Credit Card Skimming at Irish Rail TVMs

foggy_lad · 26-11-2012 12:05pm #1

http://www.irishtimes.com/newspaper/breaking/2012/1126/breaking12.html

Commuters have been warned to be vigilant when using public transport ticket machines after a number of case of card skimming activity were reported.

The Irish Payment Services Organisation said the Garda Bureau of Fraud Investigation was looking into recent cases involving ticket vending machines at Dart stations in Booterstown and Dún Laoghaire.

The organisation said criminals appeared to be using skimming equipment to capture debit and credit card details and PIN numbers while members of the public used the machines.

It said CCTV footage captured from the stations suggested that a single gang was behind the scam.

Activity of this nature “will most likely escalate in the run up to Christmas” as larger numbers of people use public transport, the organisation said.

“IPSO warns cardholders using these machines to simply cover the PIN pad when keying in their PIN so that the criminals cannot see [it] being entered, either through shoulder surfing or when micro-cameras are used,” the organisation said.

“Cardholders who believe they may have been compromised should check their accounts on a regular basis.”

coylemj · 26-11-2012 4:34pm

I heard about this on the radio but what's reported in the papers contains gross contradictions....

The reports in the Indo and Irish Times talk about 'skimming equipment' which if I'm not mistaken involves placing a mock machine in front of a genuine one, the fake machine then accepts the bank card, takes a note of the user's PIN and reads the magnetic strip on the card thereby allowing the criminals to clone the card and make cash withdrawals at real ATMs. The user is then given back the card and told the machine is out of order so they go to another machine and don't suspect anything.

However the same newspaper reports contain a warning from the Irish Payments Services Organisation (IPSO) to the effect that people need to shield the keypad when entering their PIN. All this does is protect you from someone who's looking over your shoulder or an illicit CCTV camera installed nearby by the crooks who then presumably need to pick your pocket/handbag to get the card.

Shzm · 26-11-2012 4:40pm

coylemj wrote: »

I heard about this on the radio but what's reported in the papers contains gross contradictions....

The reports in the Indo and Irish Times talk about 'skimming equipment' which if I'm not mistaken involves placing a mock machine in front of a genuine one, the fake machine then accepts the bank card, takes a note of the user's PIN and reads the magnetic strip on the card thereby allowing the criminals to clone the card and make cash withdrawals at real ATMs. The user is then given back the card and told the machine is out of order so they go to another machine and don't suspect anything.

However the same newspaper reports contain a warning from the Irish Payments Services Organisation (IPSO) to the effect that people need to shield the keypad when entering their PIN. All this does is protect you from someone who's looking over your shoulder or an illicit CCTV camera installed nearby by the crooks who then presumably need to pick your pocket/handbag to get the card.

From what I understand, what happens is there's a device attached to the card input slot (which just looks like an extension of the real machine), which scans the cards as it's entered in to the machine. This is usually combined with a micro camera attached at the top of the machine looking down on to the pin pad.

coylemj · 26-11-2012 4:45pm

Shzm wrote: »

From what I understand, what happens is there's a device attached to the card input slot (which just looks like an extension of the real machine), which scans the cards as it's entered in to the machine. This is usually combined with a micro camera attached at the top of the machine looking down on to the pin pad.

Just goes to show how alert (not!) the officials are in Dun Laoghaire, the two ticket machines are almost directly opposite the ticket desk.

oneofakind32 · 26-11-2012 6:35pm

Anyone know when the devices were found?! I used my card in the ticket machine at dun laoghaire station this morning!

26-11-2012 11:01pm

These scum are the lowest of the low.

Jamie2k9 · 27-11-2012 12:02am

Just goes to show how alert (not!) the officials are in Dun Laoghaire, the two ticket machines are almost directly opposite the ticket desk.

Don't know how you can post that as if a group of young people come into a station and go to the TMV's they are completly blocking the view of station staff as they were probaly protending to use both machines. It dosn't take long to put the items up. Or are you a person that would know that you card has being copyed at any machines.

Anyone know when the devices were found?! I used my card in the ticket machine at dun laoghaire station this morning!

Would say a few days ago as they said it had being passed to garadi and they would of removed whatever devices once they became known to staff. You could send them a tweet to confirm

the_syco · 27-11-2012 12:13am

Card goes in, you enter your digits, you get your money, and you walk on none the wiser.

The skimmer reads your data, and sends it via sms to another phone avery so often. Your pin code that you typed in is seen by a camera sending a signal to a nearby device. Both the skimmer and camera are low tech, and thus cheap enough. The recorder gets picked up, and off they walk, and play it back using the time stamps and the SMS data to clone your cards.

Can you account exactly what you bought last Saturday night?

Jamie2k9 · 27-11-2012 12:15am

Card goes in, you enter your digits, you get your money, and you walk on none the wiser.

Thats my point and you can't blame IE on this one.

