EBT skimmer gangs are equal opportunity criminals

Card skimmers don’t generally discriminate between their victims, but we do tend to see a certain pattern. American middle class individuals are hard targets for most card skimming schemes because they are mobile and fill up their gas tanks themselves, they shop for their own holiday gifts and they have bank accounts requiring semi-regular visits to ATMs of all kinds. These victims of skimmer scams earn enough discretionary income to simply kick the can down the long road of skimmer theft. If fraud is detected, they get a new debit or credit card immediately sent to them to resume their consumer spending in exchange for a few interest points tacked onto their interest rates or debt. However, the millions of Americans that rely on food assistance plans are now also being targeted by these same cyber criminals, but they cannot afford to make any mistakes.

As the wealth gap continues to increase in the US, the poorest among us rely more on state-provided benefits to keep them contributing positively to society rather than becoming undue burdens upon all taxpayers. The food stamp program began in the middle of The Great Depression and continues to this day in an effort to ease the suffering of the poorest and most malnourished in the population. In the late 90s, this economic assistance program received a digital update in the form of EBT (Electronic Balance Transfer) cards issued to all participants in order to streamline and modernize these efforts. According to PEW research, about 12.5% of all Americans rely on these SNAP (Supplemental Nutrition Assistance Program) benefits or about 21.67 million US households. That’s a lot of program participants to keep track of necessitating digital automation in the form of cards. These cards are similar to credit and debit cards in that they hold funds on them and communicate transactions via an embedded magnetic stripe.

If you know anything about card skimming basics, you understand that real problems occur when you store valuable data in an unencrypted format that can be easily read and copied. Magnetic stripe technology dates back to the late 60s when the first credit cards appeared. On the tech timeline, this is ancient. Put it this way, if there was a hacker elementary school, 1st grade would require all hacker students to skim, read and clone data from a typical mag stripe found on any credit or debit card because it’s just that easy. And building and installing skimmers isn’t much more difficult. Plans, tutorials and even tech support is readily available on the dark web making it possible for any criminal to start their own enterprise.

177,000 instances of fraud in 46 reporting states

Organized skimmer gangs have recently upped their game and gotten the attention of local and federal authorities. In response to an onslaught of skimmers targeting EBT cards, the US Secret Service and multiple local law enforcement officers participated in major skimmer detection operations. More than 1,400 point-of-sale terminals, gas pumps and ATMs were inspected and teams also distributed educational materials about EBT fraud and card skimming to help businesses better identify the warning signs of illegal skimming devices. In fact, since these initial report of EBT skimming fraud in the first quarter of 2024, there were nearly 177,000 instances of fraud in 46 reporting states.

Since EBT cards are accepted in both POS (Point-of-Sale) terminals found at the checkout counter and in ATM kiosks, the attack vector is huge. In the case of card swipers, a legitimate look keypad overlay is placed overtop the real one. When the consumer swipes their EBT card (or any credit or debit card), card data is immediately skimmed. If the consumer is using a card, that also requires PIN data (all EBT cards require PIN), that is also recorded from their keypad inputs. While EBT cards can only be used to purchase food items, they are also permitted to work in ATMs and gas stations depending upon the classification. This means that deep insert skimmers, the ones that are much harder to detect, have also been targeting EBT cards. There is no full tally on all the losses from EBT skimmer theft but according to the Consolidated Appropriations Act (CAA), a provision for stolen benefits has led to the replacement of over $60 million nationwide.

It would seem that cybercriminals have no biased towards their victims. Rich, middle class, poor, anyone with a card containing a mag stripe is fair game for skimmer fraud. There are roughly 2 billion credit and debit cards currently in circulation so what can we all do to stay safe? Before I rattle off the usual tips to steer clear of skimmers, I want to offer a weapon on the fight against skimmers. If you suspect there might be a hidden skimmer in your midst, there are tools that detect all kinds of skimmers before you find out the hard way. Skim Swipe™ is used mostly in convenience stores and checkout counters that require a swiping motion with a card. This device has been adopted by many travel centers and store owners to detect card skimmers found in keypad overlays before customers face fraudulent charges.

Skim Scan™ works with ‘dip’ or insert card readers like those found on ATMs and fuel dispensers. This device detects deep insert skimmers, the ones so deep that you cannot see nor even pull off a bezel to reveal them. Law enforcement, credit unions, banks and managers of all kinds have adopted these devices all over the US to fight skimmer crimes.

Here are the standard preventative tips issued from US Secret Service:

• Inspect ATMs, point-of-sale terminals, and other card readers before using. Look for anything loose, crooked, damaged, or scratched.
• If you use a debit card at a gas station, run it as a credit card instead of entering a PIN. That way, the PIN is safe, and the money isn’t deducted immediately from your account.
• Cover any keypad with your hand when entering your PIN to block the view of tiny pinhole cameras used to record PINs
• Use ATMs in a well-lit, indoor location, which are less vulnerable targets.
• Be alert for skimming devices in tourist areas, which are popular targets.
• Utilize debit and credit cards with chip technology. In the U.S., there are fewer devices that steal chip data versus magnetic strip data.