Gangs develop new chip-and-pin fraud

[The Venetian]

August 13, 2008

The new ‘card-skimming’ scam came to light after police raided an alleged card fraud factory in Birmingham on Monday.

Criminal gangs have found a new way to steal people’s payment card details and raid their bank accounts by tampering with the chip-and-pin machines in shops. Police warned that fraudsters have been hiding devices inside checkout card machines to access the details of any card that is used.
The criminals then clone new cards and withdraw money abroad where the chip-and-pin system is not yet in use.
The new ‘card-skimming’ scam came to light after police raided an alleged card fraud factory in Birmingham on Monday.

Officers said 30 checkouts in the UK had been affected by the new type of fraud, with petrol stations most likely to be targeted by fraudsters.
During the Edgbaston raid, stolen chip and pin terminals, card account numbers, card readers, computer software and counterfeit magnetic strip cards were recovered.
It is thought thieves steal the card readers from shops or manufacturers and install a hidden device which logs information when a customer enters their pin number.
The reader is then put back in a shop, supermarket or petrol station, sometimes with the collusion of a member of staff.
Fraudsters use the information to create fake cards to withdraw cash in countries where chip-and-pin has yet to be introduced.
Chip-and-pin technology has been hailed as a success in reducing card fraud in the UK since its introduction in 2006.
Apacs, the UK Payments Association, said that over the past three years losses on high street transactions fell from £218.8m in 2004 to £73m last year.
But card fraud abroad has increased by 77 per cent in the past year, and costs £207.6 million, according to the specialist police force for card fraud in the UK, the Dedicated Chip and Plastic Crime Unit (DCPCU). Banks throughout Europe have agreed to bring in chip-and-pin cards by 2010.



Detective Inspector John Folan, head of the DCPCU said: “We are sending a very clear warning to fraudsters that these crimes will not be tolerated, and that we will continue to target them and disrupt their fraudulent activity,” he said.
Police want to hear from any retailer who has had chip-and-pin readers stolen or believe their machines have been tampered with.
Monday’s raid followed the launch of an investigation into how shoppers at an Asda store in Gosport near Portsmouth, Hampshire, lost thousands of pounds from their accounts.
Customers reported money being withdrawn from their accounts in Canada and China. Around 20 people have so far reported fraudulent withdrawals.



Margaret Galea, 66, a Barclays account holder from Gosport, said: “I did my shopping at Asda then received a letter from Barclays saying there had been some suspicious withdrawals from my account.
“I checked and there had been five cash withdrawals from the Royal Bank of Canada of about £1,000 in total.
“It’s odd to think it’s happening so far away and it’s awful because I’m a pensioner and I don’t have a lot of money - they have just wiped me out.”
An Apacs spokeswoman said it was too soon to link the Gosport incident to the new wave of card-skimming attacks.
Spokeswoman Sandra Quinn added that inquiries were continuing into exactly how the criminals downloaded the information from the hacked chip-and-pin machines.
She said that chip-and-pin remains the safest method of payment for goods and services. The Banking Code should ensure that any victims are refunded for any losses.
She said: “Whereas fraudsters used to put pinhole cameras above the chip and pin device to get hold of the pin number, they now manipulate the chip and pin terminal to get that basic data.
“They steal readers from retailers, cracking them open, and try to recreate one and then put it back in a shop.
“We have been aware that this has been going on because police have been getting reports that terminals are being stolen.”
She added: “Fighting fraud is a shared responsibility and we continue to work with law enforcement and the retailers to tackle the organised criminal gangs responsible.
Jane Milne, of the British Retail Consortium, said: “Customers should be assured that UK retailers always take the protection of cardholder data seriously and are continuing to invest millions of pounds to enhance existing security measures.”
Two people have been charged with conspiracy to defraud after the Edgbaston, Birmingham, raid.

Gangs develop new chip-and-pin fraud - Times Online