Swipe. Tap. Pray. Criminals might have their eyes on your bank card.
In 2011, roughly 11.6 million adults -- 1 out of every 20 -- in the U.S. were victims of identity theft, including more than a million Californians, according to the Pleasanton-based financial industry consulting firm Javelin Strategy and Research.
And in the last few years, skimmers -- criminals who use fake card swipe machines to steal card information -- have stolen millions from unsuspecting consumers at gas pumps and ATMs alike.
It's part of an identity theft industry that cost consumers, businesses and banks $18 billion in 2011.
According to Javelin, 66 percent of identity thefts involved existing credit or debit card accounts.
But boiling the numbers down to the specific number of skimming crimes has been difficult for law enforcement and researchers alike.
"We ask consumers if they've been the victim of fraud and sometimes they don't know how they've become victimized, they just know that they have," said Nancy Ozawa, marketing manager for Javelin.
Rosa Fuentes knows.
She sat at the dining table in her Rialto home on a recent Monday morning and looked over her bank card statements.
The soft-spoken Fuentes -- a 34-year-old homemaker was burning with anger after bank card skimmers twice captured her account information at the same gas station.
The rows of numbers on her bank statement reminded her of a ruined Christmas.
"We were going to go to Sacramento because we have family there," Fuentes said. "We had to cancel."
Her husband, Carlos -- a 48-year-old coordinator for volunteers at a Los Angeles preschool -- used their card at a gas pump at the Chevron gas station at Cedar and Merrill avenues in Rialto.
Thieves later used the card numbers to ring up $350 in fuel charges in Rancho Cucamonga and La Verne.
The Fuentes family is among a growing number of victims in Southern California and across the U.S. who have been hit by skimmer groups that target gas pumps and ATMs.
"I'd say where it really started heating up was probably two years or so ago," said Chris Butler, resident agent in charge with the U.S. Secret Service Riverside field office, where agents have started a task force to home-in on skimming in the Inland Empire.
Authorities say skimming crews use highly sophisticated scanners that are by and large undetectable by consumers.
They often are molded plastic or metal card reader simulators placed over the bank's equipment, and in many cases criminals use the same paint banks use, in order to blend their devices into the ATM.
According to authorities, criminals employ a pinhole camera on or near the ATM to capture a customer's personal identification number.
The equipment can be installed in the time it takes to withdraw cash or fill up a gas tank.
A card skimmer could be in line behind you.
SKIMMING FOR DOLLARS
Authorities say the card-skimming trend is hitting Southern California hard, from Torrance and Long Beach to desert communities.
The Secret Service's Inland Empire Financial Crime Task Force is tracking and identifying suspects involved in recent hits at multiple locations in Chino Hills and Temecula.
Authorities have warned that card skimmers have been placed on ATMs and gas pumps throughout Southern California.
San Bernardino County sheriff's investigators recently found card skimmers on several 76 station pumps in Rancho Cucamonga.
In September, authorities were on the trail of a suspected skimming crew that hit a US Bank in La Crescenta and may be involved with a group in Santa Clara.
Authorities in August charged four men in connection with an alleged scheme where credit card skimming was used to buy and sell fuel.
The men were from Oxnard, North Hollywood and Toluca Lake.
According to the FBI, 50 identity theft victims suffered a total loss of more than $50,000 in the scheme.
After an investigation by the Eurasian Organized Crime Task Force that netted an indictment of dozens involved with the "Armenian
Power" criminal group, authorities learned that one of the four men, Vardan Mkryan, managed several gas stations in the Los Angeles area.
Butler said international criminal groups based in eastern Europe and parts of the Middle East use skimming as one of many crimes targeting the U.S.
In Southern California, the groups are keying in on a specific bank, but Butler wouldn't specify which one, citing an ongoing investigation by authorities, who are using surveillance in an effort to track the thieves and nab as many as possible.
The state Attorney General's Office website lists the names of organizations where customer data has been breached. Yolo Federal Credit Union was hit more than a dozen times in 2012.
Authorities say skimmer groups span many regions of the U.S. and throughout the world, with a network of equipment manufactures, technicians and "runners" who do their dirty work at cash registers, ATMs and gas pumps.
Butler said cost estimates on card skimming belie the real impact.
"The figure is so much higher because the banks won't cooperate," he said. "A lot of times the banks won't tell law enforcement they got hit and we don't know about it. It's huge."
Reporting the crimes may be bad for a bank's business.
"They don't want their people to pull their money out of a particular bank and go somewhere else," Butler said.
'PROOF OF OUR WORK'
Skimming equipment can be installed with double-sided tape and later removed by crooks who then download the information and encode it on to blank bank cards, according to the FBI.
"If someone skims your card on Thursday and re-encodes it on Friday, you're not going to know about it until Monday," said Los Angeles County sheriff's Sgt. Josh Mankini, who investigates high-tech identity thefts. "There's nothing you can do as a consumer to stop that from happening. Even going into the store doesn't help (if) a merchant is involved in the crime."
