The Merchant. Skimming is No Laughing Matter. A hand held skimming device. These devices can easily be purchased online.

Transcription

1 1 February 2010 Volume 2, Issue 1 The Merchant Serving Florida State University s Payment Card Community Individual Highlights: Skimming Scam 1 Skimming at Work 2 Safe at Home 3 Read your Statement 4 Useful Tips: Audit Report 6 PIN based debit 6 In The News: Florida Man Pleads Guilty 7 Vegas Police Warn About Skimming 7 Contact Info: 7 Skimming is No Laughing Matter Imagine one day taking your family out to one of your favorite restaurants. The meal is great, you re having a wonderful time, and then you hand the server your card to pay for the check. Next month, you notice a $500 dollar charge for something you didn t purchase. Or suppose you are traveling and stop at a convenient store to get some cash. When you return home you notice that there are several extra charges on your statement that you didn t make. You are confused and can t understand what has happened. Chances are that you have fallen victim to one of the fastest growing and costliest credit card scams to hit the streets. It s called Skimming. Skimming is where thieves capture sensitive data stored on the magnetic stripe of a debit or credit card. Two of the primary ways they do this is: getting your card under normal circumstances, as in the case of a waiter or store clerk, and swiping it on their own device prior to giving you back the card. This device can be as small as 2 inches long and can easily be hidden inside a pocket. Another way is for crooks to attach a skimming device onto the ATM slot where you insert your card. They may even install a plastic cover for the key pad or have a hidden camera (no larger than a dime) that records your keystrokes thus obtaining your PIN. You may never know about this until it s too late (Article continued on next page). A hand held skimming device. These devices can easily be purchased online. An ATM that has been tampered with. Note the raised slot.

2 Skimming is No Laughing Matter (Con t) Once they capture your data, they can use it to make fraudulent purchases or get your cash. The best way to prevent this from happening is to stay alert when using your card. When paying for something in a retail situation, make sure you don t take your eyes off of your card. Be sure to watch the employee as your card is being processed. When getting cash from an ATM, make sure the machine doesn t look different or altered. Use your bank ATM instead of isolated or convenient store ATMs as the latter are more subject to tampering. Always cover the keypad when typing your PIN and make sure that no one is standing over your shoulder watching. If you approach an ATM and it looks like it has been tampered with, don t use it and contact the bank as soon as possible. Another suggestion is to avoid using your debit card at gas stations unless you use it as a credit card (so you don t have to type in your PIN). Cards processed as credit cards give you greater protection. Some banks may not protect you from PIN based transactions. Keep a limited amount of cash on cards that you use for purchases or ATM cash withdrawals. Have a separate checking account for bill paying or payroll direct deposits and then transfer money into your debit card account as needed. If you do this make sure that your debit card account isn t linked to your primary checking account with overdraft protection. This step could limit your exposure in the event that you do fall victim to skimming. Check your account activity daily. Any suspicious activity should be reported to your bank immediately as with any lost or stolen cards. If you are a victim of credit card fraud, contact the police as well. 2 Skimming in the Work Place The threat of skimming isn t just a problem for consumers; it is a very serious concern for merchants as well. Merchants must take every precaution possible to protect cardholder data. Merchants that fall victim to a skimming attack will lose the confidence of their valued customers. There are two primary tactics that criminals use inside the work place. The first is when thieves persuade employees to steal sensitive cardholder information usually by swiping a customer s card into a recording device (as mentioned in the previous article). Then the employee sells the stolen information to the crooks. People engaged in this act are committing a crime even if they never use the card information. The second method is when thieves infiltrate a merchant s payment or phone system and secretly install recording devices. To see actual photos of such devices go to the following link (starts on page 6): revention_form.pdf. Also on this site, under Appendix A, there is a very useful tool to determine what your risk factor is. Appendix B is another useful tool in helping to evaluate your payment card environment. When hiring employees make sure that they have background checks performed. In addition, train your staff to inform management if they are ever approached by thieves or witness other employees engaged in criminal activity. Remind them that skimming is an illegal act. The environment in which payment cards are processed is also an important issue as well. Although many FSU merchants are not as highly visible to the public s eye as others are, it is still a good idea to take precautions. Never leave your payment card terminal unattended or exposed to public access. You will be surprised how quickly someone can plant a device onto your machine. Maintain physical security at all times including your pin pad. In addition, make sure telephone control rooms or panels are locked to prevent tampering. Check your terminals and pin pads occasionally to see if anything has been altered. Also, look around the area to see if any miniature cameras have been attached, especially near the pin pad. Be sure to monitor outside vendors when they enter into the payment card processing area. Do not leave them unattended. Lock your terminal and pin pad in a secure cabinet or room at night when not in use.

