Costco Credit Card Skimmer Found

This is the place for general and miscellaneous posts on topics which might extend past the boundaries of any specific region. No non-grocery posts.
Alpha8472
Posts: 3931
Joined: February 24th, 2009, 8:55 pm
Been thanked: 79 times
Status: Offline

Costco Credit Card Skimmer Found

Post by Alpha8472 »

Costco has reported that a skimmer was recently found at a Costco store. Customers had been complaining about unauthorized transactions on their cards since February 2021. Costco finally found a skimmer on a recent survey of pin pads in a store. They only check on pin pads after a period of several months?
storewanderer
Posts: 14393
Joined: February 23rd, 2009, 3:54 pm
Has thanked: 2 times
Been thanked: 298 times
Contact:
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by storewanderer »

I wonder how that happened with the Chip cards. Also Costco usually uses security tape.

Another reason to use the tap function whenever possible.

I've had a couple cards skimmed in recent months. Suspect some of those swipe only gas pumps... really need to stop using those and go pay inside when those are still in use.
Alpha8472
Posts: 3931
Joined: February 24th, 2009, 8:55 pm
Been thanked: 79 times
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by Alpha8472 »

I work in retail, and many people mindlessly swipe their cards even if it is a chip card. The fact that the skimmer was not detected for months is really surprising. I do not even trust those insert your chip card readers at gas pumps. It has to be tap to pay to be secure. I often use the Shell app or 76 app to pay at gas stations. That way you do not even have to get out your card.

I also use the Skim Plus app. The app scans for any skimmers at gas pumps using Bluetooth. It even works at cash registers to detect skimmers.

Costco does not have enough employees to monitor cameras at every checkout to look for people installing skimmers.
Super S
Posts: 2691
Joined: April 1st, 2009, 9:27 pm
Has thanked: 11 times
Been thanked: 61 times
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by Super S »

Alpha8472 wrote: November 14th, 2021, 11:50 pm I work in retail, and many people mindlessly swipe their cards even if it is a chip card. The fact that the skimmer was not detected for months is really surprising. I do not even trust those insert your chip card readers at gas pumps. It has to be tap to pay to be secure. I often use the Shell app or 76 app to pay at gas stations. That way you do not even have to get out your card.

I also use the Skim Plus app. The app scans for any skimmers at gas pumps using Bluetooth. It even works at cash registers to detect skimmers.

Costco does not have enough employees to monitor cameras at every checkout to look for people installing skimmers.
The fact that this happened at Costco is a bit disturbing. By default, a lot of people use debit cards, as Costco typically only accepts one credit card, which changes at times. Most people don't change credit cards on a whim if they are trying to maintain good credit scores. I wonder if this was at a regular checkstand or at a self checkout. Fraudulent debit purchases do not have the same protections as credit purchases. For this reason, when traveling, I usually will use credit instead of debit (or cash) just in case I somehow end up in a place where there is a skimmer. Then you have WinCo which accepts debit cards but no credit cards.

I personally will not do any transaction involving money through my phone. I make it a point to use credit at gas pumps, I have had a Chevron card for many years and have not had any issues. Chevron also gives you their cash price when using their card. I also pay the bill in full every month.

I am not going to fumble around with two or three apps in order to pay when I want to get in and get out. If a store is accepting cards they need to stay on top of this.
Alpha8472
Posts: 3931
Joined: February 24th, 2009, 8:55 pm
Been thanked: 79 times
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by Alpha8472 »

Stores should check each credit card reader once a day for skimmers. The Costco gas station employees check for gas station skimmers at the end of the day.
storewanderer
Posts: 14393
Joined: February 23rd, 2009, 3:54 pm
Has thanked: 2 times
Been thanked: 298 times
Contact:
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by storewanderer »

Those Verifone terminals Costco uses also should somehow be not so easy for skimming. I am really surprised after all these years that these terminal companies keep making units that can be compromised like this. Another thing would be to get a terminal that could just be flat out detached and moved to a secure location when the register was unattended.

I have noticed some stores lately pull those Verifone terminals out and going with other terminal types.
Alpha8472
Posts: 3931
Joined: February 24th, 2009, 8:55 pm
Been thanked: 79 times
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by Alpha8472 »

The problem is that detaching the credit card reader takes a time and then the cash register has to be rebooted. In some cases you might have to call tech support to reinstall it. It is time consuming to detach it.

