Your credit card can be cloned

Merchant can steal information to create a counterfeit card

MUMBAI: Have you stopped using cash for most of your weekend mall purchases and extravagant dinners at restaurants? And flash your credit or debit card every time you have to pay that bill? If yes, then keep an eye on the shopkeeper who is swiping it because he can clone your card. This is done by swiping the card on a device called a skimmer, which captures the information stored on the magnetic strip of the card.

This has happened to Rohan and Sarita Joshi of Mumbai. Sarita’s eyes popped out reading an SMS Citibank sent her one morning. The SMS asked her to confirm whether she had made high value transactions worth Rs2.82 lakh in Delhi using her Citibank credit card the previous day.

Joshi had last used her card when she was travelling abroad more than a month back. The card, which was an add-on card to her husband’s credit card, lay in her safety vault.

“I was in Mumbai and the transactions on my card happened in Delhi,” says Joshi, who found this after a few calls to the call centre.

The call centre attendant also told Joshi that there were five high-value transactions.
“We were shocked, refuted the claim and immediately blocked the card,” she says. Eight transactions between Rs29,000 and Rs41,000 each at three merchants based out of Delhi.

She and her husband had to make several trips to the police station and many calls to various levels of bank officials. Sarita even sent an email to Sanjay Nayar, the chief executive officer of Citigroup in India. 

The bank, after carrying out an investigation, decided to reverse the outstanding amount of fraudulent transactions worth Rs2.82 lakh. “We were told that the fraud was a case of card information being skimmed and the bank later issued a letter stating that the charges had been reversed,” Joshi told DNA.

Citibank told DNA, “The case has been investigated in detail and the customer has been provided credit to the full extent of the disputed amount. In fact, the fraudulent transactions on this card (and some others) were proactively detected by our monitoring unit and thereafter the relevant authorities, including the police, the acquiring bank and the card association have been kept informed. The method used to conduct these fraudulent transactions is globally termed as skimming.”

If a fraud is detected and confirmed by the customer, Citibank immediately blocks the card and reissues a new credit card to the customer, the spokesperson said.

However, the entire process of getting the charges rolled back was quite an ordeal for the Joshis.

What exactly is skimming?
Skimming is a process whereby a person just creates a cloned version of the card. This clone can be created by either using leaked credit card information or by swiping the card on a device called a skimmer, which captures the data on the magnetic strip of the card. The data can then be transferred to expired or blank cards, which are easily available in the market. And, you have a cloned credit card ready.

“Skimming happens when a fraudster captures the details of the magnetic stripe of your creditdebit card and replicates them on to a new card, creating a counterfeit card. This counterfeited card can be used anywhere in the world,” says Sameer Nemvarkar, vice-president, head of cards, Axis Bank. 

The data theft can happen when you give your card to the restaurant attendant and it’s out of your sight or at the petrol pump or simply at any merchant who may swipe it on a skimmer.

The fraud, which is quite popular in developed countries, is now being reported in India as well. “Developed countries, where the credit limits on cards are higher, are prone to skimming. European and Japanese cards are skimmed a lot. There are now instances traced to smaller economies such as Indonesia, Malaysia, India etc,” says a banker not willing to be named.

Keeping your card in your view always is the only way to protect yourself. “In such cases, technology can do very little. It’s people who have to be careful and it’s important for you to be alert,” says Amuleek Bijral, country manager - India, for RSA, a security solutions provider.

Even discarded card documents can be used to trace information. “Never throw away receipts in a public trash container. When disposing of receipts or old statements, be sure to destroy the areas where the account number is visible. In general, you should keep all your receipts in a safe place to refer to if you suspect suspicious activity,” says Nitin Gupta, general manager, South Asia, MasterCard Worldwide.

The world over, banks are now issuing EMV (Europay MasterCard and Visa) cards to curb skimming. “In EMV chip cards, even though the magnetic strip exists, the validation happens through the chip. When the card is inserted in the electronic data capture (EDC) terminal there is a validation check done and if it is proved that the card is not genuine, the user is protected,” says Nemvarkar of Axis Bank. “Tomorrow, if there is a skimming related dispute, the card holder is protected and the fraud is the liability of the merchant,” he adds. Several European countries and Japan have moved to EMV technology already.

Axis Bank already offers EMV-technology on its Platinum cards and is planning to launch more of them. “We are planning to have EMV chips in all our gold and higher categories of creditdebit card. One may not do it for the mass market as of now as the cost involved is about 8-10 times higher. But all premium category cards can be offered with EMV technology,” says Nemvarkar.

(Names have been changed on request) 

How a card is cloned
Cards can be cloned by swiping them on a device called skimmer or just by using leaked information.

The device captures the information stored on the magnetic chip of your card

This information is transferred to another card to create a fake

How to protect yourself
Never let your card out of your sight

Make sure the merchant swipes it on a bank machine, not something else — it can be a skimmer 

Never throw away old receipts and bank statements in public bins

Ensure that the part mentioning your card and account numbers on your statement is destroyed before you dispose them of