Cracking down on card fraud

Thieves and credit card hackers are diving through their window of opportunity before it closes, say security experts.

As cards loaded with small, encrypted computer chips — EMV payment cards — replace cards with magnetic strips in the United States, thieves and hackers are stealing as fast as they can in the short term, said Laura K. Johnson, communications manager with the PCI Security Standards Council.

“What we’ve seen in other countries is increased activity by hackers to target this channel before it becomes more secure with chip technology,” Johnson said.

---

---

Colorado has the nation’s second-highest rate of credit card fraud, 412.4 per 100,000, behind only Nevada, according to the U.S. Department of Justice.

Stealing locally, spending globally

---

---

The stolen data is being used by people outside the valley. James Mill had a charge from a Wal-Mart in Georgia and another from a Wal-Mart in California. Mill doesn’t use his card online, so it had to be a physical presence, he said.

His bank, First Bank, caught it immediately and called him at 8 p.m. on Sunday.

“First Bank has been a dream to work with. Their customer service has been amazing,” Mill said.

Katie and David Campbell have been hacked three times this month, on three different cards. They both have a protection plan, so whoever tried to rob them did not get away with much.

Their burglars are also kind of stupid, Katie laughed. They charged $25 at a McDonald’s and $750 in an electronics store, neither in this area.

She got a new card and charged something in the morning. Within an hour, someone else tried to use it. She still had the card in her pocket, so the thieves are stealing the number; they’re not stealing the card, Campbell said.

Scott Conklin’s card was compromised, and thieves tried to use it at a Wal-Mart in Commerce City. His bank called him right away, he said, canceled that card and issued him a new one.

However, when he tried to use another credit card to buy lunch later that day, it was declined because it had been hacked.

“I called the bank and it too had fraudulent charges, this time from Indiana,” Conklin said.

Not new, not just us

It’s not new, and it’s not just us.

A couple years ago, Garfield and Pitkin counties were getting hammered and one man lost $7,000. The Eagle Police were keeping an eye out, said Lt. Terry Simpkins with the Eagle Police Department.

A maintenance man servicing pumps at an Eagle gas station found two homemade skimmers when he showed up to service the gas pumps. When Eagle police called around, they found an identical device that Glenwood Springs police found in a West Glenwood gas station.

They spotted their guy sitting in a vehicle in a parking lot across the street from the Eagle gas station. His skimmers were feeding him credit card information electronically.

“Your card still goes through to pay for the transaction, but the skimmer captures your information,” Simpkins said

The skimmers can be tough to spot in a gas pump or ATM, but not impossible if you take the matter in hand, literally.

“Grab the fitting to make sure it fits tightly and is flush with the surface of the ATM or gas pump,” Simpkins suggested.

Local uptick

In the last few weeks local police have fielded inquiries about local credit card fraud.

“As is typical for the busy holiday season, we’ve seen an increase in reports of credit card fraud,” said Annette Dopplick, detective sergeant with the Vail Police Department.

So far, they’ve had no local reports of data breaches or skimming activity, Dopplick said.

During last year’s data breaches at Target and Home Depot, victims may not have even used their cards recently to be compromised by a large company’s data breach, she said.

“Because we harbor a false sense of security when our credit card is still in our possession, it can be difficult to recognize when theft has occurred,” Dopplick said.

An upcoming change in credit card security — changing magnetic stripes to EMV cards embedded computer chips — could be a factor for the recent activity.

EMV stands for Europay, MasterCard and Visa, a global standard for integrated circuit cards (IC cards or “chip cards”). The IC cards are already being used in many parts of world, predominantly Europe and Southeast Asia.

Jelena Ewart, general manager of credit and banking for NerdWallet, says she does not expect to see a significant rise in thieves and hackers illegally obtaining credit card numbers. However, they’ll still move as fast as they can.

“Even as chip cards become prevalent, there will still exist other opportunities for thieves and hackers to take advantage of stolen card info, just largely outside of the counterfeit category,” Ewart said.

Who’s paying?

Retailers are stuck with the tab for EMV-compatible terminals, about $300 each, say local bankers. The National Retail Federation calculates that tab will reach $30 billion nationwide. However, retailers who don’t buy it will have to pay for fraud losses, instead of the banks that issue the cards, Johnson said.

It’s called “fraud liability shift,” Johnson said.

The switch is set for October.

“We may see an uptick in attempts to utilize stolen card numbers, either issued in the U.S. or issued abroad for in-person purchases in the U.S. before the deadline,” Ewart said.

Ewart said to look for three things after chip cards become prevalent:

Counterfeit fraud (stealing a card and manufacturing another card with that information by altering a genuine card to use in person) is very likely to go down significantly.

Lost or stolen card fraud isn’t likely to go up a lot since it’s difficult to pull off at scale, especially compared with card-not-present-fraud.

Card-not-present fraud (ordering by phone or over the Internet) is likely to go up since the chip wouldn’t prevent acceptance when a chip-reading terminal isn’t involved in the transaction.

Computer chip cards were first rolled out in 1985 in Europe. In the U.S., the chip cards will be combined with signatures as they roll out this year. The National Retail Federation calls the U.S. cards “EMV Lite.” They’re calling for the kind of chip and PIN technology that has already been rolled out in Europe.

Chip cards are an improvement over magnetic strip technology from the ’60s and ’70s, the NRF said, but signatures provide no security whatsoever.

If you want security, make it a chip card with a PIN, the NRF said. Even if thieves get their hands on your card, they can’t use it without a PIN.

Staff Writer Randy Wyrick can be reached at 970-748-2935 and rwyrick@vaildaily.com.