A bank-machine hacker who reportedly was arrested earlier this month in Turkey gave would-be fraudsters tips on how to install rogue card-reading devices, including advising them to target drive-through ATMs (automated teller machines) and avoid towns with fewer than 15,000 residents.

The hacker, who went by the handle "Chao," reportedly was arrested earlier this month in Turkey. He was one of the most well-known ATM hackers in the world, according to Uri Rivner, head of new technologies for RSA Consumer Solutions.

Chao sold fake faceplates that fraudsters could attach to the card slots in ATMs. These "skimmer" devices can read the magnetic stripe of every customer's ATM or credit card, and are often used in conjunction with a hidden camera that watches people enter their PINs (personal identification numbers), Rivner said. Alternatively, criminals can attach an extra keypad on top of the one in the machine and capture the PIN that way, he added. (Read how credit card skimming works in this slideshow)

After collecting this data over a period of time in these devices, the fraudster can remove the devices and use the information to make counterfeit ATM and credit cards that can be used in stores and ATMs, Rivner said. There are other such devices that can send the information to a nearby computer via Wi-Fi, he added. Fraudsters also commonly produce counterfeit cards using information stolen directly from bank and credit-card databases. Overall, card counterfeiting is one of the major types of fraud against ATM and credit card issuers, representing roughly 30 percent of their fraud losses in the U.S., Rivner said.

In an animated online video commercial for his skimmers, Chao provided a glimpse into the world of ATM hacking with a series of tips for potential customers who would buy and install his products.

Picking an ATM to target with this scheme requires watching the surrounding area for days or weeks and taking notes on foot traffic and other characteristics, Chao said in the video. Among his tips are these:

-- don't install a skimmer in the morning, because people are more vigilant then;

-- determine where a person would have to stand to keep an eye on everything happening on that block;

-- avoid blocks where more than 250 people per day walk through, because of the danger of detection;

The IDG News Service is a Network World affiliate.