Forest Global Training Partners

Cyber Risks · Krebs on Security

Checkout Skimmers Powered by Chip Cards

Summary: Fraud investigators described a new self-checkout skimming device that pairs a PIN pad overlay with a flexible, paper-thin 'shimmer' fed into the terminal's chip reader slot, drawing a few milliamps of power from the current the terminal sends when a chip card is inserted, so it needs no battery and can operate indefinitely. Because the device has no Bluetooth or battery, thieves retrieve the recorded data by inserting unmarked 'white' smartcards that instruct the skimmer to dump its contents, a method a compromised merchant confirmed after finding such cards left in a store and having a lab validate it.

Why it matters: The skimmer fits entirely inside the slot because terminal specs must still accept older, thicker embossed cards - the source notes the slots are tall enough to fit two cards - so the backward-compatibility allowance that keeps old cards working is the same gap that hides the device from view.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related