3 Be Smart and Safe At Home Too! 3 Being a part of the FSU Payment Card Community we are all responsible for security awareness and minimizing the risk of credit card fraud here at work. However, we should also take similar precautions when it involves our own personal use of payment cards. Many cases of fraud could be prevented or minimized if the consumer takes proper measures to safeguard against this type of theft. For example, a rising number of fraud cases are being reported because of the Skimming scam (see related articles in this issue). Knowledgeable consumers can help reduce this scam by staying aware when making purchases. There are many other actions people should take in order to protect their assets. The following are some safety measures that many in the industry are recommending to cardholders: Keep your card number, your PIN, and other sensitive information confidential and secure. Do not share it with anybody. Shred documents with sensitive information before recycling or throwing away. Sign the back of your card as soon as you get one and destroy the old ones. Treat your cards as if it were cash. In stores or restaurants, make sure your card doesn t leave your site (to avoid skimming) and don t leave your credit card with employees (e.g. a bartender holding your card when running a tab). Make sure to total up the charges and do not leave any spaces blank on the receipt (such as the space for tips). This will prevent employees from adding extra amounts to your charge. Always check your receipts for accuracy keeping a copy to match up with your statement later on. Report discrepancies immediately. Check your account online daily. If there are any unfamiliar transactions, or if your card is lost or stolen, contact your card issuer immediately. Notify card issuer immediately of any changes in address so your statements are not mailed to your old address. Also, if you plan to travel, especially overseas, notify the card issuer. Never write your PIN on your card. Use a one-time virtual credit card number when making online purchases. This is offered by many card issuers where they generate a randomly selected number connected to your account for a one time use over the internet. Be suspicious of phone calls and s asking you to give out information. Your bank will never ask for your PIN, full social security or card number on line or over the phone. If you receive an from what appears to be your financial institution, call them using a phone number that you have on file or on the back of your card to verify your account status. If someone calls you and you aren t sure if it is legitimate, ask for the name of the representative, call the bank back using a reliable phone number (as mentioned above) and then speak to a agent. Getting into proper habits and being informed may take some time but in the long run it is well worth it. These steps can save you time, money, and hassle. Check with your card issuer for more tips on how to maintain good security and safety.

4 How to Read Your Visa/MC Statement 4 When you get your monthly statements what do you do with them? Hopefully, part of your answer is that you review them to check for accuracy, match the totals shown on the statement to your daily batch totals, and identify charges that seem high and figure out why. But if the task of examining your charges is too daunting because of the way the statement appears, then you probably avoid looking at it all together. However by breaking down your statement into its components, it can help ease anxieties you may have and make it less complicated to review. Below is an illustration that shows what all those numbers mean. With a little practice you can become efficient at reading your monthly statement. Why is this important? Because your department pays for those charges and you want to make sure that you are being charged properly and that your business practices are not putting you into a higher interchange category (e.g. not settling your batches daily). Please take a few minutes to review the following. Having your last statement along side of this will probably help. If you have any questions, please contact Alyn Minnerly at aminnerly@admin.fsu.edu.

5 5

6 6 Useful Tips 1. Run an Audit Report Before Settling Running an audit report prior to settling (closing) your batch can potentially help reduce costs and possible chargebacks. At the end of the day run this report, compare your individual receipts to this report and make sure they match. If they don t, find out why. If you are unable to solve this yourself, call Merchant Support for assistance (Visa/MC , AMEX , and Discover ). Fixing problems before you close out your batch will cost you nothing. Trying to fix a mistake afterwards may increase your costs and possibly create a chargeback. Refer to the terminal quick reference guide for instructions on how to run the report. 2. PIN Based Debit Costs Visa and MasterCard Debit Cards can be processed in two ways. One way is to first hit the Debit Key on your terminal, swipe, and then the customer enters their PIN. Another way is just to swipe the card and process it like a credit card in which the customer signs the receipt. Both ways will work. Did you know that every PIN based debit transaction costs you 65 cents? That can be a huge savings for some departments whose average transaction amount is $35 or higher. For example: if you process a $100 transaction as a credit card (just swiping it) it would cost you approximately $2.00 in processing fees. If that same transaction was processed as a PIN based debit, your costs would be 65 cents saving you $1.35. On the other hand, a $15 transaction processed as a credit card will cost you approximately 30 cents where the PIN based debit charge would be 65 cents. FSU Cards can only be processed as a PIN based debit.

7 7 In the News Florida man pleads guilty to two counts of conspiracy in what is considered to be the largest credit card fraud case in U.S. history. He was accused of stealing at least 130 million card numbers from companies that have recently made headlines like the TJX Corporation and Heartland Payment Systems. He faces 17 to 25 years in prison. (Reported by the Australian). Click Here to Read Story NY Times Article Las Vegas police are warning everyone about the growing threat of the skimming scam. Click Here to Read Article Contact Information