• IP addresses are NOT logged in this forum so there's no point asking. Please note that this forum is full of homophobes, racists, lunatics, schizophrenics & absolute nut jobs with a smattering of geniuses, Chinese chauvinists, Moderate Muslims and last but not least a couple of "know-it-alls" constantly sprouting their dubious wisdom. If you believe that content generated by unsavory characters might cause you offense PLEASE LEAVE NOW! Sammyboy Admin and Staff are not responsible for your hurt feelings should you choose to read any of the content here.

    The OTHER forum is HERE so please stop asking.

Basics of Card Skimming

UMNO Terrorist said:
There are actually very well developed devices that the syndicates tailored to fit the ATM machines. It consist of card reader which reads magnetic strips of ATM cards was you slot

DBS has their own attachment at the opening of the card slot to prevent another device from attaching to the ATM. You have to remove the original adapter before you can do it. Don't know how they do it. These people go to great lengths.
 
Last edited:
Leongsam said:
The skimmers don't leave their devices on the machine. They install them quickly, get the data they need to clone cards, then come back and remove the hardware... all within hours.

Most of the time, the skimming equipment is held on by nothing more than double sided tape. It can be ripped off in less than 10 seconds and nobody would be any the wiser.

They will also have to re-install the devices that DBS has at their card-slots to delay the detection to give them time to fabricate the fraud cards and transfer the money. The longer this stays undetected the more money they can withdraw.
 
DBS has their own attachment at the opening of the card slot to prevent another device from attaching to the ATM. You have to remove the original adapter before you can do it. Don't know how they do it. These people go to great lengths.

check my post #20 ;)
 
[video=youtube;Ns80IjFHyrg]http://www.youtube.com/watch?v=Ns80IjFHyrg[/video]
 
theres also a pocket card skimming using bluetooth ( dont even need to install in atm ;) ) ;) very popular in eroupe ...within seconds they can get your pin

How is the PIN captured? As far as I can see, all they get is the CC magnetic strip details.

CCs can be used without PINS.
 
DBS has their own attachment at the opening of the card slot to prevent another device from attaching to the ATM. You have to remove the original adapter before you can do it. Don't know how they do it. These people go to great lengths.

Those aren't foolproof. They have been breached many times in NZ.
 
Let me share what i know if anyone's interested.
I got no intention to talk down or sound yaya but i have to agree with Scoobal and Sam.
This type of scam has been going on for years and yet sinkies think its the first moon landing.


Story goes back to 1991 when a guy assembled a crew and committed the first crime of this sort in singapore.
I knew all 4 of them inside the prison. I recount as much as i can remembered.

There was a mastermind and he recruited 3 other fellows, a goldsmith employee from Toa Payoh, a NTUC cashier from Bedok and another guy.

The mastermind went to manufacturer of plastic magnetic strip cards in malaysia and told them he need credit card type employee cards for his factory workers in singapore. He learned how to embed particulars into the card and bought the machine together with the thousands of blank cards.
With that he got his crew to stand behind people making withdrawals at atm to peep at their pin numbers then retreived the reciepts which used to have full bank accounts and other personal info. All these info were embedded into the clone cards and they were literally printing money.
The banks and police were puzzled after there were complains of illegal atm withdrawals and as cctv footage showed strangers making withdrawals without the atm cards being stolen....
They only start to realised after programming atms to capture the cards of the accounts that were compromised. And only when they saw the blank cloned cards then they had an inkling of what was happening.
Meanwhile the weak link was spotted as members got lazy and did not stand in line to note pin numbers rather the NTUC cashier just conveniently mined the info from customers that used nets at his cashier counter. This led to the downfall as police noticed all the cloned cards had a patttern of using their cards at this particular bedok NTUC outlet.

After a few weeks and less than a million scammed the whole crew was rounded up. This case has huge repercussions on the local banking industry's standards and many security features were added on from then. Periodically there were similar cases but all focused mostly on credit cards....the last big one locally...a one man operation which netted close to 1-2 million the guy got a consecutive sentence of 12 years.

