Week 36: Analogue skimming – psychology, not technology
Although conventional skimming, which involves reading or copying credit card data, has become relatively rare, scammers are increasingly using social engineering, a form of psychological manipulation, to obtain bank cards. In one scam reported to the NCSC, victims are persuaded over the phone to hand over the chip from their bank card. The scammers pose as bank employees and claim there has been a security incident. In reality, their aim is to use the stolen chips to make fraudulent cash withdrawals.
Around ten years ago, Switzerland regularly experienced major waves of skimming attacks. Conventional skimming involves criminals tampering with ATMs or payment terminals by attaching additional devices. These devices are used to read card data and capture customers' PINs, for example by using hidden cameras or modified keypads. The stolen data could then be used to make fraudulent cash withdrawals or card payments.
From magnetic stripes to chips: how cybercriminals respond to improved security measures
A range of security measures have been introduced in recent years in response to conventional skimming. In Switzerland, for example, the magnetic stripe now plays virtually no role in cash withdrawals. Instead, the chip on the card is used for authentication, providing significantly better protection against fraud.
The key difference lies in how the two technologies work. Card data is stored statically on the magnetic stripe, meaning that the same information can be read each time. If criminals manage to obtain this data, it can be copied relatively easily and transferred to another card or storage medium. This is precisely why conventional skimming was such a successful scam for so many years.
The chip works on a different principle: it contains a small computer with cryptographic keys and generates a unique security code for each transaction, which is only valid for that particular transaction. Even if attackers were able to intercept the data transmitted during a transaction, they could not reuse it for subsequent chip transactions. Consequently, conventional skimming at ATMs and payment terminals has declined sharply and now mainly occurs in countries where magnetic stripes are still accepted for cash withdrawals.
A new form of skimming: social engineering instead of high-tech
In a recent scam reported to the NCSC, criminals have been targeting the chips in bank cards. Unlike conventional skimming, however, they do not use card readers or any other technical equipment. Instead, they trick victims into handing over the chip themselves. The scam starts with a text message that appears to be from a bank, saying that your card has been used fraudulently or that suspicious transactions have been detected. You are instructed to call a phone number to resolve the issue.
When you call the number, someone claiming to be a bank employee tells you that your card must be destroyed immediately for security reasons. You are instructed to cut up the card, but to make sure that you do not damage the chip. You are then told to put the pieces in an envelope, which you must either send to a specified address or hand over to a supposed bank employee who will come to your home to collect it. Cutting up the card might make it seem as though it has been rendered unusable. In reality, however, the chip still works. In cases known to the NCSC, someone arrived at the victims' homes shortly afterwards to collect the cut-up cards. The cards were then apparently pieced back together and used to withdraw cash. In one case, more than CHF 10,000 was stolen in this way.
In some cases, the scammers went even further, persuading victims to increase their card limits beforehand. It is still unclear how they obtained the corresponding PINs. The NCSC assumes that the scammers either asked for the PINs during the phone call or obtained them in some other unobtrusive way.
Recommendations
- Banks will never send an employee come to your home to collect your bank card or any part of it, or to ask for your PIN or login details.
- Never cut up a bank card on the instructions of someone you do not know, and never hand over the chip to anyone.
- Never disclose your PIN over the phone, even to someone claiming to be a bank employee.
- Be suspicious of text messages, emails or phone calls that create a sense of urgency and tell you to act immediately.
- If you receive a message of this kind, contact your bank only using its official phone numbers or contact channels.
- If you think you may have fallen victim to a scam, block your card immediately.
Current statistics
Last week's reports by category: