By Donna Harris, dharris@opisnet.com
This story begins like many others in the industry, with fraudsters planting skimming devices at convenience stores in an attempt to harvest payment card information.
But, in this case, a retailer’s vigilance gives the tale a much better ending.
The scam was cut short. The skimmers were discovered the same day they were installed.
David Velcu, 23, of Anaheim, Calif, faces federal charges for allegations he stole debit card data from ATMs at QuikTrip stores in Olathe, Kan., and Riverside, Mo.
And some of his suspected accomplices were caught as well, based on the legal record.
Federal court documents claim Velcu and his gang placed skimming devices and pinhole cameras on c-store ATMs to steal account information “with the intent to defraud” consumers. A federal affidavit said Velcu possessed about 78 re-encoded magnetic strip gift cards.
All of this – the discovery of the skimmers, the investigation, the round-up of suspects and the charges – happened in less than two weeks. According to court records, skimmers were discovered at the Olathe and the Riverside QuikTrip stores on April 7.
Velcu was arrested April 19, and on April 24, a federal judge in Kansas City, Mo., ordered that he be held without bail pending trial.
Timing is critical, based on Verizon’s latest statistics on data breaches. “The time from first action in an event chain to initial compromise of an asset is most often measured in seconds or minutes. The discovery time is likelier to be weeks or months,” Verizon said in its 2018 Data Breach Investigations Report. “The discovery time is also very dependent on the type of attack, with payment card compromises often discovered based on the fraudulent use of the stolen data (typically weeks or months).”
Based on the hundreds of daily visitors to the average convenience store, skimmers can do a lot of damage in a very short time. And skimmers planted on an ATM – complete with pinhole camera to snatch personal identification numbers – are even more alarming, as the devices can give crooks direct access to bank accounts.
Just what was QuikTrip’s secret for effective damage control? Really, there is no secret – only the execution of best practices.
Mike Thornbrugh, QuikTrip’s manager of public and governmental affairs, noted that store employees discovered the skimmers soon after they were installed. “Our training paid off,” Thornbrugh said, adding that staff members are educated on how to spot skimmers and what to do once they have found the devices.
As part of their daily routine, QuikTrip staff members also are required to inspect dispensers, internal point-of-sale terminals and ATMs, he said.
An affidavit filed in court said a manager at the Olathe QuikTrip store examined the store’s ATM after a customer complained his “card was not sliding easily.” The manager noticed a metal piece was not sitting evenly along the card slot of the ATM. He pushed the metal piece with a key and it popped out of the card slot. Then he noticed one side of the metal was a magnetic strip reader and a circuit board was glued to the reverse side of the metal. There was also a piece of molded plastic fascia with a pinhole camera applied directly above the keyboard. The camera was designed to capture PINs, the affidavit said.
The store manager confiscated the skimmer and pinhole camera and placed the ATM out of service, contacting QuikTrip’s regional headquarters, ATM owner UMB Bank, and local police. The store manager and an IT technician also reviewed the store surveillance camera footage in an effort to identify the potential fraudsters.
The affidavit noted that the bank’s data analytics system detected the likely presence of ATM skimming devices at not only the Olathe store, but a Kansas City, Kan., store and the QuikTrip store in Riverside.
In addition to trained managers, well-placed, high-quality surveillance cameras were critical to tracking down suspects in this case. Thornbrugh said the company’s “top-notch” security cameras provide clear images and are stationed at a variety of angles to view critical areas of the store and forecourt. “Our store surveillance equipment was a big help to law enforcement in their investigation,” he said.
Authorities said footage from the Olathe store’s surveillance cameras captured two juveniles installing the skimmer that day. Surveillance video also showed Velcu had entered the store later the same date wearing a jacket exactly like what one of the two unidentified suspects was wearing and went directly to the ATM, which had a sign saying it was out of service, according to authorities. The court affidavit said Velcu stared at the ATM for “an unusual amount of time,” then bought food items with cash and left the store in a silver Audi A6 with California license plates.
Investigators used the license plates on the Audi to identify Velcu – operating under the alias “Luca Antoni” – as the vehicle’s owner, they said. Through service records, they also determined that the Audi recently had an oil change in Independence, Mo. An employee of the lube business identified Velcu from a photo obtained from the QuikTrip surveillance camera, authorities said.
An Olathe police detective drove to several motels in the area on the hunch that he might be able to locate the suspect’s vehicle in a motel parking lot. And there it was, in the parking lot of an American Inn in Independence.
Velcu and some of his suspected accomplices, all operating under aliases and fake IDs, were detained, authorities said.
Searches of vehicles and hotel rooms uncovered items such as re-encoded magnetic strip cards with stickers depicting 4-digit codes, tubes of super glue, crowbars, surface skimmers, circuit boards and cutting tools. They were collected as evidence.
Each of the counterfeit debit cards had a circular sticker applied to the front, suggesting the corresponding PIN affiliated with the 16-digit account number that was re-encoded on the magnetic strip. Both elements are necessary to steal cash from ATMs, authorities noted.
The facts of this case suggest that it wasn’t just a lucky coincidence QuikTrip’s store manager discovered the skimming device on that ATM. At the very least, QuikTrip significantly improved its luck by routinely executing on policies and practices that protect its customers and reduce company liability.
Copyright, Oil Price Information Service
