Card ’shimming’ could be the new card ‘skimming’

Card ’shimming’ could be the new card ‘skimming’

MONTGOMERY, AL (WSFA) - EMV cards, also known as “chip” cards for the embedded information chips they contain, have yielded some effectiveness against counterfeit credit card fraud. Unfortunately, even with this advancement in credit card security your personal information could still be at risk of getting into the wrong hands.

Overlay Skimmer Confiscated By the AG's Office
Overlay Skimmer Confiscated By the AG's Office

Special Agent Jake Frith with the Attorney General Office’s Cyber Crimes Unit said they’ve worked diligently to combat skimming.

Skimming is a type of credit card theft where crooks install skimmers in the card slot. When a credit or debit card is swiped through, the device captures and stores all the details stored in the card’s magnetic stripe. The culprit can then take the stolen information to make fraudulent charges either online or with a counterfeit credit card.

“It was one of the reasons that lead Attorney General Steve Marshall to create the cyber unit, so we have a group of dedicated individuals who can combat crimes like this," said Frith. “We have made several skimming arrest here throughout the state and involving other states as well.”

Now scammers have taken a new approach that investigators are closely monitoring called shimming.

“We have not made a shimming arrest yet, because we have not found a shimmer here the state of Alabama. That is not to say they do not exist however, we have not seen one yet,” said Frith.

A "shimmer” is a paper-thin device. It is embedded with a microchip and flash storage. They were first discovered in Mexico and Arizona approximately two years ago it is to believed to be spreading across the United States.

What is to believed to be the first found shimmer in Mexico
What is to believed to be the first found shimmer in Mexico

“This device is inserted inside what would be the chip reader. These particular contacts read the data off your EMV chip. That being said, it is only getting the same information you would get off a mag stripe you would get off of a regular skimmer," said Frith.

Once you insert your card into credit card terminal at an ATM, gas pump, or shop the shim copies and saves your payment information.

“It is reading your card number, name, and expiration date. The difference is it is not gaining the CVV code, which is the last three digits on the back of your card, stored on the mag stripe. It is picking up a different CVV code called a dynamic CVV code so it changes. They are able to replicate your card number, name, and expiration on a mag stripe. If a bank doesn’t have a CVV check then they are able to use that card," said Frith.

Unlike skimming devices, which are typically bulky making them easier to spot, shimming devices can be difficult to detect.

“Unless something catches on it and causes the card to stick you are not going to know anything is in there,” said Frith.

“All the crooks have to do is use a special card so they walk up to the terminal and insert the special card to retrieve the information and it just looks like they are using the terminal to make a purchase," said Nancy Crawford, with the Better Business Bureau.

This fact is frightening to many consumers.

“I thought the chips was for protection initially. I think that is what everyone thought. It is scary to know people are doing that," said Chasity Bartlett.

“I have never heard of 'shimming.’ The idea that someone has found a way to get by them - that doesn’t surprise me. I don’t believe anything that is full proof,” said another resident.

Recommended actions for shimming victims:

Consumers who believe they may be a victim of shimming should take the same action as in other debit or charge card theft crimes.

- Immediately notify law local law enforcement if you believe you are a victim of shimming and provide them with the location of the ATM or card reader device that you suspect might be comprised by a shimmer.

- Immediately notify the issuer of the debit or charge card that you believe is compromised so they can cancel the card and a send you a replacement.

- Immediately report to your bank or card issuers any suspicious charges on your account.

- Monitor your credit report for any new inquiries, high balances, or new accounts you don’t recognize.

To avoid possible future card data theft, use tap-and-pay with either your card or smartphone to make it harder for hackers to access your information.

The Better Business Bureau suggests consumers take extra measures to protect their financial interests:

The BBB says consumers should check their online statements on a regular basis. If any suspicious charges arise, report them to your credit card company or bank right away. The customer service number on the back of credit and debit cards is the best place to start when reporting card theft or disputed charges.

The BBB also warns consumers to be cautious about chip readers that have tighter-than-normal grips on their credit cards. This could be a signal that a scammer has loaded a shim inside the reader. To be on the safe side in this case, consumers should cancel their transaction and notify their credit card company.

Finally, the agency says that whenever possible, consumers can use a contactless payment method instead of swiping or inserting their cards. It points out that a customer can enter payment information manually, and card readers are unable to steal information this way.

You may also want to consider a credit card with purchase protection in the event that a scammer steals your information and makes charges against your account.

Copyright 2019 WSFA 12 News. All rights reserved.