Partially 3D Printed Device Could Help Detect Credit Card Skimmers

[Image: University of Florida]

I recently had my credit card information stolen, which was a fun ordeal. I still don’t know how it happened, but it could have been a credit card skimmer installed somewhere, on an ATM or a gas pump. These hard-to-detect devices capture people’s credit card data when the card is swiped, and the victim is none the wiser until strange transactions start showing up on their bank statements. 3D printing has been used both to aid and to foil credit card skimmers, and now the technology has been employed to create a device that may instantly be able to detect when a skimmer is present.

Cybersecurity expert Patrick Traynor, a professor of computer information science and engineering at the University of Florida, had his credit card information stolen half a dozen times in five years. Fed up, he and some University of Florida students began working with local law enforcement professionals to create a device that would slide into a card reader slot and detect whether or not it had been compromised by credit card skimmers.

Most credit card skimmers work by installing an extra “read head” inside or outside a credit card reader. This extra read head allows criminals to copy customers’ credit card information as the card is swiped. The device created by Traynor, called the “Skim Reaper,” detects if there is more than one read head installed. About the size of a credit card itself, the device slides into the slot and is attached by a cable to a cellphone-sized 3D printed box that says “possible skimmer!” if it detects that the reader has been compromised.

“We’ve had to manufacture these cards,” Traynor explained. “We’ve been using 3D printers that we have here in the lab to built our boxes. The students have been soldering, they’ve been writing software.”

[Image: AP News]

Traynor and his team have been using 3D printers to create the devices, and gave five of them to the NYPD in February to test out. Credit card skimming has been becoming a major problem especially in New York.

“In New York City, we saw a surge in ATM skimming in the past few years, as evidenced by the increase in devices recovered by our agency, the NYPD,” said Lt. Gregory Besson of the NYPD Financial Crimes Task Force. “In 2015, we recovered 48 devices, and two years later that number had doubled to almost a hundred devices in 2017. Correspondingly, our arrests more than doubled for the same period, from 48 skimming-related arrests in 2015 to 134 skimming arrests in 2017. The big takeaway is that we’re always seeking new innovative ways to tackle this growing crime type, and we welcome trying new tools that would aid us towards that goal.”

According to Steven Weisman, a cybersecurity expert and professor at Bentley University, the Skim Reaper could be a “revolutionary, watershed moment” in stopping credit card skimmers.

[Image: WCJB]
“If indeed this new technology could be done on a cost effective basis, it could put the skimmers out of business,” he said. “It would save people tremendous amounts of money and aggravation.”

Right now, it takes about $50 to make each Skim Reaper, but Traynor and his team are working hard to reduce the cost, and also to make the device smaller so that it can be carried in a wallet. The NYPD says that more testing needs to be done but that they are impressed with the early results using the device.

“I’ve been doing skimming for approximately five years now and I have never used anything like this or have known of anything like this,” said NYPD Det. James Lilla of the Financial Crimes Taskforce. “It’s definitely an assist we can use to combat ATM skimming.”