BIRMINGHAM, Ala.—A new type of ATM card skimmer is expected to make its way to the U.S., and the device is targeting chip cards.
Called a shimmer, the virtually undetectable device sits inside the machine, between the chip reader in an ATM and the chip on the card, recording the data on the chip as it is read by the underlying machine.
The data collected can’t be used to fabricate a chip-card—since chips contain additional security components not found on a magnetic stripe—but it can be used to clone a mag stripe card. The fake mag stripe plastic will not carry a CVV, and will not work unless the FI fails to check the CVV on a transaction.
“Shimmers were first discovered in 2015 in Mexico, but they have since made their way into Canada. Many card processors are worried they could soon spread to the United States because of the country’s transition to chip credit cards,” said LowCard.com’s John Oldshue.
Criminals can install shimmers on existing chip readers, or they could implant them into new machines for companies that are converting their point of sale terminals. The information on the shimmer can be collected by inserting a special
card in the reader, so the transactions could go unnoticed for quite some time, Oldshue said.