March Skimming Prevention Kit. For Business Owners 1

Transcription

1 Skimming Prevention Kit For Business Owners 1

2 Contents Introduction:... 3 Debit Card Fraud:... 3 What is Debit Card Skimming?... 3 Who is Affected?... 3 Impact on Consumers... 3 Impact on Financial Institutions... 4 Impact on Merchants... 4 The Cost of a Skimming Attack... 4 Who is Behind Debit Card Skimming?... 4 Prevent your Business from Becoming a Target... 5 Detecting Skimming Devices... 5 Stolen PIN Pads... 5 CHIP Technology... 5 Ensure your Business is Secure... 6 Train Staff... 6 Websites to check out for more information:... 7 Threats and Risks... 7 Compromised POS Terminal: What to Do... 7 Be Aware!... 7 POS Terminal Characteristics Form... 8 POS Terminal Inspection Log

3 Introduction: Debit card skimming has become one of the most common types of fraud affecting businesses. Merchants and the general public are more aware of this threat. Law enforcement and financial institutions are spreading awareness and providing preventative measures for skimming attacks. This package includes information about the threats associated with debit card skimming, and the necessary tools to detect skimming devices and prevent skimming attacks at your business. Debit Card Fraud: What is Debit Card Skimming? Skimming is the unauthorized capture of the electronic data from credit and debit cards, including personal identification numbers (PINs). Stolen data is encoded on counterfeit cards and used to purchase goods or make withdrawals without the knowledge or consent of the cardholder. Who is Affected? Skimming affects everyone. Skimming attacks challenge the integrity of everyone involved in the payment services business. Employee trust, industry relationships, and consumer trust are negatively impacted by skimming attacks. In 2012, $38.5 million was reimbursed to victims of fraud in Canada as a result of debit card skimming (down from a high of $142.3 million in 2009 thanks to chip technology). Impact on Consumers Consumers are inconvenienced when their account information is compromised. Besides needing to either replace or re-pin their debit card, they can lose trust in the system leading to strained relationships between merchants, merchant-servicing financial institutions, and the various payment networks. Victims often feel violated and might believe that merchants are the ones trying to defraud them, or that they are not taking necessary precautions to prevent fraudsters from taking advantage of customers. Some observed consumer behaviours after a skimming attack are very distressing for both financial institutions and merchants. They include: changes in buying patterns, changes to shopping locations, using cash rather than debit cards. 3

4 Impact on Financial Institutions Consumers may lose trust in security and fraud prevention procedures at financial institutions. They may believe their financial institution is not capable of providing the adequate level of security of personal information. The processes of notifying affected cardholders, replacing compromised debit cards, fraud reimbursements, monitoring and reporting, and investigative efforts are all costs directly absorbed by financial institutions as a result of a debit card skimming attack. Impact on Merchants Debit card skimming is one of the most important types of fraud that business owners need to be prepared for. A single skimming attack can have a severe negative impact on a business. A merchant may suffer detrimental reputational damages and consequently lose their customer base if consumers become aware of a compromised POS terminal at their location. One local news story naming your business as the location of the skimming attack can easily cause loyal customers to lose complete confidence in your business. Consumers assume that the merchant is the one trying to defraud them and capture their personal data. Most of the time devices are planted without the knowledge of the merchant and employees. Consumers are starting to seek out businesses that take proactive measures to ensure the safety of their personal information. Customers will take their business elsewhere if they discover protection of personal financial data is not a merchant s priority. Business owners are the first line of defense in combating debit card fraud! The Cost of a Skimming Attack The cost of a skimming attack can be expensive! If a single Point of Sale terminal needs to be replaced, it may cost the merchant about $1000. A single, stolen PIN pad may cost the merchant about $250-$400 to replace. There are also additional costs and responsibilities for business owners to endure when faced with a skimming attack. These include: time spent participating in a police investigation, system upgrades, employee terminations, loss of goodwill, lawsuits and more. Who is Behind Debit Card Skimming? The profile of a debit card fraudster is not exclusive - it could be anyone. There is a high level of anonymity related to skimming, which makes it more appealing and one of the most popular options among today s criminals. It is a quick and easy way to gather large amounts of valuable banking information from a variety of people. Most criminals look for the path of least resistance when committing fraud and skimming is a preferred method because it is often difficult to detect once a skimming attack has occurred. 4

