Fake top-cover skimmer on a shopping mall POS terminal · 47,000 cards read over 8 weeks · 4 perpetrators indicted
The mall management noticed 8 weeks later that a POS terminal's top cover had been replaced with a fake device (observed by cleaning staff). It contained a Bluetooth chip + a magstripe reader. 47,000 cards were read and 1,200 frauds confirmed. With a DSET forensic investigation + mall CCTV facial recognition + a joint indictment by 3 malls, the gang was arrested.
01 The Challenge
A bank alert: "4% of customers paying at your POS have fraud." Physical check: the POS top cover was a 3D-printed cover + a Bluetooth chip + a magstripe reader. Mall CCTV from 8 weeks earlier: during cleaning hours a person dressed as a "maintenance worker" replaced the cover. From 1,200 victims an average of 1,800 TL fraud, a total of 2.16M TL.
02 DSET's Approach
T+0 · Remove the skimmer
The skimmer was physically removed + handed over to the DSET digital forensics lab. The bank was informed (card cancellation process started).
T+72h · DSET forensic investigation
Skimmer firmware analysis: an ESP32 + a custom magstripe reader + 14 Bluetooth packets/second. The Bluetooth listening device was found at a cafe 50m away in front of the mall.
T+1 week · CCTV facial recognition
The "maintenance worker" from 8 weeks earlier in the mall CCTV was identified as the same person at 3 different malls. A professional criminal accomplice was suspected.