Back to skimming, usually reserved more for credit cards, as there is no pin required and they get the money by buying goods rather than atm withdrawls.
The ways to skim cards are ingenuious, some angmo syndicates ever set up fake atm to skim info. The atm would says it looks and operate like a real one and would say it ran out of money and return the card.
Cloned credit cards are still very rampant there was a recent big case from US and the mongolians that came to singapore. I knew people who recruited foreigners to be shoppers using fake credit cards. Some work with the shops some dun. And you either work for them or you buy their cards with a guarranteed credit limit....a certain discounted % to the dollar.

scrobal was right that back in the 90s VISA was no go in malaysia. you travel only with mastercard.
 
How is the PIN captured? As far as I can see, all they get is the CC magnetic strip details.

CCs can be used without PINS.

Sorry for my mistakes .. They don't need pin they just clone another card and make purchase using the cloned cards ..
 
Last edited:
Let me share what i know if anyone's interested.
I got no intention to talk down or sound yaya but i have to agree with Scoobal and Sam.
This type of scam has been going on for years and yet sinkies think its the first moon landing.


Story goes back to 1991 when a guy assembled a crew and committed the first crime of this sort in singapore.
I knew all 4 of them inside the prison. I recount as much as i can remembered.

There was a mastermind and he recruited 3 other fellows, a goldsmith employee from Toa Payoh, a NTUC cashier from Bedok and another guy.

The mastermind went to manufacturer of plastic magnetic strip cards in malaysia and told them he need credit card type employee cards for his factory workers in singapore. He learned how to embed particulars into the card and bought the machine together with the thousands of blank cards.
With that he got his crew to stand behind people making withdrawals at atm to peep at their pin numbers then retreived the reciepts which used to have full bank accounts and other personal info. All these info were embedded into the clone cards and they were literally printing money.
The banks and police were puzzled after there were complains of illegal atm withdrawals and as cctv footage showed strangers making withdrawals without the atm cards being stolen....
They only start to realised after programming atms to capture the cards of the accounts that were compromised. And only when they saw the blank cloned cards then they had an inkling of what was happening.
Meanwhile the weak link was spotted as members got lazy and did not stand in line to note pin numbers rather the NTUC cashier just conveniently mined the info from customers that used nets at his cashier counter. This led to the downfall as police noticed all the cloned cards had a patttern of using their cards at this particular bedok NTUC outlet.

After a few weeks and less than a million scammed the whole crew was rounded up. This case has huge repercussions on the local banking industry's standards and many security features were added on from then. Periodically there were similar cases but all focused mostly on credit cards....the last big one locally...a one man operation which netted close to 1-2 million the guy got a consecutive sentence of 12 years.

Back to skimming, usually reserved more for credit cards, as there is no pin required and they get the money by buying goods rather than atm withdrawls.
The ways to skim cards are ingenuious, some angmo syndicates ever set up fake atm to skim info. The atm would says it looks and operate like a real one and would say it ran out of money and return the card.
Cloned credit cards are still very rampant there was a recent big case from US and the mongolians that came to singapore. I knew people who recruited foreigners to be shoppers using fake credit cards. Some work with the shops some dun. And you either work for them or you buy their cards with a guarranteed credit limit....a certain discounted % to the dollar.

scrobal was right that back in the 90s VISA was no go in malaysia. you travel only with mastercard.


yo are right ...if i remember correctly the market rate then was $800 and the credit limit was $2000 if you were to buy each of the cloned card .
 
They will also have to re-install the devices that DBS has at their card-slots to delay the detection to give them time to fabricate the fraud cards and transfer the money. The longer this stays undetected the more money they can withdraw.

Chances are the skimmer will simply be installed OVER the security sleeve. There will be no need to remove it.
 
Only some "wannabe" criminal actuals PAYS for this daddydumps carders..

a) nothing is delivered
b) a pile of made up rubbish is delivered
c) a list of 'blocked' card data is delivered

REAL criminals use REAL stolen card details to extract REAL cash from the victims .. once the card is 'blocked' they sell the details on to morons ..in DumpsDaddy

malaysia actually rejected all Magnetic strips cards and only acept thse with EMV chip Euro compliant.

Let's see how this last.

AS for portable skimmer, it was already exposed ages ago when several waiters were jailed at high end restaurants in manhattan skimming off the Top credit card holders before presenting bill to cashier.

Police Charge 3 in Huge Manhattan ATM Skimming Scam | ATM ...

http://www.securitynewsdaily.com/manhattan-atm-skimming-scam-1342/

and it gets better and better...here's another hard case

How Cybercrime Gang Stole $13 Million in 1 Day
http://www.securitynewsdaily.com/how-cybercrime-gang-stole-13-million-in-1-day-1102/

A coordinated cybercriminal network pulled off one of the largest and most complex banking heists ever, withdrawing $13 million in one day from ATMs in six countries.

