The New York County District Attorney announced that the NYPD arrested four men on March 21, 2013 suspected of using concealed card skimming systems to grab card numbers and PINs from hundreds of victims at gas stations in Texas, Tennessee, and Georgia. The thieves targeted RaceTrac and RaceWay pumps with their tools and nabbed $2.1 million from stolen credit and debit cards.
The system they used is similar to skimmers found in gas stations throughout California. Designed to connect in line between the card reader and the pump computer, the skimmer reads PIN input and the magnetic stripe and stores it locally. The thieves could then drive by and pull the data off wirelessly using Bluetooth-equipped phones.
The four defendants – Garegin Spartalyan, 40, Aram Martirosian, 34, Hayk Dzhandzhapanyan, 40, and Davit Kudugulyan, 42 – are charged with 426 counts of money laundering, criminal possession of stolen property, and grand larceny. Additional defendants were charged with counts of Money Laundering in the Second Degree or Money Laundering in the Third Degree.
“In this case, the defendants are charged with stealing personal identifying information from victims in southern states, used forged bank cards on the East Coast, and withdrew stolen proceeds on the West Coast,” said District Attorney Cyrus Vance. “My Office’s Cybercrime and Identity Theft Bureau also operates across borders, and will continue to track and prosecute identity thieves here in Manhattan and around the world.”
Brian Krebs has further detail on the scam which involves sticking the devices into gas pumps using a universal key and simply driving by later to gather the numbers. Crooks can then clone the cards they steal and use them to withdraw cash at ATMs.
Writes one officer involved in stopping the scam in California:
The moral of the story? In short, don’t use your PIN number at a gas pump. Because these tools are so well-hidden there is no way to simply push or tug on the reader to test for tampering (I actually pull card readers at every ATM I use to see if they are affixed poorly or have been tampered with.) Having a credit card number stolen is far preferable to having your bank account cleared out via your PIN.