ATM WARNING: No rules and regulations

There are nearly half a million ATMs in the U.S. Most are affiliated with reputable banks and monitored daily. But we discovered that anyone can get into the cash dispensing business. There are no regulations in the U.S. on who can own or operate an ATM.

“I can go right on craigslist or ebay and just type in ATM, and instantly you’re going to find companies’ ATM machines,” says Boston area identity theft expert Robert Siciliano. He shows us dozens of new and used ATMs for sale online all over the country, and the one he bought for $750 on craigslist.org from the previous owner in Beverly. This one comes with something extra. The previous owner forgot to delete the transation history stored in the ATM before Robert picked it up.

The result, a printout 150 feet long of all the credit and ATM card numbers the machine processed in a four month period. Private data from customers who are most likely unaware their security has been breached. That’s one way your information can be compromised. Another way, is through an ATM skimming device, that you can buy off a website. In a matter of minutes, Robert shows us how easy it is to rig an ATM to steal personal information and have it still dispense money at the same time. It is as simple as attaching a skimming device on top of the card slot. This one is designed to look like it is part of the ATM. Not only can the ATM be rigged to steal your card information, it can also steal your pin. This one has a tiny camera pointed right at the keyboard. Using technology widely available for purchase online, scammers can make duplicate copies of your ATM card, and with the pin, drain your account.

For a crook to steal information, someone would have to use the ATM, but when we took the rigged ATM to three different locations north of Boston, there were concerns, but necessarily about the security of the machine itself, but the fees. No one could spot the skimmer or the camera, until after we pointed it out.

Siciliano says if an ATM is unsecured or looks out of place, don’t use it, because you never know who put it there. Also, if the machine looks like it’s been tampered with, or has any unusual attachments, it could be hacked. If your information is compromised, you most likely won’t find out until it’s too late. “I just couldn’t believe I could go on craigslist and buy an ATM machine. It shouldn’t be that easy,” Siciliano says.