The massive breach hit Fidelity National Information Services Inc. (FIS), a Jacksonville, Fla.-based firm that processes prepaid debit cards. FIS disclosed the breach on May 5, but security researcher Brian Krebs dug deeper and found out the true scope of the devastating crime, which he reported in his KrebsonSecurity blog.


According to Krebs' sources, the attackers first broke into FIS' network and gained unauthorized access to the company's database, where each debit card customer's balances are stored.

FIS' prepaid debit cards include a fraud protection policy that limits the amount cardholders can withdraw from an ATM with a 24-hour period. Furthermore, once the balance on the cards is reached, the cards cannot be used until their owners put more money back onto the cards.

Here's where the criminals got crafty: they obtained 22 legitimate cards, eliminated each card's withdrawal limit, and cloned them, sending copies to conspirators in Greece, Russia, Spain, Sweden, Ukraine and the United Kingdom. When the prepaid limit on each card got too low, the hackers simply reloaded the fraudulent cards remotely.

At the close of the business day on Saturday, March 5, the criminals began taking out money from ATMs. By Sunday evening, the scam was over, and the attackers had stolen $13 million.

Krebs said it is not clear who is behind the attack on FIS, although the characteristics of the scheme put it in line with similar crimes perpetrated by cybercriminals in Estonia and Russia.

Well here's another one :-

Thermal Cameras Use Heat to Steal ATM PINs http://www.securitynewsdaily.com/thermal-cameras-use-heat-to-steal-atm-pins-1068/

Now there's another reason to keep your cash under your mattress — criminals can steal your ATM PIN using thermal cameras.

Researchers from the University of California, San Diego carried out a series of proof-of-concept attacks using a thermal camera mounted above a traditional ATM pinpad. Reading images captured by the camera of residual heat left on keys, the researchers were able to detect the numbers that were pressed

In some cases, depending on the size of the thermal imprint, the researchers could even detect in which order the keys were pressed, the security firm Sophos reported.

Researchers Keaton Mowery, Sarah Meiklejohn and Stefan Savage presented their paper, "Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks" at last week's USENIX Security Symposium in San Francisco.

Their tests, using 27 randomly selected four-digit codes on both plastic and brushed metal PIN pads, revealed that, although the metal PIN pad made thermal detection attacks almost impossible, the plastic PIN pads with rubber keys are a goldmine for potential thieves, because they are able to detect a person's keystrokes after he's left the ATM.

[Hear That? It's Your Bank PIN Being Stolen]

Unlike metal keys, which retain heat for only a few seconds due to their high conductivity, rubber keys retain heat much longer. Long enough to cause a serious problem: The researchers detected PINs with approximately 80 percent accuracy 10 seconds after the person entered their PIN. Forty-five seconds after being pressed, the thermal cameras were still able to determine PINs with 60 percent accuracy. By this time, the target is presumably driving away as his bank account is being raided.

Traditional cameras used in ATM skimming attacks won't get the job done if the target blocks the camera's line of sight using their forearm or hand, for example. Thermal cameras, however, bypass such obstruction techniques by capturing the heat left over after the potential victim has left.

"Using a thermal camera instead provides an attacker the ability to recover the code even in the cases where, for example, a user's body is blocking the keypad throughout the transaction, or he just covers the keypad with his hand as he types in the PIN," the researchers wrote.

For now, there are no reports of thermal-camera based attacks, which could have something to do with the cost — the researchers' camera cost $1,950 per monthly rental and $17,950 to buy. But when the potential reward of this hack is so high, it's only a matter of time before these heat-seeking cameras become part of an ATM thief's arsenal.

In the meantime, it's a good idea to stick to metal ATM keypads, or, better yet, go right to the bank teller. And if you're banking from your mobile phone or computer, make sure your bank's website is typed correctly and the URL is highlighted in green, meaning you've set up a secure, encrypted HTTPS connection.

Australia and NZ's ATm technology are in stone ages, so is Singapore's thus,the crime.
The Most secure ATM network to withdraw cash from is from ATM5 network - the shared network between citibank Stanchart,maybank,SBI....they only accept EMV CHIP withdrawals and are located in a confined space, under Chubb police watch 24/7, not along some Ulu passage way along Bugis.
 
