In this interview, Cambridge police alert the public to a series of ATM skimming incidents that stole money from at least seven victims in the Central Square area between November and January. Security expert Robert Siciliano explains how criminals attach a façade skimmer over the card slot that reads the magnetic stripe and install a hidden camera that wirelessly streams PIN entries to a nearby laptop. The stolen card data is transferred onto blank cards and used to withdraw cash in distant locations such as New York City and Las Vegas, quickly exhausting victims’ accounts. Siciliano advises users to cover the keypad with their hand while entering PINs, monitor accounts daily via mobile apps or statements, and watch for unauthorized withdrawals. He notes that newer ATM hardware can detect skimmers, but adoption is uneven, and emphasizes the upcoming shift to chip‑and‑PIN cards, which are far more resistant to skimming. Only 5 % of cards currently use chip‑and‑PIN, but Visa, MasterCard, and American Express plan to mandate it within about 18 months. Finally, he explains that under federal law consumers must report fraud within two days; banks typically have a zero‑liability policy and will cover fraudulent withdrawals if reported promptly.
Chapters
Quite a scare, really, for anyone who uses ATMs. Cambridge police are now alerting the public that thieves were recently able to steal money directly out of people's bank accounts in the Central Square area after they obtained customers' bank information using a secret device known as a skimmer. Cambridge police say they are aware of at least 7 instances of this happening in their area between last November and this past January. And although they say the scam isn't isolated to Cambridge, they're not saying which banks or ATMs were compromised. Well, joining me now to talk more to talk more about this scam and how to protect ourselves, McAfee security expert Robert Siciliano. Robert, first of all, explain to us what ATM skimmers are.
So bad guys have a device that looks like the face of the ATM. It's a facade. Okay? It fits over the card slot.
Wow. Fascinating.
And then when you slide your card through, it records the information off the magnetic strip on the card.
So it's not the actual slot that you're putting your card into?
Well, you're putting your card in the slot, but over the slot is another slot.
Yeah.
You know, it's a facade.
It looks like it belongs there.
And it reads the information off the back of the magnetic strip, and they burn that information onto a blank ATM card and liquidate your bank account.
Brilliant. Any idea how this came up, how they came up with this, or how long this has been going on for?
So more than likely there was a discovery amongst a number of different bank customers who said, "Hey, we have this problem," and then they realized that on a particular time frame all of these withdrawals happened at the same time, and ultimately they determined that there was skimming.
So how do we protect ourselves from something like this? We don't even know that that device is on our ATM machine. That's scary.
Yeah, most people aren't going to know that there's a skimmer on the device because it looks like it belongs there. It looks like it's part of the machine. So what you do is you cover up the keypad with your other hand as you're punching in your PIN code, and the camera that records your PIN won't see the PIN. They can't get money out of your account.
So they're actually hooked up to the camera?
They have the camera fed wirelessly into their laptop, generally within a mile or two. Unbelievable.
In this situation, the scammers were getting the information, it seems like, around the Cambridge area, but then they were actually withdrawing or transferring money in New York City. So is that what you've been seeing a lot too, where they're then remotely taking the money out?
Yeah, generally they don't want to circulate the area and withdraw money. They'll go to New York, they'll go to Vegas, they'll pull out large amounts of money in a short period of time until you either recognize the fraud or your account's exhausted.
So obviously that's a way to protect yourself on the back end, look for withdrawals, uh, transactions that didn't happen anywhere that you visited.
Yeah, so besides covering up the keypad with the other hand, you have to watch your accounts. I watch my accounts daily on an app on my mobile phone. That way I'm in tune with every single charge. You can do it online or via monthly with your statement.
And have banks come up with any technology yet to detect whether thieves are putting these things on their ATM machines? I mean, shouldn't the bank be responsible for this as well?
So new ATM, uh, technology Senses a lot of this stuff, but they don't all have that same technology on all ATMs. That being said, chip and PIN, the, the, the Canadian, Mexican, and all of Asian and Europe credit card generally will be a more effective credit card in the next year and a half. It'll protect us and prevent ATM skimming.
So you want to make sure your bank uses that kind of a card.
Right now, only 5% use chip and PIN. It's going to be about a year and a half until Visa, MasterCard, American Express require chip and PIN for everybody.
Okay, other quick question too. If you do get money taken out of your account fraudulently, will the bank normally cover it in this kind of a scam?
Yeah, that's the thing. You only have 2 days by federal law to respond to fraud in your account. You have to call the bank within 2 days to let them know.
Wow.
That being said, the bank generally has a zero liability policy as long as they believe that you in fact were scammed. So you really do still have to pay attention to your accounts.
Absolutely. All right, Robert Siciliano, a lot of great advice there.
