How to spot a skimmer at a gas pump or ATM
Update: A 19th and 20th card skimmer was found the morning of Dec. 17 at Loves Truck Stop on Cedar Lake Road in Biloxi, police say. An employee was doing routine maintenance and found devices on at least two pumps. It’s believed they were installed between Dec. 14-17. It’s unknown if they captured or transmitted any card information.
Under the cover of darkness, they placed skimmer devices that record debit card and credit card data at local bank ATMs and gas pumps, and put tiny cameras above the key pads to record the personal identifying numbers as customers entered their PINs.
The skimmer thieves returned to download the data gathered from magnetic strips on customers’ cards and their PINs and drove off to start the next steps of their crimes: Turning blank cards into duplicate cards on their victims’ accounts; using the cards as if the accounts were their own; and in some cases, stealing people’s identities.
Dozens of victims across the Mississippi Coast have fallen prey to these crimes, learning after the fact that someone had made unauthorized purchases on their accounts.
If you live on the Mississippi Coast or travel the area, chances are you’ve driven by or made a transaction at one of the places where skimmers have been found. Or maybe you’ve been one of the victims.
The crimes raise a number of questions. Where has this happened? How does it happen? What can stop it? And how safe is it to use your card at an ATM or gas pump?
At least 18 skimmers have been found at a minimum of eight ATMs and gas pumps in Harrison and Jackson counties since January 2017, a Sun Herald analysis shows. The actual number is undoubtedly higher. Documents in federal court, for instance, indicate a larger number of pumps but list no specific details.
Sixteen of the 18 confirmed skimmers were found across Harrison County, where thieves rigged ATMs and gas pump card readers after store hours in Saucier. Suspects in the Saucier crimes hit the same gas station twice in 14 months, according to the sheriff. Deputies found skimmers on four gas pumps in January 2017 and on seven pumps in March.
Where the skimmers were found
Here’s where skimmers have been found over the last two years:
Harrison County: In Saucier, Robinwood One Stop, 18447 U.S. 49; in DeLisle, Chevron, 8329 Firetower Road; in Gulfport, Hancock Whitney Bank, 12240 US 49, and Kangaroo Express (former Circle K), 10406 U.S. 49; in Biloxi, Chevron, 2351 Pass Road; in D’Iberville, Keesler Federal Credit Union, 10521 Auto Mall Parkway and in Long Beach, Kangaroo Express, 124 East Beach Blvd.
Jackson County: In St. Martin, Shell station, 8000 Tucker Road, and in Ocean Springs at Keesler Federal Credit Union, 2420 Bienville Blvd.
While credit card skimming is a crime trend nationwide, Harrison County Sheriff Troy Peterson said the region’s crime wave over the past two years appears to be finished. At least for now.
Some of the same people who have been prosecuted or are being prosecuted for most of the local crimes are from Brazil and were in the U.S. illegally, court papers show.
“People generally can feel safe about using their cards,” Peterson said.
But it could happen again.
“The only thing is you need to look for any tinkering on the pump at an ATM, any signs that something doesn’t look right. There’s precautions you can take.”
How to spot a problem
Some questions for consumers to answer:
- Does the card reader stick out beyond the panel?
- Does the credit card reader protrude outside the rest of the machine or move when you grab hold of it?
- Does the pin pad look thicker than normal?
- Is your card not entering the card reader smoothly?
- Is the security seal on the gas pump broken? (Seals are normally a flat red, but sometimes blue or black.)
One precaution is to grab the hard plastic cover where you insert your card. If if wiggles or comes off, it’s a false overlay attached to a skimmer device. If the security seal on a pump is broken, it’s likely a skimmer has been installed inside the pump.
Also, place your hand over the key pad to make sure that the PIN you enter is blocked from view in case a camera is installed above the card reader.
And check your transactions on an online banking app, paper statement or email and text alerts to spot suspicious payments.
Most of the local crimes at gas pumps occurred near busy thoroughfares — just off Interstate 10, I-110 or U.S. 49.
“These aren’t happening at your mom and pop stores, but the larger businesses that are closed at night,” Peterson said. “The criminals slip in at night and install the skimmers.”
