The Sound of Stealing: Crooks Make ATM Skimmers Out of Old MP3 Players

13 October 2011 | 01:59 PM ET | Matt Liebowitz, SecurityNewsDaily Staff Writer

CREDIT: Dreamstime

MP3 players have revolutionized the way we listen to music, but these tiny technological marvels are also breathing new life into the dark world of ATM skimming and credit-card counterfeiting.

In forging head-on into the cybercrime underground, noted reporter Brian Krebs discovered that criminals are selling ATM skimmers that use parts from MP3 players to record audio files of the data stored on a credit card's magnetic stripe as it passes through the ATM. (The magnetic stripes are basically short lengths of audio cassette tape.)

Krebs, in his Krebs on Security blog, detailed one particular skimmer designed to fit over a Diebold Opteva 760, "one of the most common ATMs around."

Wired to the circuit board from an MP3 player, the ATM skimmer "hears the data stored on the card's magnetic stripe, and records it as an audio file to a tiny embedded flash memory device." After the audio is captured, crooks can then convert it to a digital format that can be written onto the blank magnetic stripe of a new ATM card.

[How to Protect Your Debit Card From Skimming Scams]

Skimmers only steal credit and debit card information from the part of the ATM where customers slide in their cards. A skimmer does not capture a person's PIN, but many skimmers, including the one Krebs profiled, come with a camera that records people manually entering their PINs into the ATM keypad. The whole rig, with the camera included, costs $1,500 and has a six-hour battery life.

This devious technology is not new, but Krebs said that it's becoming more prevalent in cybercrime markets because after the audio is captured using the MP3 parts, the perpetrator then needs to decrypt the information. So along with the audio-capturing skimmer , Krebs said the buyer also needs to purchase a decryption service.

The seller of the skimmer Krebs profiled works in tandem with another fraudster "who will decrypt the audio files in exchange for 20 percent of the stolen card numbers and PINs."

A skimmer with MP3 parts is a step up for fraudsters, who in the past have made similar devices using cassette players to capture audio from a card's magnetic stripe. High-tech ATM skimmers have been behind notable and massive incidences of fraud, including the theft of tens of thousands of dollars from Houston-area ATMs this summer.

North American financial-card issuers are slowly beginning to move away from the 50-year-old magnetic-stripe technology to the more secure "chip and PIN" system used in Europe. But until then, card users in the U.S. and Canada will have to be on guard for funny-looking or mismatched parts on ATMs.

Would you like to subscribe to our weekly newsletters?