Credit unions hit by ATM skimmers are likely victims ofmulti-tier crime rings recruiting young people online and payingthem for their efforts, according to a defense attorneyspecializing in Internet crime and technology law.

Meg Strickler of Conaway & Strickler in Atlanta saidskimming outbreaks, such as the recent one in Wisconsin, whichinvolved over a dozen devices, are often part of bigger criminalenterprises.

Be sure to register today for Data Breach Defense, the free CUTimes cybersecurity virtual conference on Oct. 6. Find out thelatest credit union liability and risks, as well as securitymeasures you can take to ward off cybercriminals.

Building the Pyramid

“What usually happens is someone says, 'You can make $800 bygoing into the bank and withdrawing $1,000,' or, 'Take $1,000 out;I'll give you $800,'” Strickler explained.

Skimmers often don't know each other personally; the recruitingis often via the Internet, she said.

“The people tend to go after 18- to 25-year-old women who arecollege kids,” she added.

Sometimes people enter the fray after dating someone who knowshigher-end criminals, she said.

Strickler said criminals even pay people $20 or $40 to assemblea skimming device and then sell or mail them.

“It's a pyramid scheme where the lower guys are making $800while the guys in [other countries] are making billions of dollarsin 10 minutes,” she said.

“They're just being manipulated and screwed with and used,” shesaid. “The criminals abuse that part, too. They're like, 'OK, let'sgo get those people to do the low-end crap.'”

The temptation is real, she said.

“You work at McDonald's for minimum wage, making nothing,” shesaid. “Go ahead and use this device and scan everybody's creditcard for a day. Do it for a day and I'll give you $500. That's hardto say no to.”

Prison Time

The trouble is, skimmers get caught. ATM cameras make it easy for police to broadcast suspectphotos. Sometimes social media is the foil, she said, becausecriminals often use it to show off new purchases.

“They seem so comfortable out there,” she said. “They thinkthey're safe. But only the really high-end people are safe.”

Law enforcement can easily pierce through fake Facebookaccounts, for example, but “the high, high, high-end people areable to bounce off different servers and you can't track them,” shesaid. “So again, the low-end people get caught; the high-enddon't.”

Strickler said many low-end criminals become informants, butthey almost always serve prison time – three to seven years iscommon.

Will Regulation or EMV Matter?

In the Wisconsin cases, police suspect criminals made severalskimming devices from genuine ATM parts.

“It seems to me there should be something that should preventthem from buying stuff that looks like a real card reader,” Madison PolicePublic Information Officer Joel DeSpain said in an interview.

But a simple Google search reveals how easy it is to purchaseATM parts, and there are no real regulations preventing anyone frombuying them, one expert told CU Times.

On some websites, the listings are brazen.

“They even post 'I have fake ATM skimmers, just contact me atthis email address,'” Strickler said. “Even if we did regulateit, I don't know how that would fix anything. Let's pretend we goahead and regulate the heck out of it, no more ATM parts. Well,you've got the 20-year-old kid who's also majorly tech savvy. He'llfigure out how to emulate the entire technological aspect of it andthen go one step further, and it'll tie your shoes even.”

The coming move to EMV-compliant ATMs could stifle skimming,experts said, but it likely won't end ATM crime.

“In many EMV-compliant countries, skimmer fraud hassignificantly declined but physical attacks have increased,”according to a study last year by Pace University and theAssociation of Chartered Certified Accountants.

“A physical attack could be a gas attack, a bomb or a truck usedto physically rip out the ATM,” the study said. “Otherschemes like card trapping, cash trapping, transaction reversalfraud and currency fishing are also on the increase in a number ofcountries in the European Union, and we should anticipate similarchallenges in the United States with the introduction of EMV.”

Or as Strickler put it, “It will stem the flow a bit. Peoplewill get savvy, and then it's off to the races we go again.”