Using brash ingenuity, criminals out to steal your personal data are tampering with the checkout machines in department stores, supermarkets, gas stations and even your doctors' office.
Their prime target: your debit card account number and personal identification number.
Thieves use ruses, such as posing as repairmen to alter and corrupt payment terminals — installing skimmers and storage devices that capture account numbers from the magnetic strip on a card as well as the PIN numbers the customer keys in.
STORY: Why you should use your debit card sparingly
"Technology is making it easier for criminals to develop smaller, more effective skimming devices," says Dale Dabbs, CEO of identity theft protection service EZShield.
The compromised checkout machines are so widely dispersed that many crimes go unnoticed and public reports are sporadic, says Jeff Hall, director of Technology Risk Management Services at consultancy McGladrey.
Barnes & Noble recently disclosed that data thieves got away with installing corrupted checkout terminals in 63 bookstores in nine states. The case is under investigation, and the company has not said how many customers were affected.
In late September, Toronto Police arrested four men at a subway station in possession of 168 counterfeit debit cards. A fifth suspect was arrested later in his west side condominium — with a cache of point of sales (POS) terminals. Some of the devices were ripped apart for use in assembling altered terminals, says Toronto detective Ian Nichol.
Verizon's data-breach investigations unit noted that data thieves have begun targeting POS terminals used by patients to make co-payments and pay deductibles in health services clinics and facilities. Verizon annually investigates several hundred data-breach cases and reports on trends, but does not disclose names of the victimized companies.
Debit card account numbers and PINs are highly sought because they can be converted quickly into cash. A device called a mag stripe encoder can be purchased legally on the Internet. For about $200, anyone can embed a stolen payment card number onto a blank magnetic striped card. With the associated PIN, free cash is only an ATM away.