Transit Police are warning the public to check their banking records after discovering credit and debit card skimmers at stations on the Canada Line.
The force said the skimmers – small devices that thieves use to steal card information – were found on Compass Card vending machines at two stations. They were located on July 8 at the YVR-Airport Station and at Vancouver City Centre.
They were found by alert attendants who regularly check the machines for signs of tampering or damage. The machines were shut down and police were called immediately.
Investigators were able to determine that the device at YVR hadn't been installed at the machine before Sunday's service, but it is not known when the City Centre skimmer was placed.
"When you looked at the machines, you could see absolutely nothing," Transit Police spokesperson Anne Drennan said Thursday.
"This was a very accomplished skimmer… it's molded plastic. It looked almost completely identical to the actual surface of the machine itself."
The skimmers are being analyzed, and it is not yet known whether any card data was obtained. Drennan said investigators think thieves likely ended up with nothing, as skimmers often need to be retrieved, but there's a chance that any data collected was transmitted.
As a precaution, those who used machines to buy fares or top up their Compass cards between Sunday morning and 5 p.m. the same day are asked to check that their cards were not compromised.
However, as it is not known exactly when the City Centre skimmer was put in place, it's possible cards were compromised before Sunday. Drennan said officials believe they were likely installed the same day, but their analysis is ongoing.
Drennan said it's the first time a skimmer has been found on a Compass Card machine, but that they're looking at other stations to see if there's a possibility they were placed and later retrieved.
Investigators are reviewing all surveillance camera footage of the stations.
"It's always surprising what people will do when it's no secret we have CCTV all over the place," Drennan said.
"It's a bold move, but there's just no end to what people will try and get away with."
Skimming technology is getting smaller, and in some cases, criminals are making custom devices that can be installed in just seconds.
"3D printing is getting so much better that the quality of the devices, if they did an overlay, it's harder for the average person to detect and see," Hexigent Consulting security expert Steve Wilson said.
He said it's something that's been going on for years, and that major banks and credit unions have been targets.
"Transit is probably more of a low-lying fruit, an easier target to go after," he said.
Information obtained from the skimmers is often sold online, and people overseas will use data for other activities.
Security expert Scott Tingren, from UniTrust Protection Services Canada, said the best defence against devices like skimmers is vigilance by card holders and business owners.
"The user should look closely at the physical card reader and surrounding area," he said. Factory-built card readers are well built and fit properly, but overlaid skimmers are not, and may detach with light pressure.
Skimmers sometimes include a small, pinhole sized camera to record the user entering their PIN, he said.
Those with doubts should look at a nearby card reader, such as the one at the next gas pump or ATM, to see how they compare.
Drennan advised the public to contact a transit employee if they notice something is off, as anyone seen fiddling with a vending machine will be seen as suspicious.
With files from CTV Vancouver's Sheila Scott and Sarah MacDonald
