Truth 29 Credit card skimming

Have you ever wondered why there seems to be no rhyme or reason as to when you are asked to show ID when using a credit card?

At many of the grocery stores and major retail outlets, you actually swipe your own card, never even handing it the cashier. In some cases, after you swipe the card and approve the amount, a message displays on the screen telling you to show the card to the cashier; however, the cashier rarely looks. Other times, diligent cashiers do ask to see your ID. What’s more amusing is that if you go through the regular line, cashiers ask for ID when you use the credit card; however, if you use self-checkout, there is no one available to check your ID, so there’s no validation. I don’t think I am giving a criminal any hot tip when I point this out. I have also noticed that some merchants no longer even require a signature for credit card purchases totaling less than $20.

With all the identity theft and credit card fraud that is taking place around the globe, you have to assume that the credit card companies must be getting angry at the merchants who are failing to perform proper ID validation. However, you would be wrong.

In fact, the actual guidelines from the major credit card companies seem to be ambiguous at best. In the worst case, they actually insist that merchants not ask for ID when accepting a credit card. Apparently, credit cards are to be treated as cash. While treating credit like cash sounds nice, we live in a world in which identity theft is out of control. While I might carry $100 cash with me occasionally, I am quite certain that most people are not carrying $10,000 in their purses and wallets. So to treat credit the same as cash is to assume that people would absorb the same risk with both. Obviously, if someone steals your credit card, he or she is going to spend far more than the $100 cash in your pocket. The point is that the system is broken, insecure, and ultimately leaves you to fend for your own credit security. And it’s this general lack of control that has made credit card skimming a lucrative practice for identity thieves.

The term skimming refers to taking a legitimate credit card and making a copy of the card without the owner’s knowledge. Identity thieves often get involved with employees at restaurants and bars working out a deal in which the employee skims the cards and the identity thief pays for the stolen numbers. So how easy is it?

I have tested this type of attack in several locations and found it was frighteningly easy. I started by picking up an inexpensive, easy-to-use magnetic strip read/write device from the Internet.

In my first test, a friend let me pose as a bartender in his bar. When a patron paid with a credit card, I would swipe the card through the bar’s card machine and then swipe it through my own card reader that I had set up to capture information right off the cards.

In another test, I concealed a small camera inside my hand, which was wrapped with a bandage. When I went to several bars, I was able to scan cards lying on the bar by simply passing my hand over the card. The camera would record the name, number, and expiration date.

Next, I decided to see what happened if I copied my own credit card information onto other cards. I actually used hotel room key cards and copied my credit card information onto them using my magnetic strip reader/writer.

After making my new cards, I went to a store that allows you to swipe your own credit card. The transaction with my modified hotel key card was approved and, as expected, the cashier didn’t ask to see the card. Had I been a real thief, all the card numbers I had gathered at the bars could have been used for this attack.

Next, I went to a location that I knew would ask for ID. I swiped the card and then waited. Sure enough, the cashier asked to see the card and my ID. I handed her the room key and my ID, and her expression was priceless. She asked me for the credit card, and I told her that was the credit card. She called over a manager. The manager explained that he needed the original credit card, and I explained that for my security and privacy, I only carried room keys that contained my card information.

In the end, the store did let me make the purchase after carefully looking at my ID again. I didn’t have the same good luck when I tried this everywhere. One location took one look at the card and canceled my order. I was told to use a real credit card, and when I started to get upset, the store offered to call the police. I chose to leave.

Here is what I suggest to protect yourself.

When paying with a credit card, never leave the card laying out for the public to see. While many restaurants provide a holder to place your card in when they leave the bill, often times bars simply leave the receipt lying in front of you. In that case, place the credit card under the receipt partially sticking out.

It’s rare that you can see where your card is taken after your server picks it up. But in the event that he does stay in your sight, pay attention. If you see him swipe the card more than one time, or if you see him writing anything down while he is looking at your card, be concerned. I would even go so far as to ask him what he was writing or why he scanned it twice. If it was malicious, generally the fact that you called the server out on it will be enough to deter him from using your card.

Most credit card companies allow you to set up an email limit notification. You can set a number, and when your credit card balance goes over that number, you will receive an email letting you know. I suggest keeping this number low enough to be a safety net while not so low as to be hit with normal usage. If you are notified that you’re over the limit, it could be your first indication that your card has been stolen.

Never use your banking ATM debit card for purchases at restaurants, bars, and other locations where the card is taken out of your sight. Unlike a credit card, the debit card pulls funds directly from your banking account. And, unlike a credit card account in which you can decline to pay for items that are under investigation as fraud, when you use a debit card, the cash is removed immediately.