Brandon Williams noticed something unusual when he approached an ATM at Wauna Federal Credit Union in Warrenton in July.
A man in front of him used two cards, and the machine projected an error message as he struggled to withdraw cash. Williams noticed the card slot seemed tight, the lighting on the ATM appeared off and some kind of mold had obviously been placed on the outside surface. He poked the front of the slot and saw a loosely placed item inside.
“I was like, ‘Yeah, somebody put a skimmer on the machine,” Williams said.
Williams contacted police, and a skimmer — a small device inserted near card readers in ATMs to steal information — was indeed found. Days later, another skimmer was spotted at U.S. Bank in Astoria.
Warrenton police — after reviewing and publicizing security footage — have spoken with a suspect, and an investigation is ongoing, Police Chief Mathew Workman said. Astoria police have not identified a suspect. It’s unclear if the incidents are related, but they involve two different types of devices.
Williams, a private contractor who lives in Warrenton, started researching skimmers earlier this year after hearing about incidents in other parts of Oregon.
“It’s a shame that we have systemic problems that lead to that kind of behavior,” Williams said. “In an evolving society, we need to educate ourselves.”
The skimmer was apparently inside the ATM at Wauna Federal Credit Union for about 15 1/2 hours, while the device at U.S. Bank was more visible and likely placed shortly before it was discovered.
“I don’t think anybody would’ve found that thing,” Williams said.
Skimmers have been placed in ATMs, gas pumps and other machines at businesses that read credit cards for decades, originally popping up throughout Europe. Initially, they were bulky and more visible.
“You would have to find a really unobservant person to fall for these,” said Mark Cooper, president of PKI Solutions, a Portland-based cybersecurity company.
Over the years, skimmers have evolved in complexity and invisibility, and some include cellular data chips. The chips allow criminals to access information remotely, removing the need to return to the ATM.
“It makes it very difficult for law enforcement to find out who’s doing it,” Cooper said. “Every time it becomes more obvious what the criminals are doing, they change their techniques.”
Representatives from both local banks say no customer information was illegally accessed from the recent incidents.
The Warrenton skimmer case is the first Wauna has seen, said Chief Marketing Officer Debi Smiley, who has worked at the credit union for about 30 years. She noted that the ATM — located in a shopping square with an increasing number of surrounding businesses — is one of the company’s busiest.
“It’s becoming very prevalent at the moment, so there are a lot of precautions going on,” Smiley said.
Both banks have been checking ATMs several times each day, and customers can sign up for notifications alerting them when cards are used. The best remedy, however, is awareness.
Along with the typical precautions — highly visible places, trustworthy businesses — it’s best to insert credit cards into machines that use EMV chip technology, Cooper said. EMV chips are typically placed on the left or right of the front side of a credit card to make them more secure. Most companies now use the chips to avoid forcing customers to fully insert them.
“The better physical control over your card and how you use your card makes a big difference,” Cooper said.
Cooper noted a few things to look for when using a more standard ATM: materials on the surface such as wires, loose objects inside the card slot and whether the card moves at an unusual speed when entering the machine.
“It’s really a matter of awareness, and I think as people get used to using their chip function, we’ll see less of this,” Cooper said. “But it’s going to be around a while. That’s for sure.”