Card skimming is a problem in South Africa, with debit and credit card users scammed out of money thanks to advanced software and hardware used by criminals.
Waiters and bar staff at restaurants are often perpetrators of card fraud, and in some cases are recruited by syndicates and supplied with the means to steal customers’ money.
“The card fraud perpetrators provide business staff with handheld skimming devices and reward them for skimming customers’ cards,” states The Banking Association of South Africa.
If you visit a restaurant or bar and are concerned about card skimming fraud, this is what you need to watch out for.
Shoulder surfing and thermal technology
When entering your PIN into a point-of-sale device, make sure the keypad is covered and not visible to others.
Waiters or bar staff may “shoulder surf” their victims, watching them enter their PIN.
Armed with a smartphone and a thermal imaging attachment, criminals can also steal your PIN using thermal technology.
Because you leave behind a thermal signature when you press buttons on a keypad, criminals can use a smartphone with a FLIR ONE thermal imaging attachment to figure out your PIN.
As there is a time lapse between the time you press the first and last buttons, it is easy to figure out what your PIN is.
To combat this, touch all the buttons on the keypad after entering your PIN.
The victim’s card is often stolen or cloned during the transaction or at a later time in combination with the above.
Dropping or cleaning the card
Watch out for a waiter who drops you card, leaves the table with your card, or states that your card needs cleaning.
Card skimming devices can be hidden under an apron or on a waiter’s ankle, and only require one swipe to store card details.
A waiter may “drop” your card at the table, and swipe it on a device attached to their ankle, or “clean” the card’s strip by wiping it on the inside of their apron – skimming it at the same time.
Also ensure that the waiter does not leave the table with your card to “fetch a new card machine”, as they will have ample time to skim it.
These tricks are used in combination with shoulder surfing.
The broken card machine
“This card machine is not working so I am just going to get another one quickly.” This is a line patrons must listen out for.
Waiters may have a point-of-sale device which has card cloning software loaded onto it.
You swipe your card and enter you PIN like you would on a normal card machine, but this device records and stores all your information.
When you are done, the waiter claims the machine is broken, and fetches the restaurant’s legitimate POS device to settle your bill.
Using fake point-of-sale devices
Handheld skimming devices often resemble real POS devices, with only small differences noticeable.
First Calgary Financial has advice for spotting the difference: if you cannot insert your chip card with your thumb pointed at the device and have your thumb remain fully on your card, do not enter your PIN.
Tips to avoid becoming a victim:
- If you suspect a card machine is fake or being used suspiciously, demand to inspect it and call a manager to verify it is legitimate.
- Never let your credit or debit card out of your sight.
- Cover the keypad when entering a PIN.
- Inspect all slips from POS devices, even after failed transactions.
- Sign up for SMS notifications from your bank, and regularly check your bank statement.
- Check your card after every transaction – ensure it is the correct card.
- Touch, but do not press, other keys on a keypad when entering a PIN, as criminals may have access to thermal technology.
- Use cash if you feel uncertain about the POS device or establishment.