Oil companies and banks are working to prevent skimming.
"Shell was the first major oil company to bring tamper-evident labels to the market at the pump," said Kayla Macke, a spokeswoman for the oil giant, in an email. "We introduced the Security Seal program to help combat skimming fraud and provided a sample packet to more than 14,000 Shell-branded stations."
Macke said Shell works with wholesalers to offer incentives for new locks on pump dispensers in targeted markets.
"The number of sites where skimmers were found at Shell-branded stations fell in 2011 after we implemented this counterfeit skimming initiative," she said.
Macke said Shell is working with Duncan Falls, Ohio-based Flint Loc on fraud prevention technology that includes a pump device that sounds a 105-decibel alarm when the dispenser door is opened, and automatically kills the power to the pump.
But criminals are also upgrading their technology.
In 2011, Gordon M. Snow, then the assistant director of the FBI's cyber division, told the House Subcommittee on Financial Institutions and Consumer Credit that Bluetooth-enabled wireless skimmers were found at gas pumps in the Denver area.
According to Snow, wireless technology allows thieves to instantly download information from the skimmers.
Snow said criminals can also make equipment to mimic the security features on ATM hardware.
In other words, as banks and oil companies are developing anti-skimming equipment, criminals are working just as hard to stay ahead. Some encode stolen numbers onto gift cards, which don't draw suspicion from merchants.
"The suspects are using technology against us," Mankini said. "The same technology used to fight it is being used against us."
And equipment makers are brazen when it comes to selling their black market technology. Many of them advertise on the Internet.
A man who identifies himself as "Stean Cortez" runs a website that says on its home page: "ATM skimmers for sale!"
Under a page titled "Proof of our work," Cortez lists the names, addresses and card information of more than a dozen victims in the U.S.
The website touts one skimming machine as capable of storing up to 2,000 card swipes.
The skimmer is password-protected and is advertised as good "for people who work with partners they may not trust."
It also comes with an instruction manual.
Asked by email how long it takes to install the skimming equipment, Cortez replied, "Hell (sic) it take about 1-2 minutes."
Asked which ATMs the skimmers work best on, he replied, "It works on any banks who use wincor nixdorf, NCR or Diebold atm's (sic)."
Suzanne Cluckey, editor of atmmarketplace.com, a website dedicated to ATM industry news, said the brands are ubiquitous.
"Those three are the big ones in the United States," she said. "The banks especially use NCR and Diebold."
CAREFUL WHERE YOU SWIPE
Maryanne Solomon of Santa Monica received a disturbing phone call around Thanksgiving.
"Chase Bank called me and said, 'Did you buy this?"' said Solomon, 63.
She said the bank representative read through several purchases. Thieves had used her card to shop online at Amazon and Wal-Mart.
The bank alerted Solomon after the criminals tried to change the address on her account.
Solomon closed the account, which had sentimental value.
"It made me sad because I had that same number since 1979 and I had the numbers memorized," she said.
Chase declined to talk about card skimming.
A spokeswoman with the bank said, "we really wouldn't comment on such a thing."
Authorities advise card users to use caution at ATMs and gas pumps.
They suggest folks watch for people hanging around ATMs, and wiggle the entry point of the ATM or gas pump card reader to see if it's been tampered with.
"Just be careful where you're swiping, if there looks to be any machinery or anything like that where you normally swipe your card," said Russ Heimerich, spokesman for the state Department of Consumer Affairs.
Customers should also check their bank and credit card statements for purchases they didn't make.
According to Javelin, the average victim spends $354 and 12 hours to fix skimming-related problems.
Rosa Fuentes knows.
With Christmas plans dashed for the Fuentes couple and their three children, the family decided to forge ahead in the new year, as mom and dad each struggle with medical issues, including Rosa Fuentes' recovery from a stroke.
They need their money. And their bank card. The couple notified their bank and ordered a replacement.
A new card arrived and on the morning of Jan. 2 Carlos Fuentes bought gas at the same Chevron station.
Hours later, thieves used the bank card numbers to spend $116 at a movie rental store in Rialto.
Mankini said skimmer groups spend the stolen money on a variety of things, ranging from drugs and alcohol to home purchases and investments outside the country.
The Fuentes family needs the bank card to cover health care costs.
"Now we can't use that card to pay for doctor expenses," Rosa Fuentes said. "We don't carry cash because it's not safe, and now you can't carry a card. What choice do you have?"
A disappointed Fuentes said she wanted to alert the public.
"We can get the money back, but if we don't bring it to light, they will continue to steal," she said.
(c)2013 the San Bernardino County Sun (San Bernardino, Calif.)
Visit the San Bernardino County Sun (San Bernardino, Calif.) at www.sbsun.com
Distributed by MCT Information Services