US SECRET SERVICE WARNS OF ‘CHIP SWITCH’ CARD SCAM
The U.S. Secret Service is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations. In this scheme, the fraudsters intercept new debit cards in the mail and replace the chips on the cards with chips from old cards. When the unsuspecting business receives and activates the modified card, thieves can start draining funds from the account.
According to an alert sent to banks late last month, the entire scheme goes as follows:
1. Criminals intercept mail sent from a financial institution to large corporations that contain payment cards, targeting debit payment cards with access to large amount of funds.
2. The crooks remove the chip from the debit payment card using a heat source that warms the glue.
3. Criminals replace the chip with an old or invalid chip and repackage the payment card for delivery.
4. Criminals place the stolen chip into an old payment card.
5. The corporation receives the debit payment card without realizing the chip has been replaced.
6. The corporate office activates the debit payment card; however, their payment card is inoperable thanks to the old chip.
7. Criminals use the payment card with the stolen chip for their personal gain once the corporate office activates the card.
The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that. So, they change out the chip and send the card on to the legitimate account holder and then wait for it to be activated.
The Secret Service memo doesn’t specify at what point in the mail process the crooks are intercepting the cards. It could well involve U.S. Postal Service employees (or another delivery service), or perhaps the thieves are somehow gaining access to company mailboxes directly. Either way, this alert shows the extent to which some thieves will go to target high-value customers.
– krebsonsecurity.com –