News @ AsiaOne

Stealing ATM card data is easy: Experts

Magnetic strips used in ATM cards are old technology and are vulnerable to skimming. Experts say anyone can buy an electronics card reader to steal capture data illegally. -AsiaOne

Sun, Jan 08, 2012

Technology experts told The Straits Times that magnetic strips used in ATM cards are old technology and vulnerable to skimming.

Dr Derek Kiong, a computer security lecturer at the Institute of Systems Science, National University of Singapore, told the English daily that anyone can buy an electronic card reader to 'read' the information on the magnetic strip.

After personal information embedded in the magnetic strip of the ATM card and the cardholders' PINs (personal identification numbers) are stolen, ATM cards can be cloned using a $300 machine sold in places like Sim Lim Square.

These machines are sold openly because they are used by organisations such as spas and department stores to create loyalty cards for customers.

Other experts said cyber thieves target ATMs because they can physically get at the money and disappear after breaking into an ATM.

Such skimming attacks can also happen at shops, petrol stations and convenience stores.

For example, a shop assistant can simulate an ATM card transaction by swiping the ATM card and letting the customer key in the PIN.

The data he captures electronically is not sent to the bank but collected by him. After enough data is collected, he clones the cards and steals money from the cash machines.

ATM card security have been under scrutiny after $500,000 were stolen from about 400 customers in two days as part of what was believed to be an ATM-skimming scam.

US$114 billion (S$147 billion) were lost globally to cyber thieves in 2011, according to research company Symantec. This sum includes time spent to recover the lost money.

Future solutions

According to The Straits Times, the best prevention against such ATM fraud would be to switch to a smart card technology that embeds computer chips into cards.

An important lesson on card skimming fraud
Click on thumbnail to view

The computer chips encrypt personal information and make it tougher for thieves to steal the date.

But practical difficulties mean this solution will not be adopted anytime soon.

For example, it would be difficult for banks to switch to smart cards as it would mean an overhaul of the entire ATM system, an expert said.

Retail outlets and other organisations that use ATMs will also need to change their equipment, he added. This would mean hefty investments.

His opinion was mirrored by Mr Jeremy Soo, DBS Bank's managing director and head of consumer banking Singapore at a press conference last Friday.

Mr Soo said that if a bank switched to smart cards, all local and overseas organisations using ATM cards will have to change their equipment.

This would mean that anyone who visits an overseas country without a smart ATM card system will not be able to use his card to withdraw money or pay for items.

However, DBS is looking into it and will consider doing it when the time is right, The Straits Times said.

Copyright ©2011 Singapore Press Holdings Ltd. Co. Regn. No. 198402868E. All rights reserved.
Privacy Statement Conditions of Access Advertise