Feedback on this page
Some people call them ‘cash-points’ and others call them ‘cash machines’ or ‘holes in the wall’. The industry refers to the machine as an ATM – Automatic Teller Machine and I’ll refer to them as ATMs for the rest of this section.
After the introduction of the first ATMs into the UK in the early 1970s it didn’t take long for the thieves to work out how to turn this new convenient technology to their advantage. All the thief needed to do was to catch sight of your PIN as you punched it in and then steal the card by some method of card jamming or distraction or maybe even robbery. Then the fraudsters became more sophisticated and started using pinhole cameras and card readers fixed to the ATM card slots to carry out large scale ‘skimming' or 'skimmer’ operations. The skimmers are devices that can read the information off the magnetic stripe (or strip). With both the information from the card and the PIN they could counterfeit the card without you knowing about it and use the card to take money from your bank account.
Although much of the world has now introduced Chip-and-PIN cards and terminals (see below) cards are still being copied and therefore great care must still be taken when you use your card at the ATM
Before arriving at the ATM
- If possible, have your ATM card in your hand on approach to the machine, rather than delve into the wallet or handbag either at the machine or whilst standing in a queue to use it
- Have in mind the precise transactions you wish to conduct at the ATM to minimise your time at the machine
- Try to use ATMs that are located in busy public places and ones that are well lit after dark, although be aware that 'skimming' (see below) usually takes place during peak periods of ATM use.
- If you regularly deposit funds using an ATM maintain a supply of deposit envelopes in the car or in the office or home so that you can fill the envelope beforehand and minimise your time at the ATM
Arriving at the ATM
- Don’t use ATMs that appear visually different from the norm, especially around the card slot. Have extra things be added onto the surfaces of the ATM? (Tell the bank about your suspicions immediately)
- If in the company of your partner have them stand close to you at the ATM to help block views of the keypad
- Stand outside any ‘privacy boxes’ painted on the footway until it's your turn to use the ATM
- Be aware of somebody sitting in a car near to the ATM and be very aware of the people standing behind you and off to the side that are close enough to see you input your PIN. If you are at all concerned about the people near you, walk away and come back later or use a different machine. Trust your instincts!
- During bank opening hours use the ATMs inside the bank if they have them
- If the ATM is located in an access controlled lobby, where you swipe your bank card to get in, leave it immediately if you are followed in (tailgated) by someone who has not swiped their card. Return to the ATM later or use another machine
Using the ATM
- Don’t use your mobile phone during a transaction. Be totally focused on the matter in hand
- Try not to be distracted by incidents around you. Be suspicious of people talking to you and of people trying to assist you with your transactions, no matter how friendly they appear to be
- When inputting your PIN always stand up close to the ATM and cover the keypad with your other hand to stop your PIN being seen by people and cameras
- If you are withdrawing cash, place the cash and your card into your pocket or bag immediately and walk away. Don’t stand at the ATM counting it
After using the ATM
- As you walk away from the ATM continue to be aware of the people around you. Try to avoid walking up some poorly observed and quiet backstreet or alley
- If you think you are being followed walk into a shop, a pub, a restaurant or some other busy place
- When getting into your car lock the doors
- Check your bank statements regularly and report any unusual transactions to the bank immediately
- If you think your PIN has been seen or copied change it immediately. You can do this at nearly all ATMs
Methods of stealing your ATM card or bank details and PIN
Card trapping
This is achieved by various devices that are designed to fit into the card slot of an ATM and retain the card. The simplest form, the ‘Lebanese loop’ (named as such because that’s where the technique was first used!) uses a loop of plastic tape (similar to video cassette tape) attached to a false facia that sits on top of the genuine card slot cover. When the customer inserts their card into the slot the transaction progresses as normal and the money is counted. A design detail in the device traps the card as the ATM tries to return it to the customer. The ATM detects that the card hasn’t been returned and so doesn’t release the cash. The victim is hoodwinked by a fraudster standing nearby into believing that the ATM has malfunctioned or their card has been retained for some genuine reason.
While all this is going on, the thief has either recorded the PIN by looking over the shoulder of the victim (‘shoulder surfing’), another person standing off to the side has recorded it, or one of the fraudsters will engage the victim in conversation and suggest that they input their PIN a couple of times to see if this will release their card. Some more sophisticated criminals have attached miniature pinhole cameras to the ATM to film the PIN input and possibly even transmit the images to the laptop of a gang member sitting in a nearby car.
Once the victim has left the scene the thieves will pull out the device with the card and use it to withdraw funds from the victim’s account as quickly as they can before the victim reports the matter to the bank and the card is stopped.
What have the banks done?
To counteract this problem banks have been introducing devices to detect things being introduced into or onto the card slot.
Shoulder-surfing and Distraction theft
This is achieved through stealth and trickery resulting in the loss of your card and the recording of your PIN and below is a scam that’s been used in UK cities for years.
