(Published Sunday, September 23, 2007 11:54:40 PM CST)
A d v e r t i s e m e n t
By Frank Schultz/Gazette Staff
At thief may at this moment be holding a perfect copy of your credit or debit card.
Perhaps he's approaching the checkout line at a suburban Chicago department store with a cartload of shoes, clothes and electronics. Perhaps he's charging a room at a hotel in London.
And you have no idea. Your card is secure in your wallet.
How could this happen?
And could it happen here?
It already has.
The debit cards of 21 southern Wisconsin residents were compromised in June and July. It's not clear precisely how or where it happened, but a recent report by a Rock County Sheriff's Department detective said is was a case of skimming.
Skimming is quick, hard to detect and usually happens within feet or even inches of the legitimate cardholder.
Skimmers use the same basic technology that allows a store or restaurant to scan a card for payment. The thief swipes the card through a skimming device. Instantly, the information recorded on the card's magnetic strip is transferred to the device.
Sometimes, the cardholder thinks he's swiping his card legitimately at an ATM or a store, but it's actually a skim scam.
Once the thief has skimmed a card, he has what he needs to create a duplicate card, along with a fake ID, using your information but his photograph, said David Tatar, manager of the state Office of Privacy Protection.
"It's a growing problem," said Tatar, who recently returned from an international financial crimes conference in Toronto.
Local police won't say much about the local thefts because they're connected to an ongoing federal investigation in northern Illinois.
One rural Rock County couple's debit card was hit for more than $1,700 in charges, the sheriff's department report indicates.
The U.S. Secret Service referred inquiries to the U.S. Attorney's office for the Northern District of Illinois. Assistant U.S. Attorney Randall Samborn said on Wednesday that he could not even acknowledge the existence of an investigation before an arrest is made.
The 21 cards were all held by customers of Blackhawk Community Credit Union. BCCU spokesman Frank Beres pointed out that BCCU isn't alone. Just about any bank has had the same experience, he said.
"This happens all over the country, and it's been happening all around the area, too," he said.
If 21 BCCU customers were stung, odds are that many others between Janesville and Rockford, Ill., also got skimmed, Beres said.
And sure enough, the sheriff's department is investigating another skimming case involving an area bank, possibly connected to the BCCU case. Reports were withheld until the investigation is concluded.
Beres didn't know how the local cards were skimmed, but he said that no BCCU employee was involved.
Beres said the credit union gave the customers their money back, a common practice for banks, credit-card companies and other financial institutions, once they determine that the customer was an innocent victim.
It's common for people to be skimmed while on vacation, often at a restaurant, when the waiter takes the card out of sight, said Glen Loyd of the state consumer protection division.
But the local skimming case apparently happened close to home, "somewhere in the Janesville or Beloit area," according to the sheriff's department report.
It's also not clear when the skimming took place. Skimmers sometimes hold onto the purloined information for more than a year. Sometimes, they sell it to others, and it ends up on the other side of the globe, according to press reports.
But in the local case, all the charges were made in businesses in the Chicago suburbs, including Wal-Mart and gas stations, the report indicates.
The equipment a thief would need is available for sale on the Internet. Cost is about $500, Tatar said.
"Considering the return, that's quite an investment for a thief," Tatar said.
Tatar said skimming isn't as common in Wisconsin as it is in other states, "but it's certainly out there, and people need to be aware of it."
Skim scams
Skimming involves extracting the financial identity from the magnetic strip on your credit or debit card. The information is then downloaded to a computer and used to make a duplicate-or cloned-credit card. Thieves have found ingenious ways to skim:
-- The ATM skim-At an ATM, thieves place their skimmer over the legitimate card reader, camouflaging it to make it look like it's a part of the machine. When the customer inserts or slides the card, the device records the information. In the case of an ATM, thieves either install a pinhole camera nearby to record the PIN, or the thief reads the number as the customer punches it in. The thief later retrieves the device.
-- The point-of-sale skim-The thieves replace the legitimate card scanner at a gas station or other business with one that records card information. One way to do this is for one thief to get the clerk to help him find an item in the back of the store while another thief unplugs the legitimate scanner and plugs in the skimmer. Thieves later repeat the process to retrieve the information they have stolen.
-- The wireless skim-A variation of the point-of-sale skim, the information-stealing device transmits the stolen data directly via a wireless connection to the thief's computer.
-- The hand-held skim-A variety of pocket-sized skimmers are for sale on the Internet. The thief often is a restaurant waiter who skims the card while taking it to the register. Some restaurants have begun using wireless card readers that are brought to the customer at the table. But thieves have found ways to defeat this. A video on the YouTube Web site shows a British documentary in which a waitress "clumsily" drops a customer's card and skims it with an ankle-mounted device. The video, titled "The Real Hustle-Waitress Card Cloning" can be seen at www.youtube.com/watch?v=sexUus0igWs.
-- The patsy skim-The thief portrays himself as a marketer for a company trying to learn about people's spending habits. He hires someone to skim people's cards, telling the patsy that he must do it without the cardholder realizing what is happening, because he doesn't want people to realize that this marketing technique is being used.
Protect yourself The state Office of Privacy Protection doesn't have specific recommendations for how people can protect themselves from skimming, but they offer these tips, which apply to a variety of identity-theft schemes.
-- If you're not using cash, it is best to use a credit card rather than a check or debit card. If your identity is stolen, your credit card loss is limited to a maximum of $50. Many credit-card issuers now offer $0 liability. There is no limit on losses from bank accounts, so if an identity thief obtains your bank account information, you could be wiped out.
-- Make sure your credit card is always in sight when making a purchase. If a clerk says he has to go somewhere to validate your credit card, go along.
-- Keep an eye on what's going on around you. Pay particular attention to people in line at checkout counters. An identity thief could be in the crowd. Since many cell phones now contain cameras, be careful that the person who appears to be talking on a cell phone isn't taking a picture of your check or credit card information.
-- Review your bank account and credit card statements to able to see if there are any charges or withdrawals you didn't make. If there are, contact the financial institution or credit card issuer right away.
-- If you suspect identity theft, get a copy of your credit report right away. You are entitled to one free credit report from each of the three major credit-reporting agencies each year. To get yours, go to www.annualcreditreport.com or call 1-877-322-8228.
The Lebanese loop
It's not skimming, but a scam called the Lebanese Loop could have the same effect.
It happens at ATMs, said David Tatar, manager of the state Office of Privacy Protection.
The thief first inserts sticky tape into an ATM slot. Then he-or she-waits in hiding or hangs out in plain sight near the machine.
When someone puts her card in the slot, it sticks to the tape, and the customer thinks it's jammed.
The thief will approach and ask if he can help. The thief says this has happened to him and says you just need to hold down the buttons while punching in your PIN.
That's how he gets your PIN.
Your card still doesn't come out, and you eventually leave. He extracts the card.
"It's the low-tech way, and it's one of the early practices that occurred when ATMs arrived, but it still happens," Tatar said.
