Used [Unwiped] ATM Machines for Sale on Craigslist

Via tomsguide.com -

Identity theft expert Robert Siciliano is claiming that he bought a used ATM machine on Craigslist for $750. Apparently, this isn't unusual: he found plenty of machines on both Craigslist and eBay ranging between $500 and $2000 USD. However, this particular ATM machine was listed by a bar north of Boston, and contained 1000 credit card numbers.

That's right: the machine wasn't wiped. Siciliano said, in an interesting way, that his "hacker friend" came over with a manual and gutted the machine's eprom, spilling the 150-foot spread of sensitive data all over the floor. Surprised and excited, Siciliano thus called a "TV producer friend," and now his local FOX affiliate is running a series on ATM hacking and Siciliano's discovery.

Siciliano also said in his report that he was considering a scheme to use the numbers to leech millions from unsuspecting victims, however his wife told him a firm "NO!"

FOX Boston, on the other hand, added that the credit cards stored in the ATM consisted of numbers processed in a four month period. With that said, it's highly likely that many more used ATM machines for sale on eBay, Craigslist, and other auction sites contain credit card numbers, ripe for the picking. Then again, consumers are more susceptible to identity theft thanks to ATM skimming devices sold on the very same auction sites.

So how do you protect yourself from ATM hackers? "By paying attention to your statements," Siciliano said. "Don’t use just any ATM. Instead, look for ATMs in more secure locations." He also said to cover your pins when punching them into the keypad on the ATM or within retail stores.

--------------------------------

I understand Robert Siciliano is an Identity Theft consultant (mostly for the media)...but suggesting that he was thinking about hatching a sheme to steal money...isn't a good thing to say in a report.

Why are ATMs storing credit card numbers at all? Why are they still on the system four months later?

Shouldn't ATMs be built with drive/memory wiping utilities...just like high-end multifunction office printers?