When I got back from holidays in Mexico, my bank sent me an alarming email with the subject "Declined Purchases", which struck me as weird, because I didn't get declined the whole trip. The bank listed the locations — a perfume store and an Autozone in a town I didn't visit — and I yelled: "I've been skimmed!"
"You've been what?" my girlfriend gave me a glance. We were still on the plane, taxiing to our gate at JFK, and you could hear dozens of chirps as sunburnt holidaymakers turned on data service and received a week's worth of texts at once.
"Skimmed," I said, almost excitedly. "Somebody cloned my debit card and tried to buy a bunch of auto parts." I was almost excited because I'd been covering ATM skimming technology and the scourge of the Earth that use it to steal people's money for years.
Now I was one of those people.
I was also pretty nervous since I hadn't quite figured out how much of my holiday fund had gone missing. Thanks to some careful planning before the trip, a bank with great customer service and a little bit of luck, I would later learn that I didn't lose a cent.
Let me tell you a little bit more about what happened so that if you ever get skimmed, your cash stays securely in your account.
The Night of Many Modelos
It all started at the breezy hotel bar. Hotel bar isn't quite the right word for where we stayed in Tulum, a small city about two hours south of Cancun. The owners had been affiliated with the legendary underground club Bar 25 in Berlin, and they called the hotel bar a "beach club." I was drinking the unexpected sound of minimal techno on my second-to-last night in Mexico. The bar had been out of my Modelo Especial all week, and the shipment just arrived. I ordered two, squeezed the limes, and wished we'd taken the time to drive down to Oaxaca, where it might actually feel like we were in Mexico. Everyone at this place club looked like they were from Brooklyn.
That's Tulum, nowadays. Although the city is famous for its Mayan ruins, it feels like someone picked up Williamsburg and dropped it in the jungle. There's a Starbucks next to the entrance to the ruins, and the beach is flanked by so-called eco-resorts, almost all of which offer yoga, spa services, and beachfront cabañas. English is the language of choice, and businesses prefer to be paid in dollars — especially since they can tack a 30-per cent premium on the exchange rate.
We took a cab to the restaurant, a place called Hartwood that we'd read about in every publication that had ever written anything about Tulum. We showed up at 6pm on the dot, and the hostess said they were booked for the rest of the night. So we decided on happy hour. Two Modelos later, and I was ready to eat anything. We ended up at a charming Italian restaurant on the beach with a jewellery store next to the bathrooms. Tulum is an unusual place.
The Skimming Incident
Of course, the hippie-friendly Italian place only accepted cash. We realised this, while waiting for a table, and remembered seeing a bank of ATMs down the street. I decided to make a run for it so we wouldn't have to fuss it after a relaxing meal. I should have asked the bartender if there was an ATM in the restaurant, but I was feeling confident.
This was my first mistake.
So I'd had a couple beers at this point. I knew better than to use a roadside ATM in Mexico. Roadside ATMs in any country are probably a bad idea! This is prime real estate for skimmers.
There probably aren't any security cameras that would spot them installing the skimming device on the ATM, and once it's installed, you're likely to catch lots of people who aren't paying much attention. This is especially true for roadside ATMs in touristy places, and they don't get much more touristy than the Tulum riviera.
After a brisk walk, I arrived at the bank of ATMs and reached for my debit card. This was my second mistake.
The ATMs were shady as hell. That's not a photo of the actual ATM above — although that is a photo of the actual sunset — but they were all just as dirty and just as broken-looking. Since there were no streetlights, the ATMs were illuminated only by the glow of the screen and the headlights of on-coming cars. One displayed an out-of-order notice on the screen. The other was kind of careening off the shoulder of the road but seemed to be in working order. I dipped my debit card, and the machine gave me a read error. Dip again.
This time I noticed that the card slot seemed a little janky, slightly crooked. I honestly didn't think twice about it, as I was more focused on getting back to dinner. I input my PIN and tried to make a withdrawal. This was my third mistake.
The ATM wouldn't dispense my cash, and it wouldn't tell me why. I knew that I had the funds in my account, and I knew that I'd contacted my bank about travelling abroad. Plus, I'd been using the ATM in the grocery store all week! Like an idiot, I tried the janky ATM again. Still no luck.
Now drenched in failure, I returned to the restaurant where I immediately saw an American-looking lady making a withdrawal from an ATM hidden inside of a decorative cabinet right next to where I'd been sitting. I should have asked for help.
