Fake ATMs: Should you worry?

A couple of weeks ago, Chinese police arrested a man who installed a fake ATM in Beijing that managed to steal the account information of unsuspecting customers -- information that was later used to empty their bank accounts.

The ATM, which was purchased from a legitimate manufacturer, was installed on a busy corner in Beijing and claimed to accept most major credit and bank cards. All transactions, however, resulted in a "temporarily out of service" message, and "customers who used this 'ATM' soon found that all their money in the bank account disappeared without a trace," according to a Beijing news report.

Police later arrested a 30-year-old man, who said his machine recorded ATM card numbers and personal identification numbers, or PINs. Although this was the first such reported incident in China, it begs the question, could this happen here in the U.S.? Actually, it already has, back in 1993, when a gang known as the Buckland Boys installed a Fujitsu 7000 in the Buckland Hills Mall in Manchester, Connecticut, according to Wired magazine.

After convincing mall officials they were above board, the Buckland Boys installed an ATM that recorded card numbers and PINs of some 200 shoppers without dispensing a single dollar. After 16 days, the "temporarily out of service" ATM was wheeled out of the mall by two men, who managed to withdraw $100,000 from the accounts of their victims before they were finally caught several weeks later.

The thieves were finally undone by non-payment of bills, including $20,000 for magnetic strip card equipment and an unpaid ATM vendor in Atlanta. On June 21, Secret Service agents arrested the "Buckland Boys," who turned out to be Alan Pace, 30, of New York City, and Gerald Greenfield, 50, of Tucson, Arizona. Agents also seized five other ATMs, blank bank cards, ATM-emulating software, two bullet-proof vests and several handguns. "This crime is the first of its kind in the world," said Dan Marchitello, the Secret Service agent who broke the case.

Apparently, the only reported case of a fake ATM (as opposed to a legitimate one used for illegitimate purposes like the one the Buckland Boys used) in the U.S. was -- ironically enough -- at a Defcon hacker conference in 2009. According to Computerworld, attendees at the conference noticed that an ATM in the hotel hosting the event didn't quite look right. "They looked at the screen where there would normally be a camera," a conference organizer told Computerworld. "It was a little bit too dark, so someone shined a flashlight in there and there was a PC." He then notified local law enforcement, who removed the machine.

So how worried should you be about bogus ATMs? Not very, since it's far easier for thieves to piggyback on legitimate ATMs and steal your money with a skimmer, a small electronic device placed over or inside the slot on an ATM machine that reads the magnetic strip on your debit or credit card and transmits your account information to criminals. The thieves behind these scams also record keystrokes by using hidden cameras or fake keypads placed over the real ones.

The ATM Industry association makes no mention of bogus ATMs on its web site, but list examples of skimmers found in Maryland, California and the launch of a global anti-skimming forum. Gas stations seem to be especially susceptible to a variation of this scam, with crooks installing skimmers inside gas pumps, making them far harder to detect.

You can protect yourself against skimmers by checking the ATM for any ill-fitting devices attached to the card reader, looking for hidden wireless cameras in brochure or deposit slip holders and covering the keypad with your free hand when you enter your personal identification number, or PIN.
Read Full Story