Card raiders

When Paige Hamp opened a bank statement in April for the nonprofit ministry that she directs from her home in Wake Forest, N.C., she was stunned: All the ministry's money was gone.

Embrace Uganda-a grassroots mission group that helps needy communities in Uganda-already operated on a shoestring budget. Volunteers-including Hamp-oversee administrative details from the United States and give an American couple based in Uganda a small stipend to direct projects like digging wells and building medical clinics with partner churches and ministries in the African nation.

The organization had about $30,000 when thieves in Africa accessed the U.S.-based account with a well-worn method: ATM skimming. By the time criminals finish such a scheme, they're able to make a replica of a victim's ATM card. "I just felt sick," says Hamp. "I know the children that were going to benefit from this money. . . . I had made commitments to them."

Experts say that anyone with an ATM card is vulnerable to skimming and should learn how to guard against it. Volunteers for Embrace Uganda say other nonprofit groups should learn that recovering lost cash from such theft could prove impossible.

Thieves likely accessed the group's North Carolina--based account after American workers used an ATM machine in Uganda. Once the criminals secured the card information from the machine, they emptied the account using other ATM machines in Kenya.

But skimming isn't limited to underdeveloped countries: Experts at Bankrate.com say ATM skimming is a $1 billion racket every year worldwide, including in the United States. Earlier this year, thieves used ATM skimmers to steal $200,000 from account holders at four Bank of America branches in Long Island. (The bank refunded the money to victims, according to local news reports.)

Skimming technologies for ATM machines range from the simple to the sophisticated but follow a similar pattern: Thieves attach a digital skimming device to the card slot on an ATM machine. When an account holder swipes his ATM card, the skimming device records all the account information from the card's magnetic strip.

The skimmer sometimes sends the stolen info to another device-like a modified cell phone hidden on the machine. In other cases, thieves can access the information using a wireless signal, without ever returning to the machine. They attach a hidden camera on the machine (concealed perhaps in a light fixture) to record the account holder entering his PIN number.

After the thief has the account information and PIN number, he transfers the information onto a magnetic strip of a plastic card-like a gift card or hotel room key. The criminal now has a replica of the victim's ATM card and the PIN number to use it.

For all the high-tech sophistication associated with skimming, Robert Siciliano, an identity theft expert at ADT.com, says one of the best safeguards is a low-tech move: Cover the keypad with your other hand while entering your PIN number. Other tips: Avoid withdrawing money from common targets like stand-alone machines or ATMs in tourist spots, and look for anything suspicious on a machine like a false panel or out-of-place hardware that could be hiding devices.

Siciliano's No. 1 tip: Check your online bank statement frequently. Finding fraudulent activity quickly may be the best guard against more theft. "As inconvenient as that may be . . . if they're checking email and Facebook everyday, they should probably check their bank account too."

Hamp of Embrace Uganda says she didn't monitor the ministry's account online. By the time she reviewed the monthly paper statement, thieves had stolen nearly $29,000 through 119 transactions in Kenya over a 30-day period. Ministry workers typically withdrew money two to three times a month, and never from Kenya.

Hamp says she was shocked that RBC Bank didn't notice the suspicious activity. (She says a bank employee notified a volunteer making a deposit toward the end of the 30 days.) But Hamp was even more shocked when the bank initially refused to refund the money.

RBC Bank spokeswoman Dorsey Landis said that business accounts-including nonprofits-don't qualify for the same protections as personal accounts, and that the bank recommends that account holders monitor their statements frequently. The bank policy also says that all the protections for credit cards don't apply to ATM cards.

Embrace Uganda board member Steve West said the group eventually reached an undisclosed settlement with the bank. But Hamp says other small ministries and nonprofits should make sure they have adequate insurance against theft and ask banks about protection of their accounts.

Siciliano says consumers should remember that thieves are finding ways to outpace banks' security efforts, and make sure they watch their accounts. "They're getting more sophisticated everyday," he says of the high-tech thieves. "They're just getting brilliant."