Automated Postal Centers (APCs) are kiosks that are available when post office lines are too long, the service counter is closed, or you want to avoid bothersome human interaction. They’re set up very much like ATMs that print postage instead of dispensing cash. Like any other machine that accepts debit cards and is accessible to the public, APCs have been the target of card-skimming scammers.
Skimmers turn up in a variety of places: banks, gas pumps, subway stations, and now post offices. What these machines all have in common is that they’re places where customers use their credit and (better yet) debit cards, but the machines are unattended or isolated enough for crooks to install devices to capture card numbers and PINs, without attracting notice.
People in the banking industry alerted security blogger Brian Krebs that their customers’ card numbers appeared to have been stolen after using APCs. So far, possible postal breaches have been reported in thirteen states and the District of Columbia. The U.S. Postal Service has its own investigations bureau, the U.S. Postal Inspection Service, and they confirmed to Krebs on Security that the USPS is investigating these incidents, and they have warned post office staff to check kiosks for skimming equipment.
How can you protect yourself? It’s a good idea to check the equipment on payment kiosks and ATMs, especially if it’s your first visit to that store or bank. Here’s a quick 3-step guide to identifying external skimmers:
Also consider using a credit card instead of a debit card, if that option is available to you: credit cards offer better fraud protections in general, and also don’t let baddies walk away with your entire bank account balance, even temporarily.
Also consider covering your hand while entering your PIN on any machine: assume that there is always a camera lurking above you, maybe disguised as an electric plug like the PIN cameras recently found in a New York City subway station.
Postal Service: Beware Stamp Kiosk Skimmers [Krebs On Security]
