New security threat: Cash register skimmers
By: Herb Weisbaum
|
|
|
Source: Aventura Police Department
Crooks who steal credit and debit card numbers have found a devious new way to snag this information. They're using a small, relatively cheap piece of off-the-shelf technology to compromise computerized store cash registers.
We know about this because a band of brazen thieves was caught on security cameras installing these high-tech skimmers on cash registers at the Nordstrom store in Aventura, Fla., two weeks ago.
The skimmers are built into standard Ps2 cable connectors that plug into the back of a computer where customers can't see them. They're only about an inch long—and look so innocuous that even if employees saw them they might not suspect anything.
(Read more: Paying cash costs Americans $200 billion a year)
"It's a little piece of plastic, usually purple, that fits into the port where your keyboard connects to your computer," said security analyst Brian Krebs, who first reported this story on his KrebsOnSecurity blog. "It intercepts any data that is sent on that communication channel, whether it's keystrokes or somebody swiping a card through a terminal."
Ps2 keystroke loggers have been available for years. They sell for as little as $40 and are marketed as "professional surveillance products." Krebs said this is the first time he's ever heard of them being used to skim card information from a retailer.
Nordstrom confirmed that it had found and removed "unauthorized devices on a small number of cash registers" at its Aventura store.
"We take this situation seriously and have been working closely with law enforcement and forensics experts to investigate this and understand any impact on our customers," Nordstrom spokesperson Tara Darrow said in a statement to NBC News. Darrow said they believe this was an isolated incident at this one store in Florida.
(Read more: Scammers target utility customers)
No arrests have been made, and because the case is still under investigation, the Aventura Police Department would not comment on it or provide NBC News with a copy of the incident report.
Consumer behavior 'healthy' despite shutdown: Expert
Tuesday, 15 Oct 2013 | 10:48 AM ET
Martin Franklin, executive chairman at Jarden, explains why the government shutdown has not had a negative impact on his company.
But Krebs obtained a copy of an information sheet prepared by the Department's Crime/Intel Analysis Unit that says Nordstrom located a total of six skimming devices attached to registers.
The alert outlined what was seen on the the retailer's surveillance footage. The thieves, all men, worked in teams of three. Two men distracted the sales staff while a third took pictures of the register, then removed its rear access panel and took additional photos.
Several hours later, three different men entered the store. Again, two of them distracted the sales staff while the third removed the register's back panel and installed the skimmer. The police memo described the device:
It captures all track data from credit card transactions and stores it on the device, similar to a USB drive. The connector was made to match the connections on the back of the register to include color match. Therefore, no one would have detected it unless there was a problem with the register.
It's unlikely customer card information was compromised in this case, as the devices were discovered before the crooks could retrieve them and download the information they had recorded. But for as little as $135 they could have purchased keystroke loggers capable of sending the stolen information over a local wireless network.
Victor Searcy, director of the Fraud Resolution Center at IDentity Theft 911, said he wasn't surprised the bad guys have found "yet another nefarious method" for stealing consumer's personal information.
"This scheme, involving smaller, harder-to-detect skimming devices, puts the onus on businesses to heighten their security efforts," Searcy said.
(Read more: Recall: Surge protectors could cause fire)
Many retailers have card readers that connect to cash registers via Ps2 connections. These are now vulnerable to this kind of skimming attack and need to be secured.
The bottom line
We all need to be aware of the potential for this sort of identity theft. It can happen no matter how hard you try to protect yourself. So you need to remain vigilant.
That's why it's so important to continually review all the transactions on your credit card and bank account statements. If you spot charges that aren't yours, report them right away. And if you're at a store and see someone tampering with a register, say something to a store employee.
—By CNBC contributor Herb Weisbaum. Follow him on Facebook and Twitter
@TheConsumerman
No comments:
Post a Comment