We sat down for dinner about five minutes later. I ordered pasta full of shellfish — which it turns out was not the riskiest move of the night. My girlfriend withdrew some pesos from the ATM in the restaurant and paid the bill. I didn't think twice about that weird crooked card slot until we touched down in New York City, and the alerts from the bank came through. In retrospect, it was wildly obvious what was happening at the time.
The Evolution of ATM Skimmers
ATM skimming has become increasingly alarming in the arena of banking security and identity theft. When the phenomenon first surfaced around 2002, many thought the idea that a gadget stuck on an ATM could skim the information of any inserted card was a total fairy tale.
Within a year, these fairy tale devices were costing some businesses hundreds of thousands of dollars in a single day.
Early techniques involved an entire phoney ATM machine, but criminals soon figured out how to miniaturise the technology so that it could be attached to the front without detection. The next decade saw an evolution not only in skimmer designs but also capabilities. By 2009, skimmer technology included small devices that not only fit over the card reader but also incorporated fake keypads and even cameras to register PIN numbers. That way, if your card got skimmed, the crooks could clone it, walk to a regular ATM, and attempt to empty your bank account.
It's possible that I was using a phoney machine, since I was inexplicably unable to withdraw any cash. But based on my recollection, I think the skimming device was akin to one of these:
There was something not quite right about the ATM, but it wasn't glaringly obvious. That said, it was also probably primitive compared to the latest skimming technology. Some of these razor-thin gadgets are virtually undetectable, while others are actually installed inside the ATM.
This is all to say that even if you're aware of the danger, you might not know you've been skimmed until it's too late. I certainly didn't.
Here's What I Think Happened
I don't go on holidays often. In fact, this trip to Tulum was the first holiday I'd taken since 2013, when I went to Tulum for the first time. (What can I say, it's a beautiful place!) I made mistakes on that trip too. Chief among them was losing my debit card on the first day of a 10-day trip. This was a dumb thing to do, but since I'd prepared for the worst, it didn't impact my trip very much.
Anticipating making another dumb tourist mistake, I did even more preparation for this year's holiday. Last year, I ditched my big, terrible bank in favour of Simple, an online-only bank that's mobile-centric and great service. But I wanted to have access to two chequing accounts on this trip, so I reopened my account with Chase (ugh). That's the account where I put the majority of my holiday savings. This was enough to cover the rental car, the hotel and any unforeseen events. Then, I locked the Chase card — as well as a credit card and a small supply of emergency cash — in a safe at the hotel.
I left a very limited amount of money in my Simple account, specifically so that someone could not have much fun if I lost it. This is the account I used for ATM withdrawals and a limited number of debit card purchases. It's also the bank with better customer support, so if something did happen, I knew that I could send a free message from my phone and get a prompt reply.
The messaging proved invaluable since I never had to make an expensive international phone call to talk to my bank. At one point, I had to call to Chase from Mexico and it cost $US10.
So here's what I think happened. I think my Simple debit card got skimmed on the side of the road. Realising the next morning that the whole exchange was quite bizarre, I stopped using the Simple card.
Around that time, the skimmers used the data their device had pulled from my debit card's magnetic strip to create a clone of the card. They took that clone to Autozone and some fancy perfume shop and tried to make a purchase worth several hundred dollars. The funds weren't in the account, so the card got declined in an unusual locations twice. This set off the right red flags at Simple, and they contacted me within 24 hours.
Because I knew exactly what my last purchase before the ATM had been, I was able to confirm that I hadn't attempted those purchases. Because the cloned card never worked, I didn't lose any money or have to dispute any charges.
Some of this was luck. I could have gotten skimmed at the beginning of my holiday and lost everything in that account overnight. That's why it's good to have a backup. I could've gotten mugged and taken to an ATM, where I'd have to empty my bank account. That would be scary. But that's also why you don't walk around with access to heaps of money in an unfamiliar country.
I'm not purporting to be some sort of travel expert. I spent the better part of my 20s living in various cities around the world and got robbed in virtually every single one of them. I once edited a travel guide to Germany and handled some of my writers' crises on late night phone calls with the embassy. I once took a Jeep tour around the Atacama desert and helped the driver fix a flat tyre.
And now, I've been skimmed in Mexico.
None of these brushes with crime abroad were particularly fun, but they were all informative. If you find yourself on a gorgeous, gentrified beach, don't assume you're not going to get ripped off. Don't drink a lot of beer and run out looking for cash on a dark, dangerous road. If an ATM on that road seems sketchy, don't insert your card.
But do visit Tulum. It's bougie — very much so. But it's also stupid beautiful.
Picture: Flickr, Adam Clark Estes