Redbox handles credit card skimming scam well

I’ve been a big advocate lately for companies that are open and honest about consumer issues or ones that take a pro-active approach to potential problems. It’s time to add another company, Redbox, to my A-list.

I’ve previously written about my experience with renting DVDs from Redbox and I am still a big fan of the company. That’s why I really appreciate their honest approach to a credit card scam they recently became aware of. The scam involves someone adding an illegal credit card skimming device just above the existing device that scans your credit cards at Redbox kiosks. Consumers unaware of the extra device have no idea their credit card numbers are being captured by the extra device.

Even though this was just an isolated event for Redbox (of the 7.400 Redbox locations, a device was found and removed at only 1 location and attempts of credit card skimming were noticed at only 2 other locations), Redbox gave full disclosure of the issue in an email to its customers.

Not only did they fully disclose the issue, they included a toll free number to call as well as an email address to report any other security concerns. Better yet, they included links to the web that showed exactly what the skimming devices look like on a Redbox kiosk so consumers could be on the lookout for them in the future.

But the icing on the cake was a question/answer section at the end of the email that answered questions such as “What is credit card skimming?”, “How do I know if a skimmer is on my redbox?” and “Who should I call if I have questions?”

Bravo, Redbox for being upfront on this issue with your customers.

If you are interested, the full text of the email from Redbox is listed below.

Redbox Alert

To Our Valued Customers:

A few days ago redbox detected and removed an illegal credit card skimming device at one of our 7,400 locations. At the same time, redbox also discovered evidence of skimming attempts in two other locations. Skimming involves the placement of an illegal device above the credit/debit card reader on a vending machine, ATM, or in this case a redbox. These devices are used to illegally read or store personal credit card information.

Even if your redbox was not targeted, it never hurts to pay a little extra attention and check for any unusual activities or changes at your local redbox. If you suspect your redbox has been tampered with (click this link to see pictures of skimmer devices: https://www.redbox.com/creditcardsecurity/ ) please call 866-REDBOX3, e-mail [email protected], or notify the store/restaurant manager of your concerns immediately.

Although there is no evidence currently that these skimming attempts were successful, consumer security is a top priority for redbox. Reviewing transaction records, there is a possibility that up to 150 customers may have been affected. Although only a small percentage of the millions of customers who use redbox each month, redbox has notified the major credit card companies so that they can monitor the situation. The redbox team is also working with local authorities to investigate the incidents and ensure your security.

Skimming is not new (click this link for more details: https://www.uboc.com/ ). It has been attempted numerous times on ATMs, gas station pumps, and now redbox has been targeted. Redbox has been aware of these industry threats and has spent significant time and resources to prepare for them. The 7,400 redbox locations are visited frequently by redbox associates to maintain smooth operations and an optimum customer experience. In this case, a redbox associate found evidence of skimming attempts and initiated the actions in the team’s response plan (including this e-mail message).

Redbox greatly values our customer relationships. As a result, redbox is open and direct in our communications about this type of situation. The redbox team also utilizes industry-leading technology to ensure you have a safe shopping experience and aggressively combats attempts by criminals to defraud customers. Please see the questions and answers below for some additional details on skimming and how redbox ensures the safety of your account information.

Sincerely,
Trina Graham-Hodo
Director, Customer Service

Bill Caputo
Director, Security

Additional Questions / Answers:

Q. What is credit card skimming?

A. Skimming is the theft of credit card information used in an otherwise legitimate transaction. It often involves the placement of an illegal device above the credit/debit card reader on a vending machine, ATM, or in this case a redbox. For more info click these links:
https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming
https://www.uboc.com/about/main/0,,2485_703976951,00.html

Q. What does redbox do to protect consumer credit card information?

A. Redbox employs state-of-the-art security technology to ensure the privacy and security of our customers’ data before, during, and after their visit to our kiosks. Customer credit card information is encrypted the moment it’s swiped through our readers. Redbox uses further layers of encryption to protect all data transfers, too. Kiosks are also actively monitored and regularly inspected both on-site and remotely. Redbox never moves or stores unencrypted customer information. Credit card information can not be accessed by outsiders or even by redbox employees once the card is swiped at a kiosk.

Q. Where can I get more information on credit card skimmers?

A. Please use these links to get more information on credit card skimmers:
https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming
https://www.usatoday.com/tech/news/computersecurity/infotheft/2007-07-31-gift-cards_N.htm
https://www.uboc.com/about/main/0,,2485_703976951,00.html

Q. How do I know if a skimmer is on my redbox?

A. Redbox credit/debit card readers are standardized for all locations. Click this link for pictures of the two approved readers and some examples of skimmer devices: https://www.redbox.com/creditcardsecurity/

Q. Who should I call if I have questions?

A. If you suspect your credit card information was improperly used, contact your financial institution immediately. If you have specific concerns related to this incident and redbox, please visit https://www.redbox.com/creditcardsecurity/ or call 866-REDBOX3. Please do not reply to this email.