Security expert Bruce Schneier earlier today posted this provocative headline to his blog: Buy Your Own ATM Skimmer for $3000.
"I have no idea if this is real," Schneier writes. "If I had to guess, I would say no."
Agreeing is Brian Krebs, a former Washington Post reporter who writes frequently about ATM skimmers and scams on his security blog. I emailed Krebs a few questions about the "offer" Schneier flagged and here are his replies:
Does it look real to you?
I saw that post of Bruce's today, and laughed out loud. I have no idea whether the skimmer offered for sale there is for real -- as I haven't made any attempts to verify its authenticity. But here a few thoughts about these things:
A majority of those offering skimmers for sale on the underground crime forums are "rippers," people pretending to have or sell something they do not; they are merely there to rip a few people off before they are banned from the community. Skimmer images on the forums tend to be just like this one (with the seller's nick or name superimposed on the image of the good for sale), but they can just as easily be lifted from legitimate sellers and resold or used by rippers to scam people. That is why most experienced and serious sellers will only give out images of their goods when contacted privately via instant message or direct message on a forum.
The main reason there is so much ripping activity around these types of goods is that buyers will be hard-pressed to complain to regulatory or police authority that they got ripped off. What are they going to do? Complain that they tried to buy an ATM skimmer and some guy ripped them?
Is $3,000 a typical price for such a thing?
$3,000 is not an unusual amount for a skimmer -- one that perhaps had some advanced features -- like an all-in-one card skimmer + hidden cam -- but it's a price that no sane buyer would take unless he felt the seller was "verified" -- vouched for by forum administrators -- and willing to accept money via escrow, which protects the buyer from being ripped off. Since this ad has no escrow offer and the seller offers no way to verify that he is not just trying to steal peoples' money, I doubt anyone but wannabe skimmer scammers would take this seriously.
How easy/difficult is it to sell/buy such equipment?
It costs nothing to register a yahoo account, and the domain that this guy points to -- atmskimmer88.8k.com is a free web hosting provider, and currently there is no web site configured at that address.
In all, my impression would be that this is just a scammer trying to separate newbies from their cash and then vanish.
Does law enforcement go after the real sellers/buyers of these things? Is this a high-risk or low-risk criminal endeavor?
Using skimmers is a lot riskier than selling them :)
Finally, here's a post by Krebs about an incredibly simple technique (that I haven't been using) to give yourself a measure of protection against ATM scams.
Welcome regulars and passersby. Here are a few more recent buzzblog items. And, if you’d like to receive Buzzblog via e-mail newsletter, here’s where to sign up. You can follow me on Twitter here and on Google+ here.