Debit Card Compromises Nearly Doubled in 2023 - FICO Data

In August of 2023, I posted about the growth we’ve seen in different fraud types, including card skimming. Now that we’ve reviewed data from the entire year, we are seeing the alarming trend continue.

For 2023, we saw a significant increase in compromised cards resulting from skimming activity. Total compromised debit cards were up 96% from 2022, with more than 315,000 impacted cards identified. More than 3,500 unique financial institutions (FIs) were impacted, and we saw a significant increase in bank ATM compromises – up 90% from 2022. 

This growth trend is a continuation from what we saw in 2022 and represents a significant threat for both banks and consumers. Unfortunately, the trend shows no sign of slowing down. With January already showing an increase year-over-year, I expect to see continued increases in skimming points of compromise (POCs) and compromised cards for 2024.

Changing Locations, Points of Compromise

One interesting data point that leaps out from this graphic is the dramatic increase in POCs at bank ATMs. While the majority of compromises still occur at non-bank ATMs – like free-standing terminals in convenience stores – criminals appear to be going right to the source more frequently when it comes to ATM locations. In 2022, bank ATM compromises were less than 20% of overall incidents compared to 35% in 2023, a 90% increase year-over-year. When you combine bank ATM compromise growth with a 39% increase in the average number of cards compromised per skimming event (nearly 200 per event in 2023), debit card users should carefully assess the situation when using any ATM, point of sale terminal, or other location where a card skimmer could be lurking.

Across the US, the geographic hot spots for skimming activities have shifted from 2022 to 2023. California retained the unenviable title of top state for skimming event locations, boasting over 20% of all incidents for 2023, more than double any other state. Texas and Colorado both moved into the top five states for skimming activity, while New Jersey and Pennsylvania rounded out the main offending states. These five states accounted for nearly 50% of all the skimming activity.

New to the top ten states this year were Ohio, Florida, and Illinois, complemented by New York and Virginia. These top ten accounted for 70% of all the Compromised Card Reports that FICO delivered to banks and financial institutions last year.

Consumers: Pay Attention to Detail

Given the ever-growing rate of skimming fraud, I would recommend specific actions for both consumers and FIs to mitigate impacts from a compromise. I’ve mentioned some of these in previous posts, but they bear repeating.

1. Pay close attention to PIN pads and payment terminals. Anything that catches your attention when you use a credit or debit card, like mushy keys on the keypad, a tap reader that isn’t working, or a broken seal on a gas pump card reader should be a red flag to head to another location.
2. Utilize tap-to-pay technology. With this payment method, commonly known as “contactless payment”, tokenization encrypts the card details. Rather than exposing all the card information that is contained in a magnetic strip, the tap-to-pay hides all the card details and replaces them with a token that is nearly impossible to decrypt, preventing criminals from capturing sensitive card information.
3. If tap-to-pay isn’t available, utilize chip and PIN. While these transactions are more secure than swiping, consumers are still advised to cover the PIN pad while entering their number to prevent a fraudulently installed spy camera from capturing their information.
4. Avoid swiping a magnetic stripe if at all possible. This is the least secure payment method, as it exposes all the card information. If a payment terminal has been compromised, it will often only allow swiping. If you experience problems using tap-to-pay or chip and PIN methods, find another place to complete your transaction.

Banks Can Take Proactive Steps to Protect Against Compromise

For banks and other FIs, knowing that bank-owned ATMs are increasing as points of compromise is critical. With this knowledge, institutions can step up protection and monitoring of their ATM locations, employing video surveillance where possible. Regular inspection of ATMs for signs of tampering, as well as coordination with law enforcement, can help ensure ATMs remain safe for consumers.

Equally important is knowing where the bulk of skimming and POC activity is happening. By employing fraud checks and using advanced analytics to identify and flag risky transactions, banks can help prevent potentially compromised cards from being used to commit fraud.

FICO® Card Alert Service provides reports to issuers with valuable data that enables them to act immediately to address known compromised cards. Banks can block/reissue a compromised card or monitor cards for signs of fraud, depending on their unique risk management strategies.

Being proactive with customer outreach is another way to help prevent fraud on a compromised card. Engaging customers in real-time, in the channel of choice (whether text, email, phone, or in-app messages) and providing the option to have two-way conversations can enable FIs to confirm whether a specific transaction is legitimate or fraudulent.

While skimming is one of the vectors that fraudsters use to separate victims from their hard-earned money, criminals will also continue phishing, smishing, and other tactics to obtain any data they can use to commit fraud across all channels. The right technology, including AI- and ML powered fraud detection models, can help banks fend off fraudsters while helping deliver the experiences that customers expect.

How FICO Fights Card Skimming Fraud

• Explore how FICO helps fight fraud, regardless of channel or portfolio.
• Review the first half 2023 card skimming results from Card Alert Service.
• Get more details on FICO® Card Alert Service and how it helps protect US consumers
• Learn how Customer Communications Services for Fraud engages customers in real time to fight scams and skimming.

Follow me on LinkedIn for more insights about FICO’s innovative fraud fighting efforts.