Have you used your credit card at a restaurant or gas station lately? That's all it could take to make you a victim of a credit card scam.
The scam in question is what's known as "cloning," which entails stealing your credit card's information and then copying the stolen data onto another card to make purchases in your name - even as the original card is still in your wallet.
Out of Sight, Out of Mind
Cybercriminals will sometimes steal credit card numbers by installing specialized malware onto your PC or breaking into the database of a business to steal reams of card data (as in the 2005 TJ Maxx breach, in which at least 45 million Visa and MasterCard accounts were compromised).
By contrast, cloning schemes rely on physically swiping individual credit cards through a handheld device, a process known as "skimming." All a thief needs to do is briefly separate you from your card.
"You could have a waiter in a restaurant or someone else who takes your card for the briefest moment, and they will swipe your card in a device that has memory to hold the information of hundreds or thousands of credit cards," explains Shirley Inscoe, senior analyst for the Aite Group, a financial services research firm.
And unfortunately, most people don't think twice about handing their card over to a waiter or clerk, who could have been roped into a cloning scheme.
"My mom won't buy something online through a website that has encryption technology rivaling that of a bank, but she'll gladly hand her card to a high school dropout waitress who disappears with it for 10 minutes," says John Ulzheimer, president of consumer education at SmartCredit.com.
According to the Nilson Report, payment card fraud losses totaled $3.56 billion in the US in 2010, though it's unclear how much was due specifically to cloning schemes. An official with the Secret Service, which investigates financial crimes, confirms that it's difficult to put a firm dollar figure on cloning, but notes a number of cases closed by the agency in recent years, including that of a restaurant server in California who used a handheld skimmer in a 2010 scheme that resulted in losses of $235,000.
"The problem is very prevalent, but a lot of times it's not reported," says Michael Barnett, executive director of the Identity Theft Protection Association. "It's much easier for the bank or issuer to simply replace the card and close the account than to conduct a full investigation."
Do You Need to Worry?
The good news for consumers is that it will usually be the issuer rather than the cardholder incurring the losses.
"We as cardholders thankfully have very effective protection against fraud," says Ulzheimer. "As long as you're diligent enough to check your account online, read your statement and let them know right away [if you find fraudulent charges], you really have almost no liability."
The best credit cards offer zero liability for fraudulent charges, but even if yours doesn't, the Fair Credit Billing Act limits your liability to $50. Debit cards are a different story, however: the relevant law here, the Electronic Fund Transfer Act, caps damages at $500. And even if you are able to get your money back, in the meantime you'll be hurting for cash and unable to pay bills. That's why many experts say they prefer to use credit cards whenever possible.
"I try to avoid debit cards except under very unique circumstances," says Ulzheimer.
Debit card users also need to worry about a similar scheme in which thieves will affix a skimming device and a pinhole camera to the front of an ATM, allowing them to get both your card data and PIN.
"Their number-one goal is to steal cold, hard cash," says Inscoe. "If they can get your PIN, they can withdraw cash from ATMs around the world."
For this reason, the Secret Service recommends concealing your PIN when using an ATM, and Barnett says to look for anything unusual on the machine.
"A skimmer may be placed over the card slot, and it's typically a magnetic unit," he says. "If there's any protrusion and it comes off in your hand, that's a skimmer." You'll also need to be vigilant when pulling out your gas rebate card at the gas station, as skimmers have been found on gas pumps as well.
Of course, you won't be able to fully inspect every ATM and gas pump you come across, and you can't exactly follow your waitress when she takes your card. As such, your best defense against such schemes is to use credit cards instead of debit cards whenever possible, and be vigilant in monitoring your accounts for unauthorized activity.