A Genesee County resident was shocked earlier this month to find that two of her debit cards had been used to make unauthorized purchases at locations as far away as France and Texas.
Apparently the thieves obtained her cards with a bit of technology, though which technology was used in this case is unclear.
Criminals can use several methods to obtain ATM card numbers. The most common is known as skimming, which involves hooking a dummy reader up to an ATM machine.
Less common is using a device that reads RFID signals (radio frequency) that some cards emit (RFID signals are much more common on credit cards and hardly used by banks on ATM cards, according to a security expert).
The local woman first thought somebody scanned her purse, but at the request of The Batavian, contacted her banks and found her debit cards do not have RFID chips.
The woman carries two debit cards, one from TD Bank of the North and one from First Niagara. She said she rarely uses the First Niagara card and hadn't used it for several weeks prior to it being compromised.
That's why the woman doesn't think her cards were skimmed at an ATM machine.
A TD bank customer service agent told her that some stores keep ATM card numbers in their system for up to six months, which could be the source of a security breach (hackers could gain access to the system, or an unscrupulous store employee to look up the numbers).
The woman contacted The Batavian after filing a complaint with the Sheriff's Office because of a local news report about skimming at two M&T Bank branches, one in Corfu and another in Oakfield.
Undersheriff William Sheron said local law enforcement has received no confirmation of any skimming victims in Genesee County, except for the possible case of the woman who filed the complaint Monday.
Regardless of the amount of skimming taking place locally, it is a fraud consumers should be concerned about, security experts warn.
In January, Bank Info Security predicted 2012 would be the year of skimming.
In order to skim card numbers from unsuspecting bank customers, a criminal places a disguised card reader on an ATM machine. The devices are often manufactured by criminals to seamlessly integrate into the bank's ATM machine, making them very hard for an unsuspecting ATM customer to detect.
The criminal must also place a hidden camera in an appropriate location in order to capture users inputting PIN numbers.
Robert Siciliano, a McAfee identity theft expert, said most criminals who set up skimming devices know how to avoid being detected by ATM security cameras when placing and removing a device on an ATM machine, and the devices are left on machines for no more than a couple of hours.
Siciliano said if a consumer suspects a device has been connected to a machine, they can usually jiggle it loose.
There are several ways consumers can protect themselves from debit card fraud.
First, Siciliano said, don't use a debit card. Siciliano said he only carries credit cards, uses those for all of his electronic purchases and then pays off the cards each month.
Credit card agreements, by law, have better consumer protection rules, he said. For example, consumers have up to 60 days to detect and report an unauthorized transaction, whereas most bank agreements on debit cards give consumers only a matter of days to report fraudulent use of their cards.
If you do use a debit card, you should be checking your bank statements online frequently to more quickly detect unauthorized transactions, Siciliano said, certainly at least every two weeks.
It's best never to swipe your debit card for purchases, Siciliano said. Don't use them in place of a check. Not only might there be a skimming device attached -- such as at a gas station -- to the purchase point machine, the numbers are stored in computer systems that can be compromised.
If you use your card at a bank ATM machine, always use your free hand to cover the entry of your PIN number. While some skimming devices include overlays for keypads, they are rare, Siciliano said. The most common way to capture a PIN number is with a hidden camera.
For the local woman who had her identity stolen, it's been a major frustration, she said.
Because she feared all of the debit and credit cards in her purse were compromised -- including a card under her dad's name with a large line of credit she uses for any emergency care for her father -- she cancelled all of her cards.
The thieves placed a nearly $2,000 charge in France on her primary debit card and tried to make another $1,000 charge at another location (by then both her available funds and overdraft protection were used up).
Fortunately, she said, she had made her $500 house payment just a day or two before the unauthorized charges were made or she would really be in a serious financial bind, she said.
On her First Niagara card, fraudsters tried placing charges in Texas and Wisconsin, but First Niagara rejected the charges. Still, she has to wait up to 10 days for a new card in that account.
She also had to cancel her direct deposit for her paychecks on her primary bank account and request paper checks from her employer until her bank accounts are re-secured.
The main reason she contacted The Batavian, she said, is she thought people should be warned these kinds of scams can take place locally.
"I had heard about this on the news last year, but you never think it would happen to you in a small town like Batavia," she said.