5 Prevent your Business from Becoming a Target Detecting Skimming Devices Skimming devices can come in all shapes and sizes. Typically, compromised PIN pads will have signs of tampering including: Labels and security seals have been removed or broken. Wires connecting the PIN pad to the base of the terminal are replaced with wires that aid in the capture of card data. Pinhole cameras around the cash register are hidden in donation boxes, brochure holders, or ceiling tiles. Gel keypad overlays that capture PIN data and send it to a remote device. Plastic Skimmer devices that are affixed to the mouth of an ATM and secretly copy credit and debit card information. In line with today s rapid technological advancements, skimming devices improve quickly and are harder than ever to detect. Some devices no longer require a pinhole camera to capture personal identification numbers (PINs). Instead gel pad overlays resembling regular keypads are placed over the number keys capturing the key strokes of the PIN entered. Stolen PIN Pads Fraudsters steal PIN pads from merchants and alter them by adding technology to capture sensitive card data. They plant the corrupted PIN pad at a retail location by swapping out a legitimate PIN pad with the compromised unit. The fraudsters may only have the compromised PIN pad at a location for a couple of hours then remove it, or they may leave it on for months, undetected, collecting customer card information. Once they have collected an adequate amount of data, they will begin a fraud spree - fraudulently withdrawing funds from unsuspecting cardholders. CHIP Technology Chip technology is the long-term solution to payment card fraud. All merchants who offer Interac services are required to have chip technology. Conversion from utilizing the magnetic strip to process transaction has taken place over the last five years and is nearly complete. Magnetic stripe transactions will no longer be accepted in Canada as of December 31, CHIP debit cards contain an embedded microchip that puts the power of a computer onto a debit card. Chip technology is virtually impossible to duplicate and provides increased protection against debit card skimming and the production of counterfeit debit cards. Transitioning to CHIP technology will help restore consumers confidence in the payment systems industry. For more information on CHIP technology, please visit the Interac website or ask your Libro Coach for more details. 5

6 Ensure your Business is Secure 1. Treat your PIN pads as cash. Do not keep them out in the open or on the counter. Ensure they are kept out of site when not used. This includes PIN pads at back-up checkouts that are not used as frequently. 2. Regularly inspect all cash register stations. Criminals will target PIN pads that are easily accessible and not easily noticed. 3. Secure terminal and PIN pad wires by bolting wire cabling to the PIN pad and the terminal. This will deter fraudsters from stealing your PIN pads and POS terminals and make it more difficult to plant a compromised unit at your business. 4. Place an identifying mark or sticker* on back of PIN pads or somewhere visible to the clerk so they can verify throughout the day that the PIN pad has not been swapped out with a compromised unit. 5. Use the POS Terminal Description Form to help with inspections by educating staff on what the terminal and PIN pad should normally look like. (ex. colour and number of wires attached, etc.) 6. Use the POS Terminal Inspection Log to ensure inspections are completed regularly. If a skimming attack does occur, the log will aid in determining when the device may have been planted, or when a PIN pad was stolen. Train Staff Ensure all employees, not just frontline staff, are educated on debit card skimming and the impact to your business. Incorporate discussions on debit card fraud at regular staff meetings. Make staff familiar with what to look for to prevent a skimming attack and the role they can play in mitigating risk. Implement a policy to inspect POS terminals daily. Shift changes, opening and closing, as well as random inspections are best practices to ensure security remains at a high level. Ensure all staff are aware of what to do if they notice a tampered POS terminal. For example: who to report to, what to look for and what the police will expect from them (if they become involved). Stay educated! Attend seminars, information sessions and read up on the latest skimming trends. The more you learn about skimming, the more you can pass on to your employees and lower the risk of your business becoming a victim of a skimming attack. 6

7 Websites to check out for more information: Industry Canada: Competition Bureau: National Consumer League s Fraud Centre: Phonebusters: Fraudcast: Bank of Canada: United States Secret Service: Threats and Risks Compromised POS Terminal: What to Do 1. Contact police immediately. 2. STOP using the terminal. 3. Ensure employees and customers avoid physical contact with the potentially compromised unit and surrounding area, as not to tamper with a possible police investigation. 4. Contact your service provider. 5. Contact Interac. Be Aware! Fraud prevention begins with keeping your eyes and ears open. Watch for signs of suspicious behaviour, and unusual occurrences. Regularly review the inspection checklists and surveillance images. Make sure PIN pads are secured at all times and are always in sight. Education is the best defense against skimming attacks and all types of fraud! For more information, please contact your Libro Coach. 7

8 POS Terminal Characteristics Form Complete this form for each POS terminal and keep in it in a separate location than the daily checklist. POS Terminal Description Location: Make: Model #: Serial # (printed on label): Serial # (on screen, if applicable): General condition and appearance (colour, existing marks, scratches, etc.): Details of any identifying stickers: How is this terminal connected to its host device? Connection type, colour of lead: How many connections in total (all leads, plugs, aerials, etc.)? Describe any display stands, charity boxes, or other merchandising materials that are normally placed within the vicinity of this terminal: Describe the normal condition of the ceiling above the terminal (include scuffmarks, fingerprints, dislodged tiles, etc.) My POS terminal service provider is: company, name, phone #, My Interac contact is: name, phone #, 8

9 POS Terminal Inspection Log Month/Year: Inspections should be completed at shift changes, opening and closing and randomly throughout the day. Include initial and time for each inspection completed. Equipment Week of dd - dd Monday Tuesday Wednesday Thursday Friday Saturday Sunday PIN pad Serial # Signs of tampering Wires, plug ins, seals Point of Sale Terminal Serial # Signs of tampering Wires, plug ins, seals Ceiling Damaged Tiles Cameras, wiring/cables Counter and Shelves Equipment moved Additional equipment (donation boxes, brochure holders, etc.) Equipment Hidden Surveillance Equipment Signs of tampering Cameras moved Comments Inspection #1 Inspection #2 Inspection #3 Random Inspection Inspection #1 Inspection #2 Inspection #3 Random inspection Inspection #1 Inspection #2 Inspection #3 Random Inspection Inspection #1 Inspection #2 Inspection #3 Random Inspection Inspection #1 Inspection #2 Inspection #3 Random Inspection 9

10 Skimm 10