Phishers cash in on ATM cards

The report, released on Tuesday, includes a recent survey of 5,000 US bank customers. From the survey, Gartner estimates that 3 million Americans have lost an average of more than US$900 each due to online scams over the past year.

Scam artists are gleaning bank account numbers and personal identification numbers (PINs) through the use of phishing attacks and keystroke logging technology, according to the report. They are then creating fake ATM and debit cards and using the cards to steal money and make purchases.

Criminals "succeed when the card-issuing bank is not validating security codes on the magnetic strip of the card while authorising transactions," Avivah Litan, Gartner research director, said in a statement.

Banks, as a result, have it within their control to minimize their losses, Litan noted.

On the magnetic strip of every ATM card, security codes are stored on Track 2. These codes tie the physical card with the customer's account number and add an additional layer of security beyond validating a customer's PIN.

But up to half of US banks fail to validate Track 2 data and only rely on customer PINs to authorise ATM transactions, according to Litan, who based that estimate on conversations with banks and transaction processors.

"Criminals are seeking out customers of banks that are not validating ATM cards' Track 2 magnetic stripe security data," Litan said. "Hackers call these banks 'cashable.'"

Banks could curtail this type of attack by modifying their ATM host systems, which would require the systems to review Track 2 security data, Litan noted.

Because customers are not aware of the Track 2 data housed on their ATM's magnetic strip, phishers cannot dupe them into providing this sensitive information, the report said. And unless a hacker were familiar with a bank's algorithms and security codes, Track 2 data generally could not be duplicated, according to the Gartner report.

Phishing is on a steep rise, according to a report released on Tuesday by security software company Postini. The company found nearly 19.3 million phishing attempts in the month of July as it processed customers email--marking a 16 percent increase over June.

The July phishing attempts marked the highest levels the company has seen to date.