This question has been bothering me ever since I first heard of ATM skimmers:
Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM (automated teller machine), which reads the magnetic strip as the user unknowingly passes their card through it. These devices are often used in conjunction with a miniature camera (inconspicuously attached to the ATM) to read the user's PIN at the same time. This method is being used very frequently in many parts of the world...
* ATM skimmer device being installed on front of existing bank card slot (source: hoax-slayer.com)
Banks have so far responded to such threats by installing all kinds of anti-skimmer fascias and see-through plastic slot covers on their ATMs, spent great deal on educating consumers on how to detect such devices with informative brochoures, warning stickers on ATMs themselves, even added helpful information to ATM displays' welcome screens and whatnot, and yet I still can't think of a single, simple and bulletproof way of establishing whether any particular ATM is safe to use, or it might have been tampered with and devices installed onto it to collect our credit card information and record our PINs.
Here are a few suggestions I've been reading about:
- Check for cameras: Sometimes hackers looking to get PINs put cameras on the light above the keypad. Feel the top for anything protruding that could be a camera.
- Pull on the card slot: Card stealers can't spend a long time messing with an ATM, so card skimmers are often easy to instal and remove. If the card reader at the ATM moves or seems loose, don't risk it.
- Wiggle the keypad: Hackers sometimes put fake keypads over the real one to figure out your PIN. If the keypad seems loose, try a different ATM.
Hackers are getting smarter though, and technology to enable more advanced and harder to detect skimming devices is becoming more widespread (e.g. 3D printers, tiny cameras that can record PINs through a pinhole,...). So how are we, consumers, supposed to detect all of this? ATMs themselves vary greatly bank to bank, country to country. Sometimes, even same banks will use multiple different ATMs, and anti-skimming fascias might be different altogether. Hackers might have super-glued overlaid keyboard and the skimmer, the camera can be so tiny and hidden so well it would be nigh impossible to detect, or the complete circuitry (reader, camera, the whole shebang) extremely well disguised to look nearly identical to ATMs original fascia.
ATM skimmer showing slot cover and pinhole for PIN camera. Would you have noticed it?
The example in the photograph above could be scarier, if it was in matching colour and texture to the ATM's own plastic fascia, and maybe cut a bit nicer too. Noting too hard to do really. But even as it is, it's still disguised well enough to fool any slightly too casual customer in daylight, and possibly even the most cautious ones during night and under artificial illumination. Notice how tiny the camera pinhole is. Put a smudge of dirt around the pinhole, and it would be unnoticeable.
So with all this in mind, my question is:
How can we detect, in reasonable time and assuming the attackers got in the meantime smarter and better equipped than what we learned so far, if ATM was tampered with and any skimming devices (or other traps) installed onto it?
I've left the question intentionally slightly open to interpretation and am interested in both latest & greatest ATM anti-fraud technology used by banks, as well as any good suggestions on how an average ATM user could detect such fraud schemes and devices, if present.