Important Information Regarding Debit Card Fraud

In view of the recent news reports that have been circulating regarding Debit Card Fraud within our communities, and the personal affects we have seen on our members, HCCU feels it’s important to set the facts straight and provide some information regarding this criminal enterprise and how you can protect yourself.

First off, we would like to enforce the fact that Member Cards, issued through the Interac Association, and our partnership with The Exchange Network is an extremely secure and protected system. All transactions are closely monitored and include a multitude of checks and measures to insure the safety of your money. However, as with any convenience, there is going to be a risk factor involved. This risk is present whether it be carrying cash or paying with plastic.

Here are the facts:

Canada is a world leader in debit card usage. In 2008 there were 110 million payment cards in circulation in Canada and by 2013 this is expected to reach 130 million cards, with 720,000 merchant acceptance locations.

In 2007, nearly 160,000 cardholders, about 1 in 200 Canadians, were victims of debit card fraud, and were reimbursed almost $107 million, an amount nearly double that of three years earlier.

Five seconds is all it takes for fraudsters to install equipment that would rig an automatic banking machine to capture debit card information from unsuspecting users.
There is no specific type of store or location that is more prone to debit card fraud. However, the fraudsters are looking to skim as many cards as possible in the shortest period of time. Any location that records a high volume of debit card transactions could be at risk.

As you will see in the following scenario, in most cases it is not an employee of the store doing the skimming of the cards. Typically the store is unaware of the fraud until notified by the police that their equipment has been tampered with. It is because of this that financial institutions do not release the location that the fraud took place if your debit card has been compromised.

The following was taken from the Hamilton Spectator in an article dated January 24 2009 titled Beware the Debit Card Swindlers regarding Debit Card Fraud in Ontario and outlines the normal approach used in a Debit Card Scam.

“The first step in a scam is to accumulate the debit card information from unsuspecting users, via a couple of avenues -- from an automatic banking machine that has been rigged, or by tampering with the portable terminals that stores and restaurants hand their customers to enter their personal identification numbers during a transaction.

When a user inserts a debit card, the counterfeit slot gathers the information before the card gets sucked through the real slot into the machine. Because the transaction proceeds normally, the user isn't aware that something improper has happened.

A second piece is designed to fit under the top of the banking machine. A small pinhole opening has been cut into the metal so that a miniature camera can record the keypad below.

Next to the camera, a small computer processor stores the video, complete with a date and time stamp. When account information has been captured from a debit card inserted through the phoney front slot, the camera then records the PIN that has been entered by the customer. The date and time stamp allows the crooks to match the PINs with the right card info.

At some later point, the fraudsters will return to retrieve the pieces they've installed and then the information will be dumped into a spreadsheet program.

At a retail outlet, the thieves want to get their hands on the portable terminals used by the customers.

Working in groups of two, their goal is to be the last shoppers left in a store at closing time. One of them will distract the sales staff while the other surreptitiously unplugs the debit card terminal and replaces it with a dummy replica.

Overnight, the crooks will carefully open the confiscated terminal so that the security switch doesn't activate, and then a duplicate processing chip will be inserted beside the original chip.
The newly inserted chip will now capture the account information stored on the magnetic stripe of the debit card when it's swiped in the machine.

The duplicate processor comes equipped with Bluetooth wireless technology that will transmit the data like a radio signal that can be captured by a nearby laptop computer or BlackBerry-style device.

The next morning, the thieves return as the store's first customers of the day, replace the dummy terminal with the altered terminal and then set up shop outside the store, ready to begin gathering information from the cards. You'd have no way of knowing the portable terminal has been compromised.

Once enough information has been stolen, it's surprisingly simple to make fake copies of the debit cards.

A magnetic stripe encoding machine costs a few hundred dollars, and plastic cards with blank stripes can be easily purchased off the Internet at a cost of $19 for 100.

The crooks will then begin encoding plastic cards with the required account information, and then write the PIN on the front of the card.

The final step is the "spend" -- the highly synchronized operation when the counterfeit debit cards are used to collect cash.

The bank machines targeted for a spend may be spread across southern Ontario, into Quebec and as far away as B.C.

Each team has four people -- a driver, a lookout and two people inside at the automatic banking machine.

The team is given a cellphone and a portable safe. At 6 a.m., a call comes in, giving the team the combination to the safe.

Inside are all the counterfeit debit cards to be used during the spend, and the thieves are told not to exceed certain withdrawal thresholds with the cards to avoid setting off security warnings.

And then it's like kids in a candy store. Card after card is inserted, and $480 or $980 is withdrawn time after time.

The thieves have only a small window of time before the cards will get shut down by the banking institutions.

On the other side of the equation, banking institutions are constantly monitoring transactions, looking for suspicious patterns of card activity.

Within half an hour from the start of a spend, the banks will be able to identify that a fraud is taking place.

The banks are able to work backwards in that short period of time to determine the common point of use where all the card information was stolen, whether it was a bank machine, retail outlet or fast-food restaurant, for example.”

How to Protect Yourself

Although HCCU along with The Interac Association is constantly monitoring card usage to protect your account there are many simple ways you can help prevent yourself form being defrauded.

1. Cover up your PIN when entering it.
2. Never let someone at a retail outlet or restaurant walk out of sight with your debit card.
3. Check your bank statements for irregular transactions
4. If you don’t feel comfortable with the transaction, don’t proceed.
5. Change your PIN often

Debit cards will soon come with microchips that will eventually replace the black magnetic stripe used to store information. The chip acts as a small computer allowing the card to interact with the terminal to perform complex security checks. This technology will be mandatory by 2012 for all bank machines and 2015 for retail outlets.

If you have any other questions regarding your debit card, the Interac system, or instances of fraud, please contact your HCCU branch for details.