Credit card skimmers are one of the easiest ways to lose your card data, besides database breaches and losing the physical card itself. A skimmer is designed to blend in with the thing it’s being attached to, essentially just a second card reader on top of the first one, where it sits in wait to steal data. The payment goes through – the regular card reader is still getting to read the card, just after the skimmer – and the data is stolen. It’s very stealthy. The top-of-the-line skimmers are so good it’s basically impossible to tell one has been put onto a gas pump, or over the credit card terminal. You may only find out after the fact, when you receive a credit card statement and realize you’ve been getting charged repeatedly, or get an alert from your bank.
The skimmers have been around for a long while, but this logic applies to many scams! The stealth aspect of it makes it more difficult to catch the scammers, and gives them more time to extract information or money from you without you noticing and fighting them. Where antiviruses can prevent things like ransomware from getting onto your device, a combination of social engineering and human exploits can get around even the most adept.
Fake Microsoft Pages
Microsoft, which has a truly absurd number of integrations with other sites, is a perfect target for a skimmer-like attack. A simple fake would involve buying a commonly mistyped domain for a service that integrates with Microsoft, waiting for people to mistype the URL, and then popping up a fake Microsoft signin page. Once the person reaches the Microsoft page, they’ll probably try to log in, at which point they’re just giving their data straight to a scammer. After that, there are a couple of options – redirecting directly to Microsoft is one, so the person trying to log in just thinks they typo’d their password, or forwarding the information to the actual login page, so they never know a hack occurred at all. The second one requires more technical skill, but is capable of getting past authenticator apps, while the first one is easier for a hacker to execute, but cannot scoot by 2FA.
To defend against this, the single easiest thing you can do is always type your desired address into the address bar directly, instead of clicking links sent in emails or found on third-party web pages. The Microsoft redirect or Single-Sign-On URL is incredibly long, so it’s often easier to verify before you get to that page that you’re in the right place.
A good second layer is to have conditional access policies in place that prevent logins from outside the country you’re currently in. While this won’t prevent an American from getting into another American’s account, it can stop people from hacker farms outside your country getting in purely based on their IP address, saving you a lot of trouble. You’ll still need to change your password, but it gives you time to do so!
Extended Warranty
For a little while, memes about extending your car’s warranty were everywhere because the phone calls were everywhere. This itself was another skimmer-type scam – the person calling is usually not actually affiliated with whatever company they say they’re calling from, what they’re doing is calling, waiting for someone who’s interested, and then connecting them to the car company… and hanging out on the line to gather personal data. The warranty still gets extended, just like you still get logged in, or still get charged correctly for your energy drinks at the gas station, but a third party has stolen data from you.
This is tougher to defend against, because you may genuinely be interested in whatever service they’re offering. It’s why the scam works at all! But your best bet is going directly to the webpage of the people you’re trying to get a deal from and then calling them back. Remember – scams will often try to create a sense of urgency, and may tell you the deal won’t be available anymore if you get off the phone. In that case, you’re better off assuming the deal wasn’t real to begin with!
Lots of scams use the skimming ethos – knowing when a middleman might be interested in stealing data can help you sort scams from legitimate transactions.
