California Dreamin’: ATM ‘Shimming’ Hits West Coast
The emergence of “EVM” chip-enabled credit cards was supposed to help eliminate vulnerability to identity theft and fraud because those cards could not be “skimmed.”EVM stands for Europay, MasterCard, and Visa.
But scammers are persistent, with five individuals being arrested last spring in California accused of “shimming” at ATM machines.
First seen outside the US (originally in Mexico) shimmers are able to grab information from chip-enabled cards using a paper-thin device, or “shim,” that contains it’s own microchip as well as flash storage. It hides, unobtrusively inside the dip-and-wait slot on card readers without interfering with the insertion of customers’ cards.
Whereas skimming technology was somewhat bulky, according to PCMag, shimming technology can easily be inserted into card readers at in-store terminals. The thief can thereafter collect the stolen card data by inserting what merely looks like another credit card into the same slot. Unless a mind-reader, anyone observing the thief “read” the stolen data, would naturally think they were making a purchase or taking money from the ATM.
The end result is the same. With skimming, the device copied critical customer data from the magnetic swipe. With this new technique, the shim copies and saves information from the chip on your card. In both cases, the thief can sell the user info on the dark web or can clone the card as a debit card for later use. Unfortunately, many retailers—especially online—still accept such cards.
How to Protect Yourself from Shimming
While it’s up to businesses to inspect their card readers daily to make sure they haven’t been tampered with, there are some things you can do to make yourself less susceptible to shimming.
If you have a tap-and-go feature on your credit or debit card or are at an establishment that accepts Apple Pay, Google Pay, or Samsung Pay, that’s one way to avoid shimming.
If you need cash, it’s best to get it from a teller at the bank or as cash back from a purchase. If you must use an ATM machine, use one inside a bank. (Stand-alone terminals are much more vulnerable to scams.) And if you can avoid the ATM altogether by going to a teller or just getting cash back from a purchase, those are better options. Just remember, when using an ATM, to always cover the keypad while entering your PIN.
Finally, if you ever insert your card into a card reader and feel any unusual resistance, stop immediately and alert the store or bank.
Of course, it’s wise to check your online accounts for any unauthorized charges and to notify the appropriate bank or financial institution right away.