ATM-card cloning tools sold on the Net

However, constant monitoring of ATMs and banking halls can help foil crooks with skimming tools

By Natalie Soh

TOOLS which allow crooks to clone automated teller machine (ATM) or credit cards are easily available and can be bought via the Internet, security consultants said.

'You could basically mail-order the entire thing, it's very simple,' one of them noted.

The use of such skimming equipment, particularly by crooks, came into focus recently when they cloned the ATM card of a DBS Bank customer after she used it to withdraw money in Kuala Lumpur.

In this case, the culprits had installed the device secretly at the ATM and copied data from her card when she inserted it into the slot unwittingly.

A pin-hole camera then filmed her as she keyed in her personal identification number (PIN). She found out she had lost about $3,700 to thieves only after returning here.

While similar cases have not been reported here, IT consultants told The Straits Times that the cloning devices work by zapping the encrypted numbers stored on the magnetic strips of the ATM cards.

Banks have their own master codes that can unscramble the numbers on their cards once they are inserted into a cash machine. Even so, the machine will approve the transaction only after users key in their PIN to unlock the codes.

But Ms Toh Shau Ching, National Computer System's general manager of financial services, said such a system would fail once thieves were able to copy the user's card number and PIN.

Agreeing, Mr Ronald Poon of Chubb Singapore, which has extensive expertise in ATM security, said: 'They can put in a cloning device - think play dough where you imprint the shape of the key - that can capture the information on the magnetic strip.'

These magnetic-card readers, which are available on the Internet for US$10 (S$17.49), are similar to the machines found beside cashiers of supermarkets or shopping centres which capture card information with just a swipe.

As for capturing the PIN, crooks can install a pin-hole wireless camera about the size of a 50-cent coin on top of the keypad and watch the entire transaction from about 20 m away.

To create clone cards, crooks normally use commercial card writers - which can be bought for just US$26 - to transfer information onto blank magnetic cards which cost US$28 for a thousand pieces.

Said one security consultant: 'You see, companies need these to create membership cards for example. So these are actually fairly easy to obtain.'

If so, what can consumers do to protect themselves?

Said Mr Poon: 'Never give away or write down your PIN number. Don't let a stranger help you with your transaction.'

And if you have problems slotting in your card, it could mean that someone has already tampered with the ATM.

'Call the bank immediately,' he said.

Ms Toh noted that while ATM cards can be made 'clone-proof' by embedding a microchip in the cards, the move may not be practical now as it could mean changing all ATMs here and abroad to allow the data on the chip to be read.

Until that happens, she said, 'banks need to have constant monitoring of their ATMs and banking halls, with closed-circuit TVs to make sure no one is tampering with their machines in the first place'.

Copyright Family Guardian Fellowship