Victor · 27-11-2012 1:19am

http://www.irishrail.ie/cat_news.jsp?i=4728&p=116&n=237

Customers advised to be vigilant for use of skimming equipment at station ticket machines

26 November 2012

Iarnród Éireann has advised customers paying for tickets with credit or debit cards at station ticket vending machines to be vigilant for the use of card “skimming” equipment following a small number of recent incidents.

In particular, customers are advised to heed the Irish Payment Services Organisation’s safecard advice to always cover the PIN pad when entering your PIN number to prevent criminals from seeing the PIN number. Customers should also alert station staff if they see anything suspicious at ticket vending machines.

Iarnród Éireann alerted Gardaí to this issue following a staff member observing a group behaving suspiciously at Booterstown Station. CCTV footage has been supplied to Gardaí to assist in investigating the matter.

The company has briefed station staff on what to look out for, to check ticket vending machines regularly, and on actions to take if they find skimming equipment on ticket vending machines.

For further information on how to protect your card, log onto www.safecard.ie

Victor · 27-11-2012 1:22am

coylemj wrote: »

I heard about this on the radio but what's reported in the papers contains gross contradictions....

The reports in the Indo and Irish Times talk about 'skimming equipment' which if I'm not mistaken involves placing a mock machine in front of a genuine one, the fake machine then accepts the bank card, takes a note of the user's PIN and reads the magnetic strip on the card thereby allowing the criminals to clone the card and make cash withdrawals at real ATMs. The user is then given back the card and told the machine is out of order so they go to another machine and don't suspect anything.

However the same newspaper reports contain a warning from the Irish Payments Services Organisation (IPSO) to the effect that people need to shield the keypad when entering their PIN. All this does is protect you from someone who's looking over your shoulder or an illicit CCTV camera installed nearby by the crooks who then presumably need to pick your pocket/handbag to get the card.

No contradiction. The fake machine front could easily just be on the card slot, not on the key pad, with the key pad observed by a camera (or shoulder surfer) - much more discrete from the scammer's point of view.

seanmacc · 27-11-2012 10:18am

coylemj wrote: »

Just goes to show how alert (not!) the officials are in Dun Laoghaire, the two ticket machines are almost directly opposite the ticket desk.

All stations aren't manned 24/7. Some aren't even manned at all hours between 8am and 6pm. A few more cameras and more vigilant CCTV operators and monitors would be the only thing that can stop that type of scum.

amtc · 28-11-2012 3:02am

I used my credit card to pay in Clerys Car Park (Marlborough Street) and got money €200 taken out of my account - machine prints the entire number. I just put receipt in bin (didn't realise this was occurring) but apparently people go through bins every night and take numbers. I got the money back, and rang car park but they weren't bothered.

Victor · 28-11-2012 7:55am

amtc wrote: »

I used my credit card to pay in Clerys Car Park (Marlborough Street) and got money €200 taken out of my account - machine prints the entire number. I just put receipt in bin (didn't realise this was occurring) but apparently people go through bins every night and take numbers. I got the money back, and rang car park but they weren't bothered.

Talk to the data protection commissioner.

Losty Dublin · 28-11-2012 11:49am

I had a card skimmed a few years ago which I used at an ATM all of once. BOI and the Garda I dealth with could not have been better to deal with and sorted it all out for me but it shows how easy perpetrated these frauds are. Irish Rail and Luas stops are just the victim companies today; tomorrow it will be some other company or institute or body.

@Seanmac, these readers are rather easy to fit onto ATM and card machines in seconds. All it takes is for somebody to "use" one and we are none the wiser as to what they are doing,. CCTV coverage won't go far to prevent it happening as these criminals will forever be a step ahead but it should help in some way.

flutered · 28-11-2012 11:57am

the authoritys should be holding the can for this one, when the atms were being scammed it was only a matter of time before the scammers moved to the next type of machine, the ah twill be alright for a long time does not work, how come forward planning never comes into anything to do with state or simi state, the only forward planning done3 is the budget, how often do they get this right i ask you.

Amalgam · 28-11-2012 12:00pm

Victor wrote: »

No contradiction. The fake machine front could easily just be on the card slot, not on the key pad, with the key pad observed by a camera (or shoulder surfer) - much more discrete from the scammer's point of view.

They are absolutely tiny now, strategy has changed to short term use, which in turn means tiny batteries. A local example below.

Krebs on Security (http://krebsonsecurity.com) has a satisfying overview on the tech and strategies used. His skimmer articles are the most popular on the site, it really seems to catch people's imagination.

http://krebsonsecurity.com/all-about-skimmers/

http://krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/

http://krebsonsecurity.com/2010/02/atm-skimmers-part-ii/

Carawaystick · 28-11-2012 12:15pm

I'll put the kettle on and wait for the threads with people who didn't buy a ticket at an unmanned station because they thought the machine may have been compromised.

dowlingm · 28-11-2012 2:57pm

The banking regulator and the Data Protection people should come down hard on printing of entire numbers on receipts. It's ridiculous that that is going on.

Credit Card Skimming at Irish Rail TVMs

Comments