Lexington, Kentucky, financial crimes detective Gene Haynes swiped a credit card through an innocuous black card reader known as a "skimmer." Less than a second later, two lines of illuminating text showed up in a Microsoft Word document on his computer screen. The mishmash of numbers and symbols was the visual representation of all the information stored on the card's magnetic strip.
"That's all it takes" for a credit card to be compromised, he said.
The information then can be emailed or downloaded over the Internet and rewritten onto any card with a magnetic strip, such as gift cards or hotel keys. While the victim's credit card is still in his or her possession, someone could be using a perfect replica hundreds of miles away.
"Suddenly they've got a physical asset that they can use to shop in stores," said John Sileo, a Denver-based author and speaker on identity theft and financial crimes. "There's not much you can do. They can spend on it until you figure it out or until the credit card company catches it."
The process, called "cloning," accounts for much of the growth in credit card fraud during the past few years, officials said. According to a Javelin Strategy and Research report, credit card fraud has increased 87 percent since 2010, culminating in aggregate losses of $6 billion nationwide.
Credit card cloning is easy and lucrative, accounting for its popularity, said Sileo, who founded the Web site Thinklikeaspy.com. For example, an unscrupulous restaurant waiter with a pocket skimmer might be able to steal information from hundreds of customers a week, selling that information to those with the means to encode fake credit cards. Battery-powered skimmers can be carried in a pocket or hung inconspicuously over card slots at gas pumps and ATMs, copying information as customers swipe cards to pay for gas or withdraw cash.
People whose cards are skimmed might not know for weeks or months that their information has been stolen. Once someone realizes it, the account usually is closed quickly. Savvy crooks know to rack up major bills just as fast. Two financial crimes detectives in Lexington primarily investigate credit card fraud. Detectives Mike Helsby and Larry Kinard each take about 50 reports of credit card fraud a month, they said. Among those, cases involving cloned credit cards are most troublesome because there is little Lexington police can do, Helsby said. If a cloned card is used outside Lexington, police do not have the authority to investigate it. "We don't like to take reports here for people whose cards have been used outside of our jurisdiction, because all it does is inflate our numbers," he said. "There is nothing we can do. We can't call California and request (surveillance) video, and even if we got it, we can't place charges."
Instead, interstate credit card fraud should be reported to the Internet Crime Complaint Center, or IC3, a partnership between the FBI and National White Collar Crime Center. Most, if not all, banks and lending institutions accept reports from the IC3 in lieu of a police report when victims are disputing fraudulent charges, Haynes said.Online reports may be submitted at IC3.gov, by clicking on "file a complaint" on the home page. When following the prompts, victims should select "identity theft" as the type of incident they are reporting. (Many states consider credit card fraud a form of identity theft, though Kentucky doesn't, detectives said.)
IC3 aggregates data submitted and can cross-check it to find a point of compromise. For example, they might discover 500 fraudulent credit cards were used at the same gas station in Lexington, and they can forward that information to Lexington police, who then can investigate further.However, given the lengthy paper trails that can complicate fraud investigations, the best defense is never to have your credit or debit card compromised.
Detectives offered the following tips:
¡ Don't carry more credit cards than you need.
¡ Check card readers at self-serve gas pumps, ATMs or other machines for obvious card skimmers.
¡ Don't let your credit card out of your sight for any longer than necessary when paying for items or meals.
¡ Check your bank history often. Most banks allow you to check your account online or through apps on smartphones.
¡ Take advantage of security measures offered by your bank. For example, some banks allow you to set spending limits that require authorization over certain dollar amounts.
¡ Never give anyone the PIN number for your debit card (and don't write it on or near your card).
¡ Pick a random PIN number rather than obvious numbers like your address or phone number.
¡ As soon as you notice your wallet or credit card is missing, cancel all your cards.
¡ If your card has been stolen or compromised, secure copies of bank statements to provide to police or federal authorities.Such tips might seem like common sense, but investigators say they're invaluable to combat a type of crime that affects thousands of people daily and siphons billions of dollars from individuals and financial institutions every year.