News Feed

“Shimming” on the Rise, Credit Unions Should be on Alert

Thu, Dec 21, 2017

Credit unions should be on alert for a new form of card skimming called “shimming,” which targets chip-based credit and debit cards. “Shimming” scams are on the rise around the country, and several “shimmers” have been found at credit unions in our area. While “skimmers” are card readers placed over an ATM’s card reader slot, “shimmers” are virtually undetectable because they are paper thin and wedged inside ATM slots. The “shimmers” contain an embedded microchip and flash storage that reads data from chip-enabled cards, including the card number and expiration date. While the data collected cannot be used to counterfeit chip cards, it can be used to make fake magnetic-stripe cards.

Detecting fake cards created through “shimming”

According to CO-OP Financial Services, the card verification values (CVVs) on the fake cards will not match the integrated card verification values (iCVVs) of the actual chip cards. By checking the CVVs on transactions, credit unions can identify fraud.

Mitigating the risk of “shimmers”

To mitigate the risk of “shimming,” CO-OP Financial Services recommends that credit unions consider taking the following steps.

  • Conduct physical ATM examinations. Video or PIN-capture devices may be in place to accompany “shimming” devices. Any foreign objects should be noted and removed immediately.
  • Implement anti-shimming equipment. ATM manufacturers may offer protective plates to help deter criminals from attaching “shimmers.”
  • Reissue EMV chip cards with new numbers. Issuing chip cards with new card numbers and expiration dates also triggers new CVV and iCVV values. Even if consumers had been victimized by “shimming,” any captured card information would become void.
  • Utilize fraud prevention resources. Credit unions partnering with CO-OP have access to FICO Card Alert Service (CAS). This resource helps identify skimming points of compromise involving stolen magnetic-stripe cards and PINs.