Scam artists attached skimming devices to three NEFCU automated teller machines in branch vestibules on Long Island, and the data they gathered was used in fraudulent transactions totaling about $158,000 as of Wednesday morning, a credit union executive said.
A spokeswoman for Nassau County Police said an investigation was underway but additional details were unavailable.
The skimming devices were discovered at NEFCU branches in New Hyde Park, Franklin Square and Wantagh.
John DeIeso, NEFCU vice president and chief operating officer, said in a telephone interview that the scam affected a fraction of 1 percent of the financial cooperative’s 160,000 members and that he believed “the bulk” of the losses had been reported.
The fraudulent transactions occurred in Brooklyn, Queens and Manhattan over the weekend, DeIeso said.
The breach marks the first time that NEFCU ATMs were compromised, a spokesman said. He said that customers are being reimbursed within one business day of alerting the bank to valid claims that they were defrauded.
“We have already made good on every single claim that has been submitted,” the spokesman said.
Skimmers are devices attached to ATMs that gather credit or debit card information from the cards’ magnetic strips and the personal identification numbers, known as PINs, punched in by customers. That information can then be used to buy products or get cash.
Robert Spohr of Garden City South said that on Sunday his wife went online to make a mortgage payment through NEFCU and she “freaked out” when she noticed unauthorized transactions.
The fraudulent ATM withdrawals totaled about $2,000, he said.
“We feel a little violated,” Spohr said, though NEFCU restored the funds siphoned off from three family accounts.
California-based analytic software firm FICO reported that the number of U.S. ATMs compromised by scammers rose more than fivefold in 2015 compared to the prior year.
Since 2012, police have reported skimming incidents at numerous Long Island financial institutions, including Astoria Financial branches in Franklin Square, Kings Park and Huntington Station; an HSBC Bank branch in Lynbrook; a Chase branch in Cedarhurst, and Capital One branches in Valley Stream and Carle Place.
Deposits at credit unions are insured by a fund run by the National Credit Union Administration. Bank deposits, similarly, are insured by the Federal Deposit Insurance Corp.
However, the insurance fund does not cover skimming fraud, so NEFCU is reimbursing the claims itself, the spokesman said.
NEFCU said in the statement that it became aware of the scam when it was alerted by a third-party monitoring agency and members who noticed suspicious activity in their accounts over the weekend.
Footage from video cameras is being reviewed by NEFCU’s security team and law enforcement investigators, the spokesman said.
It was unclear when the card skimming occurred, the spokesman said.
DeIeso said that NEFCU issues chip cards for its ATMs, but the technology does not protect against fraud when cloned cards are used to make fraudulent withdrawals in earlier generation ATMs that can’t detect the chips.
How to spot a skimming device
- Tug on components that seem bulky, out of place or poorly connected to see if they move
- Check for tape, glue residue, pry marks or a misaligned card slot
- Look for holes or slots in the ATM or light fixture above that would let a camera record keystrokes
- Examine the keypad for overlays that can be used instead of a camera
- What to do
- Use your hand to shield your PIN keystrokes
- Be wary of loiterers near an ATM
- Check your bank statement regularly
- Use similar strategies at self-service gas pumps
Source: Nassau County Police Department