Shimming – a new con used to steal your ID and other info…

I’m not sure if there is anything that you can do to protect yourself from this kind of attack except stop using ATM machines. Shimming is the newest con designed to skim our credit card number, PIN and other info when you swipe your card through a reader in an ATM machine. According to Diebold:

“The criminal act of card skimming results in the loss of billions of dollars annually for financial institutions and card holders. Card skimming threatens consumer confidence not only in the ATM channel, but in the financial institutions that own compromised ATM’s as well."

The Shimming is carried off is by inserting a very thin flexible circuit board through the card slot that will tick to the internal contacts that read the card data in an ATM machine. The circuit board is attached to the ATM by using a carrier card that holds the shim, inserts it into the card slot and locks it into place on the internal card reader’s contacts. The carrier card is then removed. The shim is not visible externally from the machine so you won’t know that the ATM is compromised by looking at it. The shim then performs a “Man in the Middle”  attack between your inserted card and the ATM. The design of the card is no simple feat. The space available for the shim is less than 0.1mm thick. To put this in perspective a human hair si about 0.18mm thick.

One of the main reasons that the attack can succeed is that there is no encryption of the data between the card and the rest of the ATM functions. This is slowly changing so that this problem may not be a problem in the ATM that your use. Diebold has released five new anti-skimming protection levels for its ATM devices in June of this year. But none of these protects against the shim skimming attack. Hopefully we will see this soon.