8

I would like to make some workshop about Debit or Credit card fraud (Skimming). So I need as much as possible information about it.

  1. Is it possible to clone debit or credit card with MagStripe reader and encoder which usually sold by POS store like this one?

MagStripe reader and encoder 1

MagStripe reader and encoder 2

  1. Is it possible to clone debit or credit card, can I cashout from ATM and transfer some fund to another account? In this case, I know the PIN number.

  2. Please tell any factors which can cause failed or successful in case of Cloning debit or credit card and use it for evil purpose!, maybe there is any important factor like blank magstripe specification, magstripe reader and encoder specification, the ATM itself. the Card itself maybe any encryption.

FYI: In my city, the debit card still uses MagStripe and no Chip on the card and I just tested my debit card with MagStripe reader which cause leaked card number, expired date, and some unknown number.

Krishna Pandey
  • 1,497
  • 1
  • 16
  • 26
Dark Cyber
  • 225
  • 1
  • 5
  • 11
  • 1
    1) I don't know as there are multiple tracks on the card and the reader needs to read/write all of them to make a good clone. 2) you can withdraw cash at an ATM if you know the PIN, but transferring funds (wire transfer) often requires you to log into the banks web interface and uses totally different credentials unrelated to the card. 3) I don't understand the question, please clarify. – André Borie Dec 13 '15 at 18:51
  • @AndréBorie **About Q1**, Please tell me more about multiple track on the card and the reader needs to read/write, I don't know the tracks function exactly. **About Q2**, I mean transfer money from ATM because In my city we can transfer money via ATM. **About Q3**, I mean, I think cloning card is not always end with successful, maybe there is an try and error step, maybe there is any case which can cause Cloning card end with failed. (eg: cloning card must use MagStripe encoder type XXX, MagStripe card must blank, not all ATM work with cloned card, writing data to card must use formula, etc) – Dark Cyber Dec 13 '15 at 20:26
  • @AndréBorie what about my explanation **About Q3** dude, is there any case which can cause failed on cloning card n use it for evil purpose? Thanks – Dark Cyber Dec 15 '15 at 04:22
  • 1
    Krebs has written many very good articles about card skimmers and the carding industry. He has tons of high quality photos that he has found on many carding sites as well: http://krebsonsecurity.com/all-about-skimmers/ I would definitely consider him an expert on the subject. – Allison Wilson Jul 21 '16 at 20:24

1 Answers1

8

Q1: Yes. The link for MagStripe reader and encoder 1 does exactly that. Can read credit or debit and write it to a new blank card and can also erase data on an existing card. the MSR605 comes with software to do all of this. These machines can clone ANY card with a mag stripe. Gift cards, hotel cards, rewards cards, credit cards, id cards, etc.

Q2: Yes. you can skim a debit card and if you have a pin you can go straight to ATM and get cash. The PIN is NOT provided in the skimmed data. Using skimmed cards at gas stations for example might also require you to type in a zip code associated with the card.

Q3: The only failure in skimming cards is if the machine is broken or card is damaged. Every card with a mag stripe is the exact same and every mag stripe reader can skim any and every type of credit card or any card in general with a mag stripe. If the card has a black strip on back then it can be read. They all use the same technology. The success rate of skimming a card with a black stripe through a Mag Stripe reader is 99%.

Real-life Scenarios and Scam

GIFT CARD SCAM: At Walmart you see stands with Gift cards on them. Let says the criminal takes 10 $50 Walmart gift cards(unactivated). He goes to the bathroom and skims the data off all of them then puts them all back on the shelf. He then will check the card numbers everyday on the website to see if they are activated. When a customer comes in and purchases that gift card, it gets activated and the criminal already has the data and can use it right then and there.

FAST FOOD SCAM: Another popular scam happens at Fast Food Drive-Thrus. The cashier has a skimmer next to the register. When you hand them your credit or debit card through the window, they will swipe the card through the register and then swipe the card a second time through the hidden skimmer. (Happened to me at a Taco Bell lol)

GAS STATION SCAM: There is practically a universal key that opens up any gas station pump. Criminals will open them up as put a device that will record all credit cards that are swiped. Use gas pumps that are close to the door, criminals usually install them on pumps out of site. Also look for a sticker on the pump where the pump door would open, if the sticker was peeled off to open the door it will say VOID VOID VOID across the sticker, that means some one went into the pump.

MOST PEOPLE DONT KNOW: Skimming a card with the machine is not only way to get skimmed data. A lot of cards have RFID chips inside of the even if you do not ask for them. If your card has one you will see a symbol on your card that looks like a signal or wifi symbol with the 3 bars. There a RFID machines that clone this data. Someone can walk around the mall with this RFID handheld device and all they have to do is get less than a foot away from you and it will skim the data from the RFID chip. It can skim it right through your pocket, wallet or purse.

Funny example of what you can do with a skimmer. You can clone you credit card onto a hotel key card. Then go to McDonald"s and use your hotel key card to pay for food.

Prevent RFID skimming: You can buy a special sleeve or wallet to block the RFID signal. But i recommend just having your bank reissue you a new card without it.

Prevent MagStripe skimming: Use cash at drive thru windows or any business that uses your card out of your sight. - Change card numbers every 3 months because most criminals skim your card and sell it to others which means they could be holding onto your information for many months before selling it.

Experienced Skimmers: The best of the best will buy blank Visa or MasterCard gift cards. Then they will clone your card to it and use a embroider to actually punch in the actual name and card number onto the card(most gift cards have numbers that can be wiped off that are not embroided). They will also make a fake ID in case cashier asks for identification.

Hope this helps.

h4ckNinja
  • 3,006
  • 15
  • 24
nd510
  • 1,738
  • 1
  • 10
  • 15
  • 2
    That is why I removed the comment. Not all online websites require the CVV2. Pizza Hut, for example, does not. Amazon does not. – h4ckNinja Jul 22 '16 at 18:45