Friday, June 14, 2013

MCDP – Fraud Section

1

Montgomery County Department of Police Financial Crimes & Electronic Crimes Section Detective Brandon Mengedoht 240-773-6330 [email protected]

Disclaimer  This presentation is an educational tool and while names, photographs, cartoons and other information may be included – it is not meant to cause injury, embarrassment or harm to any individual or entity.  The information is based on the presenters own personal and professional experience.  Information was obtained from cooperating law enforcement agencies, financial institutions, business’s, victims and other numerous sources Friday, June 14, 2013

MCDP – Fraud Section

3

Disclaimer  While this presentation may present in verbal, written and visual form, various Financial Institutions, Merchants and Vendors, it does not endorse or promote nor does it represent that one may be superior or inferior to another.

Friday, June 14, 2013

MCDP – Fraud Section

4

Skimmer Types  Gas Pump  Retail / Restaurant (hand held)  Bank ATM

Let’s Talk About Gas Pump Skimmers The US Attorney’s Office in the Western District of Arkansas reported authorities have recently discovered a state of the art credit card skimming device in a gas pump of a major supplier in a large metropolitan area in North Texas. The suspects have master keys to more than one brand of gas pumps. They simply unlock the pump cover and install the device. The device is estimated to hold the data of 2,500 to 3,000 credit cards. The suspects can also access the device remotely. It would appear only high volume facilities would be targeted. Also, the only known means of location is personal inspection or the identity of the compromise point for a large number of fraud complaints.

News Event  http://abclocal.go.com/wpvi/story?section=n ews/local&id=9054387

Let’s Talk About Retail / Restaurant Skimmers

Friday, June 14, 2013

MCDP – Fraud Section

9

Simple Theft of Just Card Number  writing down the number & code for use later on  taking photos of the card & code with number and email / texting it to others.  Not really “skimming”  Used for internet purchases. – Small time local offenders

Theft from Retail location of customer base

   

Complex Theft of the Mag Strip Data -Players involvedInside employee Recruiter Card Makers Runners

Credit Card Plant  The Highlight and Goal of any Skimming investigation is to discover the plant location and shut it down.  Equipment Needed – Printers, Embossers, Metallic Paper, Card Stock, Skimmer, Writer

What is Mag Stripe Data?

Friday, June 14, 2013

MCDP – Fraud Section

30

%B5312540000869328^FATY/AMADOU CHERIF^1405101000000000050600506000000?;5312540000869328=14051010000000000506?

Friday, June 14, 2013

MCDP – Fraud Section

34

Let’s Talk About ATM Skimmers

Friday, June 14, 2013

MCDP – Fraud Section

35

Equipment  Camera or Pin Number Capture device  Skimmer Device  - Audio devices have been located in Europe  Boosters for wireless device to enhance distance.

Key Pad Pin Capture Type

ATM Skimmer & Camera Report 11009439

Card Skimmer

Camera Device

ATM

Skimmer placed inside Groove

Camera place via Magnet on right side (under square) to capture key pad

SunTrust Skimmer Montgomery County PD, MD #11022632 Det Mengedoht 240-773-6330

 05/12/2011 (Thursday)– Employee checks ATM at 1330 hrs – it is clean. Checks again at 1845 hours and finds Skimmer Device.  NOTE: Follow investigation by Bank discovers multiple placements and removals of more devices at the bank after the initial date!

Device Discovered

 05/12/11 @ 1845 hours – Employee discovered skimmer. Missed the Video device - found the next morning Reset buttons Serial # on chip gm72v661641ct7j/ A LGS (GM) – SDRAM Chip 3.3 volt 64 mb

camera

Photos taken 6/03/11

Clean ATM Photos

Sun Trust ATM

Photos taken 6/03/11

Placement of the Card Reader Over ATM slot – fits like a glove

Envelope placed to show fit

Video Device Placement Inside the screen frame – double Sided sticky

Partially closed

Video device in place

Below is a clean photo – (no device) to show frame

Pin Hole for Camera Left – note slight gap In frame indicating placement of device

05/12/11 18:19 ATM L145 Bethesda_Device Install_05122011_181946

This is believed to be the INSALL of the device shown above which was recovered approximately 25 minutes later

05/14/11 1606 ATM L145 Bethesda_Device Install_05142011_160601

05/14/11 1957 ATM L145 Bethesda_Device Removal_05142011_195731.jpg

Sunglasses in mouth

Partner

05/21/11 2116 ATM L145 Bethesda_Device Removal_05212011_211627

05/22/11 1012 ATM L145 Bethesda_Device Install_05222011_101224

05/22/11 1358 ATM L145 Bethesda_Device Removal_05222011_135855

05/28/11 1702

ATM L145 Bethesda_Device Install_05282011_170218

05/28/11 2202

ATM L145 Bethesda_Device Removal_05282011_220231

Skimmer Case Montgomery County, MD Police #10001210

 Det Mengedoht 

240-773-6330



[email protected]

 Recovery of skimming device from Bethesda BC ATM (MD)     

01/08/10 ATM IMDD2317 Bethesda BC 7316 Wisconsin Av Bethesda, MD 20814

Location

10:41:05 am – 11:28:45 am

Suspect placing the Skimmer

Skimmer placement As would be placed on ATM

Pin Hole Camera facing keypad

Rear Two sided tape held skimmer to ATM USB Port

Reset Button Mag Strip capture sensor

Deconstruction Rear was found to be a putty or clay Compound which completely Covered the electronics Battery under USB Port Uncovered.

Second Battery & Electronic “motherboard”

Estimated battery life Of 6 hours. 2 MB of memory storage

Camera

“Video” Camera Hole Camera uncovered – note the copper strip Leading to motherboard.

Photo of Suspects hand while testing placement of skimmer. Note the clear view of keypad This is a snapshot of the and wallet filled with cash. video which shows multiple clients keying in PINs Skimmer also contained Hundreds of photos From at least 3 other ATM locations.

Motherboard Info  The mother board is a:  anyka ak3631814402  Possibly a “Gumpack” Camera  http://www.chucklohr.com/808/ See link for example / info on micro camera

Skimmer Placement

10:41:05 am – 11:28:45 am Friday, June 14, 2013

MCDP – Fraud Section

72

12008561 CapOne Veirs Mill Rd ATM  Based on a review of the security footage, the writer can describe the suspect as White Male, Right Handed, with a Dark Colored mustache, 5'10, 200lb.  He was wearing hooded jacket. The Hood was Gray with pull strings. The jacket had checker board or plaid design of primarily dark blue or gray lines with lighter colored blue / gray lines. The jacket had two upper chest pockets with flaps held by center button or clasp and slotted pocket for each hand at waist level.

Pulled Device out of Right hand pocket.

Complete Overlay

Local Charges



CR 8-205(b)

   

FELONY DISTRICT COURT $1,000.00 - 15 YEARS *1_0196* **CREDIT CARD: COUNTERFEIT** ...did, with intent to defraud ____ (issuer of card), falsely [make/emboss] a purported credit card, to wit: ______ (describe card). NOTE: See definition of "falsely made," and "falsely emboss CR 8-208(b)(2)





FELONY DISTRICT COURT $1,000.00 - 15 YEARS *1_0200* **CRED. CARD EQUIP TO PRODUC** ...did knowingly possess machinery, plates, and other contrivance, to wit: ____ designed to produce credit cards of _____, without his consent.