What? It's even easier in the US. Credit card data is just text. Hook up a magstripe reader to a PIC and go to town (literally hah). People have been doing it for years especially at gas stations and seedy bars where it's too dark to notice/patrons are too drunk to care.

http://www.identitytheft.com/article/identity_theft_gas_stat...

Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.

Talking about old mag stripe card, the system used to authenticate the transaction is this:

1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.

2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.

3. Account number and offset are stored in the card.

4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number. Then it verifies the PIN number: if user PIN = natural PIN + offset then SUCCESS

Copying credit cards in the US is trivial since you don't have chips in the cards.

I believe that the current attack in the US combines the aforementioned technology with a small camera mounted on the top of the ATM to capture a user's pin number.

It's even simplier, the crook usually stands in line behind the victin watching when the PIN is inserted. It's called should-surfing.

More sophisticated techniques are a hidden spy camera mounted on the top of the ATM (as you say) or even a fake PIN pad wich logs every button pressed. However the majority of attacks are usually performed trough social engineering.

Anyway to stole credit card information for forgery you need to retrieve the data stored in the card and the PIN. Skimming/Shimming is about the first part only, and the data obtained is useless without a valid PIN.

For this reason next generation ATM will avoid PIN insertion by using biometric technologies. Actually Japan an Poland are the first country in the world with biometric ATMs, for what I know.