News

In Macao, a disturbing new method of ATM skimming

June 2, 2014

Last week, authorities in the Chinese territory of Macau arrested a pair of Ukrainians who are alleged to have stolen around $100,000 from seven ATMs. The arrest in itself is not out of the ordinary, but, according to Krebs on Security, what arresting police found in the men’s possession definitely was.

“A recent ATM skimming attack in which thieves used a specialized device to physically insert malicious software into a cash machine may be a harbinger of more sophisticated scams to come,” Brian Krebs wrote.

Apparently the thieves were able to install card number-skimming malware directly onto the ATMs using “a rigid green circuit board that is approximately four or five times the length of an ATM card” connected to a laptop, Krebs wrote.

According to local press reports (and supplemented by an interview with an employee at one of the local banks who asked not to be named), the insertion of the circuit board caused the software running on the ATMs to crash, temporarily leaving the cash machine with a black, empty screen. The thieves would then remove the device. Soon after, the machine would restart, and begin recording the card and PINs entered by customers who used the compromised machines.

Photos of the devices can be viewed at the Krebs on Security website.