Threats, bribes as fraudsters target eftpos devices

Photo / Greg Bowker

Three Canadians have been arrested in what police say is an international crime syndicate, which secretly modifies eftpos machines in shops to steal customers' credit card details.

The skimmers are alleged to have stolen normal eftpos terminals and replaced them with "compromised" replicas, often with the help of shop staff who are bribed with money or threatened with violence.

The tampered machines record the bank account details of swiped cards, which are then transferred to blank cards.

Pinhole cameras hidden near the eftpos machines or false keypads are used to record the PIN numbers, before the cloned bank cards are used at ATMs to withdraw cash.

Like normal skimming attacks, where bank cards are skimmed by false fronts on ATM machines, victims are often unaware of the fraud until they check their bank balance.

This week, three men appeared in Auckland District Court charged with participating in an organised crime group which allegedly stole a number of eftpos pin pads.

The Canadian trio of Giovanni Patroni Hernandez, Guillermo Alexis Esquizel Lemus and Jonathon Burrel, aged between 21 and 30, are in custody and are the subject of an ongoing police and Customs investigation. Interpol and the Royal Canadian Mounted Police are also involved in the inquiry.

The inquiry was triggered after one of the main providers of eftpos pin-pads alerted police that 11 units had been stolen since mid June.

An Australian police taskforce arrested 40 people this week. Police there have advised people to use cash or to sign for transactions instead of using their PINs when using eftpos.

But Auckland police spokeswoman Noreen Hegarty said New Zealand eftpos providers say the technology here is superior to that used overseas.

Simon Tong, chief executive of the largest eftpos provider, Paymark, was aware of five terminals being stolen in NZ and said the firm was working closely with the banks affected.

"At no stage whatsoever has merchant or customer information, including financial data, been compromised and the security of the Paymark Network has not been impacted by the thefts," he said.

A statement from ANZ/National said the bank knew of a small number of terminals - which did not belong to it - being stolen and recovered within two days.

The serial numbers were blocked to make them unusable by thieves.

"The security of the network was never impacted by the thefts and at no stage was any customer data compromised ... The terminals in New Zealand differ from those in Australia and cannot be moved and still operate."

A BNZ spokeswoman said NZ's better security software and detection systems meant there had been no victims here so far.

"While we have been alerted to a handful of incidences of tampering with terminals, none have been successful."

HOW SCAM WORKS
* Members of the crime ring bribe or threaten store workers to be part of their scam.
* The fraudsters enter the shop and the worker turns away from the counter.
* The eftpos machine is replaced with a dummy terminal.
* The thieves take the machine away and install a microchip, to record card data, and a keypad underlay, to learn pin numbers.
* The modified eftpos machine is returned to the store.
* The thieves use information from the machine to make fraudulent eftpos and credit card transactions.

Source: Australian Federal Police.