Skimming and Gluing: Two Criminal Practices to Watch For

How often do you reach for cash when making a purchase? If you are like most Americans, it’s not very often, and the bigger the purchase, the more likely you are to use a credit or debit card. According to a Forbes Advisor survey from February 2023, 91% of transactions in America are made with a credit or debit card. And fraudsters are aware of these statistics. Now, more than ever, it’s important to safeguard sensitive card information to prevent an interruption in your ability to make important purchases. Be sure to report a lost or stolen card to your financial institution immediately. Yet, even if the card stays in your possession, there are several ways that your card information can be used fraudulently. Let’s revisit two of these criminal practices, one old and one new, and learn how you can be your own superhero and stop fraud before it happens.

Skimming

Skimming is a technique employed by criminals to steal sensitive payment card data, including credit or debit card numbers, PIN codes, and other personal information. Even though this illegal technique has been around for more than twenty years, it is still one of the most common types of card fraud. It typically occurs when a physical device, known as a skimmer, is placed on or near a legitimate card reader, such as an ATM or a point-of-sale (POS) terminal at a store or gas pump. The skimmer is designed to capture card data, while an additional component, like a hidden camera or keypad overlay, records PIN codes or other information about the payment card transaction. Even if you have a chip card, many card terminals still use the magnetic stripe on the back of the card in addition to or instead of the chip. The only transactions that are not subject to skimmers are those where you do not insert your card past the chip portion, therefore, the magnetic stripe is not readable, or you use Tap-to-Pay. Tap-to-Pay is a more recent technology that is growing in popularity and allows a cardholder to physically tap the card on the device, which uses short-range wireless card reader technology to access the account, rather than relying on the physical attributes of the card.

How to Detect a Skimmer:

1. Examine the Card Reader Carefully: When using an ATM, or a POS terminal at a store or fuel pump, check the device for anything that looks odd. Fraudsters may attach a skimmer directly over the card slot or PIN pad, resulting in something that is not the same color or shape or looks bulky. Look for any other signs of tampering, such as scratches, glue residue, or a loose-fitting card slot (touch to see if it moves). If anything seems suspicious, avoid using the machine and report it immediately.

2. Use Your Hand to Shield Your PIN: You may have developed a habit of using your hand to shield the keypad when entering your PIN code if you are in line at the grocery store, but what about when you are alone at an ATM or gas pump? You need to include this as a habit every time you enter your PIN, no matter where you are. Criminals often install tiny miniature cameras at the point where a skimmer is installed to capture your PIN, as the skimmer captures the information from your card.

3. Use Secure and Trusted Devices: Whenever possible, use ATMs or payment terminals that are in well-lit, secure areas. When filling up, choose pumps close to and within sight of employees. Illegal skimmers must be installed by someone, and criminals will choose areas where they are the least likely to be noticed and caught.

4. Monitor Your Accounts Regularly: Regularly review your bank statements, credit card statements, and transaction history for any unauthorized or suspicious activity. Report any discrepancies to your financial institution immediately. 

Gluing or "Glue-and-Tap"

Gluing or Glue-and-Tap is a relatively new method that criminals are using at ATMs to access your bank account directly, skipping the need for your card information altogether. This scam typically occurs at a free-standing ATM in a well-trafficked area where people approach on foot. It goes like this. The perpetrator pours glue into the card reader, setting up the scam. Sometime later you visit the ATM to retrieve cash, but you find that you can’t insert your card. A seemingly helpful bystander tells you that the machine is jammed, but if you tap your card, you can still make a withdrawal. At that point, you tap either your card (or phone), enter the PIN required for tap transactions, and leave, often even thanking the “helpful” stranger. The bystander is counting on you, the victim, not being familiar with this type of withdrawal and unaware that you will need to take an extra step to exit the account on the screen before leaving the ATM. Unlike when a card is inserted, and the account window closes when the card is removed, a tap transaction must be closed out on the screen. The criminal perpetrating this scam expects the victim to be unfamiliar with the process, and they can then drain the account that has been left open. Some victims even report being uncomfortable due to the bystander's presence; therefore, completing their transaction and being distracted in their effort to leave the area quickly and safely, leaving their account window open, even if they know better. Scammers recently utilized this method during a series of incidents in San Francisco, which was featured in a video news report.

To help protect yourself, avoid any ATM with a card reader that doesn’t seem to work properly. If you are comfortable using the tap feature on your phone or card for transactions, always wait for the prompt asking if you are finished and confirm that your account is no longer accessible before leaving.