mrs jjimm checked her credit card account online today and discovered that more than £1,000 had been illegally withdrawn from her account by person or persons unknown. Each withdrawal was from the same ATM in London.
She’s been on to the credit card company, and they’re saying that her card was probably cloned. However, even if it had been cloned, how could the fraudsters use it to withdraw money from an ATM, given that her PIN is only in her head?
Does she remember using the card at one of those stand-alone cash machines - not a regular bank ATM - the sort that you might find in a grocery store or a gas station?
My sister, who works for the Bank of New York, nearly took my head off one day when I made a move to withdraw some cash from one of these at the local mall. She said that the stand-alone machines are to be avoided at all costs, since you can never be sure that the machine provider isn’t in fact crooked or hasn’t had their security compromised.
Getting both your wife’s card number and PIN from a transaction on such a machine could be a trivial exercise.
Here in the US, most ATM’s have a camera attached. So the bank ought to be able to obtain photo’s of the illegal user, at least. May not be much use in locating that person, but might help in prosecuting them eventually.
P.S. Even though a PIN is “only in her head”, it’s often not hard for a thief to guess it. Things like part of your phone number or house number, the year or month-day of your birth, etc. are real common PIN’s, and pretty easy to guess. Especially so if the thief manages to see the first digit that you pressed.
What can happen is that the scammers install equipment on an ATM to pull off this kind of fraud. A magnetic stripe reader is installed over the actual reader in the ATM. The scammers also install a camera to watch you type in your PIN. If you use the ATM, the scammers will have both your PIN and a copy of your card’s stripe.
Card reader plus small camera. Not a great challenge, for anyone with the required knowledge. There’s been cases where the new Barclays machines have been covered by an entire fake plastic front, which includes the reader, camera & transmitter.
Certainly make sure you have personal contact with the local police force in question (presumably the Met, but potentially the City of London, the Transport Police, etc.). AFAIK, the bank are not themselves obliged to report anything to the police, so don’t assume they have done. They have a vested interest in keeping fraud reports down to a minimum.
There are at least to kinds of ATM frauds:
Duplicate card reader (mentioned by Rysto.)
Phooo-eee, only two? What about the distraction, when your card is about to emerge, and you’re told “oh, is that your tenner on the floor”? At least give credit to the ancient art of distraction!
We’ve been reviewing her ATM behaviour, and she recalls one incident with a standalone machine that “wouldn’t take” her card. She can’t remember if she got as far as tapping in the PIN, but that could be it. I then found this, about a device as mentioned, installed on legitimate ATMs in the UK a couple of years ago.
Cheers for all your suggestions. Off to the cop shop tomorrow. Hopefully they’ll be able to find the perp, though I’d guess they’ll be wearing a “hoodie” or a baseball cap.
Based on experiences through my job and discussions with a local assistant district attorney, the ATMs that aren’t on camera are frustratingly common, and never on bank property. I can name two Fortune 20 companies that have ATMs installed in their (public) facilities and NO policy of covering them with cameras.
ATM’s can come with cameras built into the machine, often concealed. These work quite well, because they give a close-up view of the person’s face while they are pressing the buttons on the ATM. (unless they are wearing a mask when using the ATM, which would tend to look suspicious!) Those built-in cameras are much better than the closed-circuit cameras around the facility.
But, obviously, it was the choice of the bank that installed these ATM’s to save a bit of money by specifying ATM’s without the camera. You ought to be complaining to them. And to those Fortune 20 companies, too, I’d say.
To me, it seems pointless cost-cutting by the bank to eliminate the built-in cameras from the ATM’s. Catching just one career thief would pay for the cost of this camera easily. But I guess the money saved is the customers, not the banks, so they don’t care.