Beware of ATM Super Slimmer Skimmers

6 Feb 2024 · 3 min

Watch on YouTube

3:13

The Boston 25 News consumer report, hosted by reporter Jason Law, warns viewers about a new form of ATM fraud called "shimming" or "super slimmer skimmers." Unlike traditional bulky skimmers, shims are thin metal devices installed inside the ATM’s card slot, making them difficult for both consumers and banks to detect. The segment recounts a November incident in Washington State where thieves targeted three ATMs, using shims and tiny cameras to capture card data and PINs, then producing counterfeit cards for fraudulent withdrawals. Elaine, a victim, describes how $1,000 was stolen from her account after an ATM visit. Cyber‑security consultant Robert Siciliano explains the technical differences between shimming and skimming and why banks often discover the breach only after damage is done. Chris Hansen of the U.S. Secret Service illustrates the tiny components and pinhole cameras used by the criminals. The report also highlights how the Washington State Credit Union responded with advanced fraud‑detection software, account blocks, and collaboration with ATM manufacturers to retrofit machines. Consumer advice includes monitoring transaction alerts, considering tap‑instead‑of‑insert methods, and not being overly fearful, as such attacks remain relatively rare.

Chapters

Criminals are evolving and finding more sophisticated ways to steal your money. Super skimmers are now being used and they're pretty hard to detect.
Yeah, Boston 25 News consumer reporter Jason Law explains why you could be at risk even with the chip card and what you can do to protect yourself.
Scammers are everywhere and they're getting more advanced. Surveillance video shows the sophisticated new devices used by criminals. It's called a shimmer. In November, thieves targeted 3 ATMs in Washington State. We sped up this video so you can see the criminal act that was completed in about 1 minute.
It was a shock.
Elaine says she was a victim after a stop at the ATM. Her information was stolen and $1,000 vanished from her account.
I really have thought a lot about the idea that somebody had my information.
Shimming is much harder to detect.
Robert Siciliano is a cybersecurity consultant in Boston and CEO of ProtectNowLLC.com. He says shimming is much different than traditional skimming, which relies on a bulky overlay device that we've shown you before. Siciliano says the difference with shimming is that the device is installed inside the ATM. Most businesses aren't even aware they've been hit until it's too late.
Once the shimming device is installed, it's much harder for not only the, uh, consumer to recognize that there's an issue, but for the bank themselves to even know that their devices have been compromised.
We wanted to show you exactly what to look for. Chris Hansen with the U.S. Secret Service says the scammers used a slim piece of metal like this one inside those ATMs.
With the newer technology, of course, the components can be smaller and smaller.
Criminals harvest the stolen data, print fake debit cards, and then go on a spree at ATMs.
So this is— What we call white plastic, and you can encode the data onto this stripe.
And investigators say the thieves often use a tiny camera to steal your PIN number.
And so you can see the pinhole right here.
Many banks are trying to stay one step ahead of the scammers. The Washington State Credit Union, hit by Shimmers last year, now uses high-tech fraud detection software to catch unusual transactions.
That raises a red flag.
The credit union blocked those accounts, and they're working with ATM manufacturers to prevent more fraud.
They They now are working to find a solution to retrofit machines to address this latest technology. I don't want people to feel frightened to use an ATM, and certainly not at a financial institution. This is rare.
But Elaine says this experience has her thinking twice about using her debit card.
Yes, it is unnerving.
Our cybersecurity expert recommends you pay close attention to your debit or credit card activities. Set up a mobile alert on your phone so anytime there's activity with your account, you'll know right away. And above all else, if you have the option, tap your card instead of inserting or swiping it in the machine. That's the one sure way of avoiding the shimming trap. I'm Jason Law for your local station, Boston 25 News.