“One thing we’ve asked is that businesses check their pumps every morning and call us if they see a problem. It only takes five minutes.”
How safe is it to use your card at an ATM?
There is hope in sight that these crimes will slow down.
Non-key entries will help, Peterson said of newer gas pumps that don’t require a master key to open. Master keys can be bought online and have been used to install skimmers inside gas pumps in several local crimes, he said. The other type of skimmers is false overlays.
The move toward financial institutions and credit card companies switching to chip-enabled cards instead of cards with magnetic strips can reduce skimmer crimes.
The chip cards are known as EMV. It stands for Europay, Mastercard and Visa, and is an international standard for cards that have computer chips.
Visa, the first company to issue chip-enabled cards in 2011, reports that businesses that have upgraded their card readers to accept chips saw a 75 percent decline in counterfeit in March, compared to September 2015. Sixty-five percent of all U.S. businesses now accept chip cards, Visa says.
What makes the chip-enabled cards safer is that every transaction receives a one-time code. The code becomes invalid after that transaction. Magnetic strips use your card’s information to process payments, making the information accessible to criminals because your account information is encoded inside that strip.
Chip cards are said to be nearly impossible to counterfeit.
And with the chip cards, liability for fraud is shifting from the financial institutions that issue the cards to the ATM operators or issuing institutions, depending on which has up-to-date EMV technology.
Skimming can still happen as long as banks and credit card companies continue issuing cards with magnetic strips instead of chips and criminals taking the chance of not getting caught.
The crimes multiply
Some of the local cases show how quickly the crimes multiply after data is stolen and cards are cloned.
The day after skimmers were first found on gas pumps in Saucier in 2017, video surveillance showed the same suspects using several counterfeit cards made with the stolen data to buy merchandise at the Walmart Supercenter in Gulfport, the sheriff says. The suspects also used a cloned card to make a purchase the same day at a nearby Walgreens.
A few months later, Biloxi police received several complaints from people who had found unauthorized purchases on their accounts. The skimmer was the same type used at the pumps in Saucier. Biloxi police learned the victims had bought gas with their cards at the Biloxi gas station in question.
During the investigation, Gulfport police found skimmers at a gas station on U.S. 49 at Crossroads Parkway.
In one case recently prosecuted, a man from Brazil was ordered to pay $46,264 to Keesler Federal Credit Union for money Keesler reimbursed its victims.
Claudio Fontes Ferreira, aka Michael Camargo Stanford, is one of three people convicted of ATM skimmer fraud in federal court in Gulfport. They admitted they put skimmer devices at Keesler ATMs in D’Iberville and Gulfport over a nine-day period before their arrests on Dec. 7, 2017.
Ferreira was sentenced to 39 months in prison on Sept. 7, and will be turned over to Immigration and Customs Enforcement after serving his time. His two accomplices, a woman also from Brazil and a man from Delray, Fla., received a year or less of prison. A judge ordered his accomplices to each pay Keesler $6,450 in restitution.
In another case, a different man from Brazil was ordered on Dec. 3 to pay $25,087.50 to Keesler Federal for stealing customers’ data at ATMs in Ocean Springs and hijacking the cardholders’ accounts. Ricardo Arcanjo Ramos, 37, also was sentenced for stealing the identity of a Forrest County resident.
Ramos had more than 15 cloned bank cards when he was pulled over in a traffic stop in Gulfport. By the time he reached Florida, state troopers said they found all the items needed to steal data and record PIN numbers.
Ramos had the account information of more than 250 people stored in a laptop, a court document said. He and others used people’s numbers to obtain money and transfer funds days later in Florida at a resort and two banks.
If you’re a victim
If you notice unauthorized activity on your debit card, contact your bank as soon as possible. Here’s what the Federal Trade Commission says about your liability:
- If you report theft within two business days, your maximum loss will be only $50, regardless of how much money has been stolen from your account.
- If you report theft after two business days but less than 60 calendars after your bank statement is sent to you, your maximum loss will be $500.
- If you report theft more than 60 days after your statement is sent to you, you won’t get reimbursed for any of your losses.