A year into the making, there is now a patent pending for a device that can detect credit card skimmers.
At the University of North Texas’ Cyber Forensics Lab, UNT professor Scott Belshaw worked with Michael Saylor, the president of Cyber Defense Labs and students at UNT’s Texas Academy of Mathematics and Science to create the device.
“I’ve spoken with some of the big major gas companies and they’re just excited about, ‘Wow! That would be something that would be great,’” Belshaw said. “Because you look at, like Buc-ee’s over here that has so many gas pumps, somebody could pop one in there and you wouldn’t even know.”
Credit card skimming is when people use devices to steal credit card information when someone is doing everyday things like getting gas or money from the ATM. Skimmers can be placed over almost any credit card reader but are most often found at gas stations or ATMs, according to The Balance, a personal financial advisory website.
“There’s the Bluetooth skimmer that is primarily found in gas pumps,” Saylor said. “And so it’s inside the pump and it transmits out over a Bluetooth connection to bad guys waiting in the parking lot or next door.”
For ATM skimmers, it is usually something over the card slot so when people slide their card in, it captures the credit card information.
“Those are usually in conjunction with some hidden camera so they can capture your PIN code,” Saylor said. “And those devices are either Bluetooth or they store the data on little memory cards.”
Another type of skimmer is called an overlay skimmer.
“So if you’re at the grocery store and you see the little credit card reader there or at Starbucks, bad guys can buy a complete fake cover that looks identical to that,” Saylor said. “They just distract the cashier and they just stick it right on top of the credit card reader that’s there.”
Saylor said the idea is one detector can find multiple types of skimmers.
“Our approach is a little more encompassing instead of just focusing on one type of skimmer, which I don’t believe anybody has done," he said.
The average ATM skimming fraud costs $600 per card and a single compromised gas station pump can capture data from around 30 to 100 cards a day, according to Rippleshot’s State of Card Fraud 2018 report.
“With our wand, they can go around and scan all the pumps and ... as researchers we don’t necessarily say, ‘Yes there is’ or, ‘No there’s not’, we say, ‘More likely there is,'”Belshaw said of the detector. “So what we do is based on the technology inside ... it will say, ‘Yes, more likely there’s one in [there], you need to check.’”
With the technology of the detector completed, the next step in its development is the design, with a preliminary drawing of what it could look like.
“We’ve just got the tech built, so it’s just a bundle of wires and stuff,” Belshaw said.
Concurrently with the design process, Belshaw also wants to test the detector at gas pumps, instead of on skimmers they activate in the lab.
“Gas pumps are designed different ... so we want to use a bunch of different kinds of gas pumps from different companies,” he said. “My ultimate goal would be to look at different gas pumps from a whole bunch of different companies and if we can do that, then that’d be great.”
Belshaw said the detector works, they just want to be able to test it in the field.
“The problem is that we would have to get a phone call from someone that has found one and we would have to race over there and test it,” he said. “Not very practical. We know the tech detects it, [we] just need to do it in the field.”
The ultimate goal for the detector is for entities to be able to buy and use it.
“Gas companies, law enforcement, the public [could use it]; to have that, that’d be nice if you had one of those if we could develop it smaller," Belshaw said.