The best thing is for the stores to inspect each credit card reader for skimmers at least twice a day. There is also a skimmer detector app that uses Bluetooth that is very accurate.
ClownLoach
Valued Contributor
Valued Contributor
Posts: 2700
Joined: April 4th, 2016, 10:55 pm
Has thanked: 40 times
Been thanked: 290 times
Status: Online

Re: Costco Credit Card Skimmer Found

Post by ClownLoach »

As the responsible party for inspection across a market for a major retailer, I would tell you that this is likely a very isolated incident that resulted from improper installation - or modification by a employee who thought they were smarter than the vendor direction.

I am trained on the same Verifone pin pads Costco uses. There have unfortunately been skimmers for almost a decade for this type. However the skimmer is like a giant face plate that goes right over the top of the PIN pad. They don't use Bluetooth on these because it is well known - plus Bluetooth requires that the crooks stay nearby to collect the data. These new skimmers just store the info on a SD card that the crook comes back to collect later. So Verifone and other manufacturers sell mounting brackets that go over the top of the pad, usually at the top or bottom, to prevent attachment of these skimmers. Some retailers with customized checkstands that can't fit these will use hologram stickers or other types of stickers so that the cashier immediately recognizes that their PIN pad is tampered because the sticker is gone.

The good news about these Verifone PIN Pads is they have internal sensors and software designed to detect tampering. For several years now if we detached one without having the IT folks on the line remoted into that register - the PIN pad is immediately bricked. The PIN Pads themselves are only repaired by Verifone although others can install them with Verifone on the line. So again if you are seeing them removed and put back the next day it is likely that someone has modified it which means it could be suspect. They should be hooked up to 24 hour power and never disconnected.

If you see a Verifone PIN pad that is not physically bolted down in a bracket - but is instead handed to you in some way or loose on the counter - DON'T SWIPE A CARD ON IT!
bryceleinan
Shift Manager
Shift Manager
Posts: 350
Joined: June 1st, 2018, 11:59 am
Has thanked: 2 times
Been thanked: 34 times
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by bryceleinan »

ClownLoach wrote: November 16th, 2021, 11:21 am As the responsible party for inspection across a market for a major retailer, I would tell you that this is likely a very isolated incident that resulted from improper installation - or modification by a employee who thought they were smarter than the vendor direction.

I am trained on the same Verifone pin pads Costco uses. There have unfortunately been skimmers for almost a decade for this type. However the skimmer is like a giant face plate that goes right over the top of the PIN pad. They don't use Bluetooth on these because it is well known - plus Bluetooth requires that the crooks stay nearby to collect the data. These new skimmers just store the info on a SD card that the crook comes back to collect later. So Verifone and other manufacturers sell mounting brackets that go over the top of the pad, usually at the top or bottom, to prevent attachment of these skimmers. Some retailers with customized checkstands that can't fit these will use hologram stickers or other types of stickers so that the cashier immediately recognizes that their PIN pad is tampered because the sticker is gone.

The good news about these Verifone PIN Pads is they have internal sensors and software designed to detect tampering. For several years now if we detached one without having the IT folks on the line remoted into that register - the PIN pad is immediately bricked. The PIN Pads themselves are only repaired by Verifone although others can install them with Verifone on the line. So again if you are seeing them removed and put back the next day it is likely that someone has modified it which means it could be suspect. They should be hooked up to 24 hour power and never disconnected.

If you see a Verifone PIN pad that is not physically bolted down in a bracket - but is instead handed to you in some way or loose on the counter - DON'T SWIPE A CARD ON IT!
What's funny is that some military exchanges have their PIN pads loose on the counter as you described... I thought it was a bit weird seeing that. Good news is that you can tap and go there now.
storewanderer
Posts: 14393
Joined: February 23rd, 2009, 3:54 pm
Has thanked: 2 times
Been thanked: 298 times
Contact:
Status: Offline

Re: Costco Credit Card Skimmer Found

Post by storewanderer »

bryceleinan wrote: November 17th, 2021, 5:34 pm

What's funny is that some military exchanges have their PIN pads loose on the counter as you described... I thought it was a bit weird seeing that. Good news is that you can tap and go there now.
I see loose pinpads more often than I should see them and at more retailers than we should be seeing them at. This includes some very large, major retailers. The grocery chains are actually really good about this and I can't think of the last time I saw a loose pinpad at a grocer. Department stores are another matter entirely. I thought securing the pinpads to the counter in a stand, etc. was part of the PCI compliance which was many, many years ago.
Post Reply