ATM skimming fraudsters plead guilty

Joel Abel Garcia, a 35-year-old from the Bronx, New York, became the third member of an alleged ring of automated teller machine "skimmers" to plead guilty today in the US District of New Jersey to the charge of conspiracy to commit bank fraud. Another member of the group—Victor Hanganu, a Romanian citizen living in Bayside, New York—pleaded guilty to the same charge on April 10. Eleven others have been charged in the conspiracy, which targeted PNC and Bank of America ATMs in New Jersey from March 2015 until June of 2016. Another Romanian, Radu Marin, pleaded guilty on March 29.

"According to admissions made in connection with the pleas, Garcia, Hanganu, and others sought to defraud financial institutions and their customers by illegally obtaining customer account information, including account numbers and personal identification numbers," a Department of Justice spokesperson said in a statement made on behalf of federal prosecutors in New Jersey. Garcia was found to be personally responsible for $132,805 in withdrawals using forged ATM cards out of a total of $428,581 over the 15-month period.

Garcia admitted as part of the plea that "he installed 'skimming' devices on the ATMs" belonging to PNC and Bank of America at multiple locations in New Jersey, "including pinhole cameras that recorded password entries and card-reading devices capable of recording customer information encoded on magnetic strips," according to the statement.

ATM skimming rigs are devices that fit over the card slot on ATM machines, and they're generally designed to target a specific model of ATM; they're often built using actual replacement parts or parts constructed based on those parts. Depending on the approach, they can be constructed using electronics as simple as a digital audio recorder and a Web camera. In some cases, they can be tethered by Bluetooth to a scammer's device. The magnetic data (which can be recorded and played back as audio) can then be recorded to a "blank" magnetic card and used with the recorded PIN used with the original card.

The breakup of the ring hasn't stopped ATM skimming in New Jersey. Other skimming incidents have been detected as recently as January.

"Chip and PIN" cards (or "chip and signature", mostly, as far as credit cards go) based on the EMV "smart card" standard have been widely issued by US banks in an attempt to reduce credit card skimming and other credit card fraud, but most ATM machines still rely on magnetic swipe data, leaving them vulnerable to a common attack that has created a cottage industry of illicit device manufacturers.