Last edited:
Card skimming is just like ass rimming: it's almost like the real thing, but soon you realize that you're getting fucked.
 
Pro Grade (3D Printer-Made?) ATM Skimmer Uncovered

http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made-atm-skimmer/

In July 2011, a customer at a Chase Bank branch in West Hills, Calif. noticed something odd about the ATM he was using and reported it to police. Authorities who responded to the incident discovered a sophisticated, professional-grade ATM skimmer that they believe was made with the help of a 3D printer.

Below is a front view image of the device. It is an all-in-one skimmer designed to fit over the card acceptance slot and to record the data from the magnetic stripe of any card dipped into the reader. The fraud device is shown sideways in this picture; attached to an actual ATM, it would appear rotated 90 degrees to the right, so that the word “CHASE” is pointing down.



On the bottom of the fake card acceptance slot is a tiny hole for a built-in spy camera that is connected to a battery. The spy camera turns on when a card is dipped into the skimmer’s card acceptance slot, and is angled to record customer PINs.

The bottom of the skimmer device is designed to overlay the controls on the cash machine for vision impaired ATM users. On the underside of that space is a data port to allow manual downloading of information from the skimmer.

Looking at the backside of the device shows shows the true geek factor of this ATM skimmer. The fraudster who built it appears to have cannibalized parts from a video camera or perhaps a smartphone (possibly to enable the transmission of PIN entry video and stolen card data to the fraudster wirelessly via SMS or Bluetooth). It’s too bad so much of the skimmer is obscured by yellow plastic. I’d welcome any feedback from readers who can easily identify these parts based on the limited information here. Continue reading →
 
Last edited:
Re: Pro Grade (3D Printer-Made?) ATM Skimmer Uncovered

why can't singapore stop using PINS and start using cashless card to fight off this card skimming, the popularity of PINS make us a target for card skimmer.

Like in Japan, they have Suica,
N-Suica1.jpg


Edy
Edy.jpg



nanaco
nanaco.png


waon
b0089515_13362083.jpg


The only problem in japan is that there are too many different cards, and different place support different card.

and many many more
 
Re: Pro Grade (3D Printer-Made?) ATM Skimmer Uncovered

Hope people now realise that its is not rare but an everyday event. That they do not have to worry as banks will readily reimburse because they known how to handle these cases. Its harder to explain and get your money back when the ATM does not reimburse the cash after you the card in.

Couple of other things to address urban myths or guesswork. There is a reason why REAL people do not build their own cars, or build many things on their own. Card dumps are compromises involving large merchant outlets or processors or integrators. Card accounts counts gleaned come in their thousands. Usually occurs in the US or Europe. They do not involve PIN due to their high security requirements. They involve firewalls being breached and card data stolen. These cards data are then put on counterfeit cards and used at various stores usually jewrllery and watches but nto ATMs as PIN is required. Because they are in their thousands, it will require an army to turn the data into cash. It is thefore sold online across the world.

The centre of the trade is in Amsterdam. Regulars have to build a history with the sellers before a large amount is is sold straight. Merchants are also known to have purchased these accounts online and processed thru their business in volumes and its straight cash into the bank for them. However the bank that handles their merchant card account will eventually close them in a few weeks they realise that too many fraudulent accounts have passed thru.

Here is an excellent article.

http://www.transactionworld.net/articles/2009/october/cover_story.asp
 
Last edited:
Card skimming is just like ass rimming: it's almost like the real thing, but soon you realize that you're getting fucked.

Ass Rimming...yeah .like this ...Why GSM-Based ATM Skimmers Rule

http://krebsonsecurity.com/2010/12/why-gsm-based-atm-skimmers-rule/

Earlier this year, KrebsOnSecurity featured a post highlighting the most dangerous aspects of GSM-based ATM skimmers, fraud devices that let thieves steal card data from ATM users and have the purloined digits sent wirelessly via text message to the attacker’s cell phone. In that post, I explained that these mobile skimmers help fraudsters steal card data without having to return to the scene of the crime. But I thought it might be nice to hear the selling points directly from the makers of these GSM-based skimmers.


A GSM-based ATM card skimmer.

