest tools are deep-insert skimmers, which disappear into the payment device card slot. Skimmers—electronic devices that thieves insert into ATMs and card readers—can record data stored on the magnetic stripe on the back of your debit card.
These newest skimmers are placed deep inside an ATM, behind the shutter of a motorized card reader, and are completely hidden from the consumer. Thieves often use them along with tiny cameras or other devices to capture cardholders' personal identification numbers when they punch them in on a keypad.
"As the last few years have proven, skimming technology and know-how have improved and are more accessible to the general population," says T.J. Horan, vice president of fraud solutions at FICO Card Alert Services. "So we will continue to see increases in compromises and the speed at which they occur."
A study this week from FICO Card Alert Services shows just how big a problem this sort of theft has become. FICO reported a 70 percent increase in the number of debit cards that were compromised in 2016 at ATMs and at card readers used by merchants. It also reported that the number of card readers at ATMs and merchant devices that were hacked rose 30 percent.
Consumers most at risk for debit card theft are those who use nonbank ATMs, such as the ones in convenience stores, and those who make purchases at out-of-the-way merchants, such as remote gas stations, says Michael Betron, a FICO senior product manager.
In addition to using skimmers, thieves also obtain debit card information by installing data-stealing software in card readers and through data breaches, where they hack into the main computer systems where card information is stored.
Some merchants may be able to catch thieves when they return to retrieve the skimmers. But newer versions can transmit data wirelessly to thieves, who then make duplicate debit cards to withdraw cash at ATMs or to make purchases.
If data is stolen from your card, you could find that your debit card was used to make unauthorized purchases or withdrawals from your bank account. The faster you act, the better. Depending on how quickly you notify the bank, you could be responsible for $50, $500, or the whole amount.
“People really need to pay attention," warns Katherine Hutt, a spokeswoman for the Better Business Bureau. "We have convenient access to our money 24/7, but so do scammers."
How to Protect Your Cards
Because it can often be impossible to detect whether a skimmer has been inserted into the card reader you may be using, consider taking these precautions:
Don’t use remote ATMs and point-of-sale terminals. ATMs that are in low-trafficked, poorly lit areas are vulnerable to being tampered with by thieves. So are gas pumps that accept credit cards at stations far from major highways. The safest ATMs, says Owen Wild, director of marketing for security solutions at NCR Corporation, are the vestibule and drive-up machines at your bank. But skimmers have been found even in some of those, he says.