A New Credit-Card Scam

By Elaine Shannon/Washington

A few weeks ago, an American Express security official placed an urgent call to New York City-based Secret Service agent Tim Raymond. Someone in Miami had racked up at least a half-million dollars worth of fraudulent charges against more than 100 American Express accounts. The cards hadn't been stolen, so they had to be counterfeits--very good ones, since they had zipped past the security screens in the computers of the giant charge-card company.

The bad guys in Florida covered their tracks expertly, but the American Express computers spat out a curious fact. Every one of the victimized cardholders had recently dined at one of two New York City restaurants. Raymond and his partners visited one of them, a Brazilian steak house on Central Park South called Plantation, and with the cooperation of the restaurant's mortified owner, they looked around the employee dressing room. There, in an open locker, they spotted the likely culprit: a black box the size of a Palm Pilot, with a slit down the front and bits of Velcro tape on the back. Called a "skimmer," the device can read and store the data embedded within a charge card's magnetic stripe--not only the name, number and expiration date that appear on the card's face but also an invisible, encrypted verification code that is transmitted electronically from merchant to card issuer to confirm a card's validity at the point of sale. By copying that code, the counterfeiter has all the data needed to create a perfect clone of the charge card.

"Skimming is the biggest problem in bank fraud today," says Gregory Regan, head of the Secret Service financial-crimes division. "It's the bank robbery of the future. It's technically simple, point-and-click technology. And the equipment is cheap. If you skim 15 or 20 accounts, you can generate $50,000 to $60,000 worth of fraud, and nobody is going to know about it till the victims get their bills, 30 to 60 days after the crime. So the odds of getting caught are reduced."

Charge card-industry officials decline to say how much they are losing to skimmers--in part because they don't want to scare customers out of using their plastic. But an analysis of industry-published figures suggests that skimmers reaped about $125 million last year, and Secret Service agents suspect that the number is actually higher, with much of that plunder going to international crime rings. "It's not unusual," says Regan, "to see a card compromised in New York City or Washington and the numbers used overseas, in Taiwan, Japan or Europe, within 24 to 48 hours."

The earliest illegal skimmers, book-size devices that required AC power, were discovered a few years ago under gas station counters, where there was plenty of room for a laptop computer that stored card numbers and code. But Mick Chandrani, head of the Secret Service office in New York City--now the Silicon Valley of the criminal underworld--says today's skimmer boom started in early 1999, when electronic gray marketeers started peddling a new generation of miniaturized, battery-powered skimmers with a memory chip that could store data from as many as 300 cards. The new wireless devices, outfitted with their own memory chips, can be secreted in a pocket or hung on a belt like a pager. "The sad fact is that the charge-card companies make everything so consumer friendly that it's very simple to compromise the system," says Joe Russo, supervisor of the charge card-fraud squad for the Secret Service's New York City field office.

Six major charge-card issuers--American Express, Bank of America, Chase Manhattan Bank, Citibank, Discover and MBNA--have started to fight back by cooperating with the Secret Service to pool information about fraudulent transactions and to generate computer analyses that flag locations where numerous cards may have been skimmed. The Visa and Mastercard associations, along with American Express, are refining their security programs, called neural networks, to do a better job of spotting suspicious transactions before they are consummated. (If, for example, someone in Hong Kong tries to buy something with a card that was used just two hours earlier in Chicago, the computer will reject the transaction.)

But the card companies are reluctant to spend much money to combat a threat they still regard as relatively small. "I think we have to look at the size of the skimming problem vs. the cost to solve it," says John Shaughnessy, senior vice president of risk management at Visa USA, which estimates that fraud losses from skimming represent less than one-tenth of 1% of total sales.

Individual cardholders are not liable for fraudulent charges made to their accounts by skimmers or other scam artists. But those cardholders can be in for a rude shock when thousands of dollars worth of purchases suddenly show up on their monthly statements. Card companies urge their customers to read their bills closely and report improper charges promptly. But even if they do, they face the hassle of paperwork and of acquiring new charge cards. And the losses incurred by the charge-card companies eventually get passed along, largely invisibly, to consumers through higher interest rates and card fees.

What's more, Secret Service agents point out that the skimmers, even if they are a relatively minor annoyance to credit-card companies, are feeding a sizable chunk of change into the coffers of Asian, Russian, Nigerian and Latin organized-crime cabals. "For some of these inherently violent groups," says Regan, "skimming is too lucrative to ignore."

What can a cardholder do to prevent his card from getting skimmed? Not much, the experts say. If at all possible, you should watch waiters and store clerks handle your credit card. But most of the skimming takes place out of sight of the cardholder. You can also check your accounts on the Web or by phone during the month to make sure there are no surprises. The only sure protection is to pay with old-fashioned cash. But if you carry lots of that in your wallet, you still have to worry about the old-fashioned kind of robber.