Insert ATM Card, Remove Keypad?

Wait, what?! A few days ago, an Oklahoma City police officer pulled the entire keypad off an ATM machine! No, he wasn’t trying to prove his strength, although that would have been quite impressive.

The outdoor ATM at Bank of Oklahoma in Tulsa Hills was weathered, but the officer noticed the keypad seemed brand new. When he began to inspect it further, the entire thing popped right off. “It kind of felt weird being a police officer and calling 911, but that’s what I did,” said Master Sergeant Corey Nooner in the NewsOn6 article.

ATM skimming fraud is getting so advanced that this “press-on” keypad can actually send data via Bluetooth to thieves. KrebsOnSecurity.com says that fraud devices are often placed on the ATM with glue or double-sided tape. While some banks have implemented skimming detection devices, some fraudsters in turn started using insertable skimming devices to avoid being detected.

Hackers use the information from the skimming device to create fraudulent copies of debit and credit cards. “Once they are into the system, they go to the administrative account and they remove any sort of limitations, so whatever’s in the bank at that time, they can cash that, and they do it at a pre-determined time, all over the world,” explains San Jose State University Professor Dr. Ahmed Banafa.

You know the threat is real when the FBI issues a warning of a “potential ATM bank heist” that could cost upwards of millions globally. USA today coverage said the FBI warned: “Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cybersecurity controls, budgets, or third-party vendor vulnerabilities.”

Okay, so don’t get too alarmed. Financial institutions use these warning to trigger “fail safe positions” and increase security. And, ATM owners can take the following precautions to see if there is a skimming device on their cash machine:

  1. Camera check: Check the area for small, wireless cameras that may be placed on or near the ATM.
  2. Increase visibility: Visit a high-traffic and highly visible ATM to reduce risk says Forbes magazine. Owners can place machines where they are highly visible, and unobscured by retail displays or other items.
  3. Routinely inspect your machine: Inspect your ATM for a keyboard overlay placed over the normal keypad, or internal skimming devices if you have access to the interior of your cash machine.

As the famous G.I. Joe quotes goes, “knowing is half the battle.” The other half involves being more aware of ATM conditions and possibly, contacting 911.