Overlay skimmers simply stick on top of card readers and can be installed even in busy supermarket checkout lanes.
I must warn you that after reading this article and watching the video below you’ll probably never use a credit card reader or ATM again without first pulling on the keypad. And it’s not actually a bad idea to do so because of how stealthy skimmers have become.
As Krebs on Security reports, the latest way your card details can be stolen is through the use of “overlay skimmers.” They take the form of a keypad that hides the card detail-capturing components behind a plastic casing. The keypads are then stuck over the top of either ATM keypads or the the card readers now typically found in checkout lanes.
Police in Lower Pottsgrove, PA are currently searching for a couple of men who have been installing these overlay skimmers on checkout lane card readers in Aldi supermarkets. As the video below shows, installation simply requires a few seconds of interaction with the reader. You can see the man slip the overlay out of a pocket and push it down over the keypad while he waits to pay.
Other than the camera, nobody notices him doing this and if you blinked you’d miss it. But that’s the point. The skimmers are so quick to install and hard to spot once attached that they work very effectively. They can sit there unnoticed for days before the installer returns, pulls the skimmer off, and leaves the store with all the card details and PIN numbers ready to be sold or used to empty accounts of cash.
It’s difficult to stop these overlay skimmers from being used. Changing the design of the card reader to prevent attachment is one solution, but it takes time and money to swap out the readers. A week later the skimmer design will have changed to match. In the short term, the more effective solution is to regularly check all the readers. Of course, police just want to catch the people installing them.
So next time you use a card reader to pay or visit an ATM, be sure to check carefully first to see if anything looks suspicious. If you want to give the keypad a good tug before using it, go right ahead. I’d much rather get a few strange looks than login to my bank account to find it empty.