The victim arrives at the ATM and puts their card into the slot and after a few moments the user is invited to input their PIN. What they haven’t noticed is the guy standing slightly off to their right using his mobile phone and the bloke standing immediately behind them in the queue and there may be a third person standing nearby perhaps also using a phone. These people are trying to record your PIN.
Then, just as you can hear the ATM counting the cash the victim feels a tap on the shoulder and the guy behind says “Excuse me mate, but I think you’ve dropped some money.” The victim looks down and sees a ten pound note and bends down to pick it up. At that point there may be a further distraction as the third man drops his briefcase or whatever to slow the victim’s retrieval of the banknote. At that precise moment the second guy will take your card without you noticing it. The guy with the card walks away. You notice that your card hasn't been returned and one of the other thieves will probably engage you in conversation, perhaps suggesting that you report the matter to the bank; perhaps saying that it happened to him last week. This trick is often used when the bank is closed, so you're unable to report the matter as quickly as you might otherwise.
There are a number of variants to this scam. Sometimes the criminal gang will consist of both men and woman and can be up to five or six persons strong and the distraction might be even more unexpected, such as a supposedly crippled person on crutches falling onto the ground in front of the ATM user.
The card can, of course, be stolen from you by pick-pocketing or snatch theft; something that more commonly occurs in busy locations close to the ATM, such as a street market where there is a lot of jostling and close contact with other shoppers.
What have the banks done?
To counteract this problem banks have introduced on-screen messages bringing your attention to people standing around you. Some have painted 'privacy boxes' onto the pavements to discourage others from standing too close to the user and in some shopping centres roped off queueing areas have been deliberately set back away from the ATMs to improve privacy for the user. Some of the banks have introduced additional reflective surfaces around the ATMs so users can more easily see activity behind them.
Above: Privacy boxes painted around an ATM in Camden London helps to create defensible space for the user and discourages waiting customers from standing too close to the ATM when in use.
Above: Reflective wall and ATM dividers in Holborn London enables users to see who's standing behind. The dividers help to provide some defensible space and frustrate distraction theft
Skimming
This is the most sophisticated method used to obtain your ATM card details and PIN and you may not know you have even been a victim until you read your next bank statement.
Skimming involves the use of a card reading device and a pinhole camera. A card reading device or ‘skimmer’ is fitted over the top of the ATM’s card slot. The unsuspecting victim puts their card into the card slot where it’s read by both the card reader and the ATM. The transaction takes place quite normally, but the PIN input is recorded by a disguised miniature camera located above the keypad. The victim takes their cash and returned card and leaves without realising what has happened.
In the less sophisticated cases the information is retained by the camera and the card reader, which have to be retrieved, whereas in the more recent cases the information has been transmitted to a laptop being operated by the thief sitting in a nearby vehicle. Devices have also been getting smaller and some card readers even contain the camera.
The information obtained is then used to create a fake magnetic stripe card, which can be used in a foreign ATM using the genuine PIN.
What have the banks done?
Introduced devices to detect things being placed into or onto the card slot.
In 2002, to counteract a worrying increase in this form of credit card fraud, APACS (Association for Payment Clearing Services - now UKPA (UK Payments Administration Ltd)) introduced EMV Chip-and-PIN technology. Retailers had to purchase new card readers and the banks' ATMs were upgraded to work using the chips in the cards rather than the magnetic stripes. By the end of 2006 the changeover to Chip-and-PIN had been completed. Cards have continued to carry the magnetic stripes so they can be used abroad, but by 2010 nearly all of Europe had made the change to Chip-and-PIN.
The changeover to Chip-and-PIN has reduced the use of counterfeit cards in the UK significantly, although some cards copied here are being used abroad where the country has yet to make the change away from magnetic stripes; the USA being one of them. That said Mastercard and Visa have recently announced that the US will go Chip-and-PIN by April 2013.
The UK banks are taking a range of measures to reduce ATM crime. Most of us will have a daily cash withdrawal limit of around £300 to minimise losses. Most, if not all ATMs now display warning messages to customers. Closed Circuit Television Cameras are being used to identify the criminals and the banks work closely with the police on operations to catch the villains.
For further information about ATMs visit the UK's cash machine network, LINK. On this site you can also view a short video, which demonstrates the importance of covering the keypad when you are entering your PIN.
It's interesting to note that my friends at Central St Martins College of Art and Design in King's Cross, Central London have recently teamed up with LINK to investigate new methods of reducing this type of crime using software and machine design techniques together with an appreciation of how the wider built environment can provide opportunity for ATM fraud.
Protecting your PIN
The good news is that the amount of fraudulently obtained cash and goods using debit and credit cards in the UK has been steadily and substantially reducing since the introduction of Chip-and-PIN. However, the protection of your PIN remains a vital component of fraud protection so do always remember to cover the keypad with your other hand as you type in your PIN when using ATMs and card readers in shops and restaurants.
Additional Information
Recently published by The Telegraph Newspaper is this useful video where a Detective Inspector from Action Fraud describes the problems associated with ATMs
Updated September 2015
