Card CloningAn Insidious Threat Hurting Merchants & Cardholders

A Primer on Credit Card Cloning: How it Works & How You Can Prevent It

Say you walk into a convenience store. You pick out a snack, and pull out your credit card to pay.

The cashier rings up your total, and you insert your card into the payment terminal at the point-of-sale (POS) device. A few moments later, the transaction is approved. You walk out with your snack in hand, giving little thought to the transaction you just made.

Several days later, however, a handful of unauthorized transactions begin to show up on the same card you used at the gas station. 

To your knowledge, you didn’t give out your payment information to anyone. So, what could’ve happened? It’s possible that somebody might’ve compromised that POS device with the intent to steal your card information and engage in card cloning.

What is Card Cloning?

Card Cloning

[noun]/kard • klōn • iNG/

Card cloning or is a form of card-present fraud in which scammers harvest payment card information, then use that information to create a copy of a valid credit or debit card.

Think about the example above. When you inserted your card into the payment terminal at the convenience store, it was read by the merchant’s legitimate payment terminal. But, there might well have been a fraudster’s skimming device jammed into the terminal as well, collecting your data. Once a scammer has your card data, they can use it to create a clone of your credit card.

According to the FBI, card cloning is a very common practice. Skimmers installed at fuel pumps, POS terminals, ATMs, and physical card readers cost merchants and consumers an estimated $1 billion per year.

It’s also a growing threat: data from credit analytics firm FICO shows that roughly 120,000 debit cards were involved in card cloning attacks in the first half of 2023, up 77% from the approximately 70,000 cards impacted in the first half of 2022.

How Card Cloning Works

Card cloning can be thought of as a two-step process.

In the first step, a fraudster harvests card numbers and PINs from victims using physical card skimmers, which are concealed inside a card reader without the knowledge of either the merchant or the cardholder. Whenever a victim swipes or inserts their card at the compromised card reader, the skimmer reads the payment information and transmits it to the fraudster.

Learn more about shimming

Now, the second step can occur. The fraudster takes the details stolen by the skimmer and copies (or “clones”) them onto a blank payment card. The fraudster, now in physical possession of a card that is linked to the victim’s account without either their awareness or consent, can use the victim’s stolen payment details to make purchases or withdraw cash.

How Do Scammers Get Data for Card Cloning?

Fraudsters use a variety of illegal hardware devices and psychological tactics to steal card information from victims:

• Card Skimmers: hardware attached to card readers to capture PINs and magnetic stripe data.
• Card Shimmers: devices used to capture data stored in the microchips of EMV-compliant payment cards.
• RFID Cloning: devices used to remotely siphon data from NFC-enabled payment cards from a distance.
• Dark web data vendors: illegal brokers who acquire and then resell sell stolen data, typically leaked during data breaches.
• Social engineering: manipulative psychological techniques that cause victims to divulge sensitive or personally identifying information.
• Phishing: malicious emails or text messages that appear to be from legitimate and reputable sources.

These are some of the most common tactics. But, there are literally dozens of different schemes that bad actors can run to get access to cardholder data. Then, once they have the necessary information in hand, they can clone the victim’s card and start making fraudulent purchases in minutes.

Signs of Card Cloning

How do you know if you’ve been targeted by a card cloning scam?

There’s no surefire way to determine whether your information’s been compromised by card cloning. But, there are some red flags you can look out for, both before and after the incident:

Impact of Card Cloning on eCommerce Merchants & Financial Institutions

Cardholders aren’t the only ones who suffer from card cloning attacks.

Merchants and financial institutions are the ones who ultimately bear the cost of fraudulent transactions. Every dollar lost to fraud ultimately costs US sellers and banks $4.61. That’s because card cloning attacks and other forms of fraud come back to bite businesses in the form of:

Regulations & Industry Standards to Fight Card Cloning

Merchants will need to follow a multi-layered strategy that encompasses both current and upcoming fraud prevention initiatives.

To start, sellers should ensure that they are in full compliance with PCI-DSS requirements. This includes PCI-DSS Requirement 9.9, which mandates that merchants “protect devices that capture payment card data via direct physical interaction with the card [like POS terminals and card readers] from tampering and substitution.”

In practice, this means maintaining an inventory of devices, periodically inspecting devices for tampering, and training staff to be aware of — and to report — suspicious behavior.

Using EMV-compliant card readers can also help merchants avoid some liability for fraud and contain the damage done when card cloning scams do arise.

EMV-complaint chip cards generate one-time cryptograms that are sent to the issuer for authentication. Even if a sophisticated "shimmer" device intercepts data during an EMV transaction, the captured cryptogram cannot be reused for future fraudulent transactions. It won’t totally prevent fraud, but it may limit the damage that can be dealt in a single card cloning attack.

Merchants should also leverage fraud prevention initiatives developed by Visa and Mastercard to their own benefit.

Using network tokenization services like Visa Token Service, for instance, can help sellers maximize data security and protect sensitive cardholder information from data breaches. In addition, capabilities like Mastercard’s Cyber Intelligence service can help businesses quickly understand and respond to emerging threats.

How to Detect & Prevent Cloned Card Fraud

Merchants have a number of tools they can use to detect and prevent card cloning attacks. This type of fraud can be dealt with in two ways:

One of the simplest ways to stop card cloning fraud is to regularly monitor card readers for illegally-installed hardware devices that allow fraudsters to steal cardholder information in the first place.

In practice, this means regularly monitoring all ATM and POS devices for signs of tampering or unauthorized use. Examine card readers for loose parts, unusual bulkiness, broken seals, or loose cables, and ask employees to regularly conduct manual audits for illegal hardware. The earlier a card skimmer or shimmer is removed, the less harm it can do.

Despite merchants’ best efforts, some card information will inevitably be stolen. For this reason, sellers will also need to prevent card cloning fraudsters from transacting with stolen information. 

Deploying complementary fraud detection tools at checkout can help sellers block purchases that are attempted with stolen and cloned cards. Initiatives include:

• Implementing 3-D Secure Technology
• Monitoring IP Addresses for Inconsistencies
• Using Device Fingerprinting Tools
• Leveraging AI-driven Behavioral Analytics Systems
• Flagging Suspicious Transaction Patterns
• Implementing Fraud Scoring Tools
• Using Geolocation Services

Get Help With Chargeback Prevention

Card cloning fraud is frustrating because it can lead to legitimate chargebacks that often can’t be challenged in representment.

The good news, though, is that criminal fraud chargebacks are almost entirely preventable. Comprehensive fraud detection solutions from Chargebacks911® can help preserve your revenue and inventory from scammers by stopping card cloning fraud from morphing into chargebacks.

Curious to learn more? Reach out to us for a no-obligation ROI analysis today.