ATM Pin Code Security and ATM Card Theft

Is Your ATM Pin number recorded on a security camera?
How difficult is it to crack a pin code entry device? - link
- banks and other FIs rarely reveal how much security is built in, using real numbers. Below, the article reveals a dollar number for an attack on a Pin Entry Device (PED).
- Last year Visa International formally launched a 50-point security certification process for "PIN entry devices" (PEDs) on ATMs that accept Visa. The review is exhaustive: an independent laboratory opens up the PED and probes its innards; it examines the manufacturing process that produced the device; and it attacks the PED as an adversary might, monitoring it, for example, to ensure that no one can identify which buttons are being pressed by sound or electromagnetic emission. "If we are testing a product that is essentially compliant, we typically figure it's about a four week process," says Ken Kolstad, director of operations at California-based InfoGard, one of three certification labs approved by Visa International worldwide. - Cash`n`Carrion
- In one scam that Visa says is on the rise, a thief inserts a specially-constructed sleeve in an ATM's card reader that physically captures the customer's card. The con artist then lingers near the machine and watches as the frustrated cardholder tries to get his card back by entering his PIN. When the customer walks away, the crook removes the sleeve with the card in it, and makes a withdrawal.
- police in Hong Kong and Brazil have found ATMs affixed with a hidden magstripe reader attached to mouth of the machine's real reader, expertly designed to look like part of the machine. The rogue reader skims each customer's card as it slides in. To get the PIN for the card, swindlers have used a wireless pinhole camera hidden in a pamphlet holder and trained on the PED, or attached fake PIN pads affixed over the real thing that store the keystrokes without interfering with the ATM's normal operation. "They'll create a phony card later and use that PIN," says Kurt Helwig, executive director of the EFTA. "They're getting pretty sophisticated on the hardware side, which is where the problem has been."
- Visa certification requirement is that cracking the device should cost a thief at least $25,000, or require that the crook take the PIN pad home with him for at least 10 hours to carry out the modification.
The naked crowd - a book about how Americans will abandon privacy for perceived security - getting naked for big brother
How do thieves steal your pin code? link
- Over 1.5 million tourists visited Lebanon this summer, official statistics say. But some of these visitors were not in the country for the Byblos Festival, the luxury beach resorts or the nightlife in Gemmayzeh. They were here to install devices on public ATMs that copy bank customers’ PIN codes and clone credit cards, which they are now using all over the world to extract money from victims’ accounts.
- “Apparently around 100 Eastern Europeans landed in Lebanon in August and September and installed skimming devices on many ATMs to steal information and PIN codes,” said a bank employee who wished to remain anonymous, as the Central Bank banned financial institutions from talking to the press. “They are now out of Lebanon and withdrawing the money from different parts of the world. [Bank authorities] don’t want to disclose how big the damage is, but rumor has it that they stole a lot of money.”
- Most banks have recently issued warnings for their customers and closed their ATMs, although these efforts come months after most of the damage was done.
- Lebanese banks have also restricted their card acceptance at points of sale in Eastern European countries such as Bulgaria, Romania, Turkey and Ukraine. Lebanese bank customers also can’t use their cards in Italy, Mexico, Peru and South Africa, countries where most of the skimming networks are based or operate from. In any country not on the “black list”, the client is allowed to withdraw money from an ATM only after calling their bank in Lebanon and giving complete identification.