So, after locating an apparently reliable skimmer seller on an exclusive hacker forum, I chatted him up on instant message and asked for the sales pitch. This GSM skimmer vendor offered a first-hand account of why these cell-phone equipped fraud devices are safer and more efficient than less sophisticated models — that is, for the buyer at least (I have edited his sales pitch only slightly for readability and flow).

Throughout this post readers also will find several images this seller sent me of his two-part skimmer device, as well as snippets from an instructional video he ships with all sales, showing in painstaking detail how to set up and use his product. The videos are not complete. The video he sent me is about 15 minutes long. I just picked a few of the more interesting parts.

One final note: In the instruction manual below, “tracks” refer to the data stored on the magnetic stripe on the backs of all ATM (and credit/debit) cards. Our seller’s pitch begins:

“Let say we have a situation in which the equipment is established, works — for example from 9:00 a.m., and after 6 hours of work, usually it has about 25-35 tracks already on hand (on the average machine). And at cashout if the hacked ATM is in Europe, that’s approximately 20-25k Euros.


The back of a GSM-based PIN pad skimmer

So we potentially have already about 20k dollars. Also imagine that if was not GSM sending SMS and to receive tracks it would be necessary to take the equipment from ATM, and during this moment, at 15:00 there comes police and takes off the equipment.

And what now? All operation and your money f#@!&$ up? It would be shame!! Yes? And with GSM the equipment we have the following: Even if there comes police and takes off the equipment, tracks are already on your computer. That means they are already yours, and also mean this potential 20k can be cash out asap. In that case you lose only the equipment, but the earned tracks already sent. Otherwise without dumps transfer – you lose equipment, and tracks, and money.

That’s not all: There is one more important part. We had few times that the police has seen the device, and does not take it off, black jeeps stays and observe, and being replaced by each hour. But the equipment still not removed. They believe that our man will come for it. And our observers see this circus, and together with it holders go as usual, and tracks come with PINs as usual.

However have worked all the day and all the evening, and only by night the police has removed the equipment. As a result they thought to catch malicious guys, but it has turned out, that we have lost the equipment, but results have received in full. That day we got about 120 tracks with PINs. But if there was equipment that needs to be removed to receive tracks? We would earn nothing.”


Front view of a GSM-based PIN skimmer

And what about ATM skimmers that send stolen data wirelessly via Bluetooth, a communications technology that allows the thieves to hoover up the skimmer data from a few hundred meters away?

“Then after 15 minutes police would calculate auto in which people with base station and TV would sit,” says our skimmer salesman. “More shortly, in my opinion, for today it is safely possible to work only with GSM equipment.

Aside from personal safety issues, skimmer scammers also must be wary of employees or co-workers who might seek to siphon off skimmed data for themselves. Our man explains:

“Consider this scenario: You have employed people who will install the equipment. For you it is important that they do not steal tracks. In the case of skimmer equipment that does not transfer dumps, the worker has full control over receiving of tracks.

Well, you have the right to be doing work in another country. And so, people will always swear fidelity and honesty. This normal behavior of the person, but do not forget with whom you work. And in our situation people have no tracks in hands and have no PINs in hands. They can count quantity of holders which has passed during work and that’s all. And it means that your workers cannot steal any track.



I have listed only some situations in which GSM skimmers have obvious and total advantage before all other models. Do not ask me why I sell the equipment. I do not like this question. It’s my business why I drink coffee in the mornings why I go on trainings every day, and why I sell that or I do not sell. It’s my business.”

In the first video, we see our masked skimmer maker using a mock-up ATM to illustrate how to attach and reset his skimmer devices. The second movie shows the GSM card attached to the PIN pad overlay. In the final video, our skimmer seller demonstrates how to attach the SIM card to the ATM card skimmer module.
 
This type of scam has been going on for years and yet sinkies think its the first moon landing.


Story goes back to 1991 when a guy assembled a crew and committed the first crime of this sort in singapore.
I knew all 4 of them inside the prison. I recount as much as i can remembered.

I think this was shown on crime watch one of the older episodes.
 
Re: Pro Grade (3D Printer-Made?) ATM Skimmer Uncovered

Oh yeah wanna see how RFID sniffer harvest your Visa Paywave RFID credit cards , Watch how this souped up RFID scanner swipes RFID cards from public.

It's brand new technology, the rise of E-thieves .

RFID Hijacking...yeah....the mac daddy of them all.

http://www.youtube.com/watch?v=GjOduug-SC8
 
Back
Top