Forum Topic

ATM Scam

I was scammed at an ATM on Friday afternoon, near Hayes – I’m living with a friend on a temporary basis. Whilst I know I was scammed, I don’t know how the scam was pulled off, so I wondered if anyone on here would have any idea if I describe what happened:The ATM is outside a supermarket. I pulled up on my bicycle from the right hand side, so I was facing right towards the ATM, still on my cycle, which formed a bit of a barrier. I put my card into the card slot, which is on the R/H side of the machine, and entered my card details. I pushed the button requesting £200 but no money was dispensed and I never saw my card again. During this process, perhaps starting after entering my PIN (I’m not sure exactly when), a man approached me from my left, saying that the machine isn’t working and that I need to press particular buttons for my card to be returned. I kept telling him that I didn’t need his help, but he kept returning saying the same. I reached the point where it was clear that I was neither getting any money or the return of my card. The guy said, again, that I need to press two buttons for the return of my card (approx. top left followed by btm right button), which this time I did. Nothing happened and the guy sloped off, seemingly quite content. Two women close by started shouting, saying it’s a scam and that the guy is waiting around the corner, and it was becoming increasingly clear that it was, indeed, a scam. I tried to phone my bank from the ATM to get the card cancelled but I was unable to get through. I also spoke to a security person inside the supermarket to see if they could help but they said they couldn’t, so I decided to cycle home as quickly as I could and phone my bank from there, and with all the required security info. The cycle ride took approximately 15 mins, but 30 mins or more may have passed from the incident to me logging on to my online banking, by which time nearly £500 had been debited from the card at different venues, £2k pending and, I believe, another £1k, which the bank rejected.  Any ideas, anyone, how this scam works? It’s possible that the machine returned the card but an accomplice took it while I was being distracted to my left but, if this was the case, why wasn’t any cash dispensed? And why did this guy want the two buttons on the machine pressed? My attempted withdrawal of £200 didn’t show up on my online banking statement. Fortunately, my bank has been very good so far and refunded me my losses, although I understand that their fraud team will be in touch soon for more information.In any event, I don’t think it’s a good idea to use ATMs, which are outside. I think I’ll travel the extra in future and withdraw only from inside a bank.

Michael Brown ● 1479d27 Comments

That’s a crappy thing to happen MichaelI believe that there’s something called a card reader that is inserted into the ATM which prevents your cash being delivered and allows the criminal to withdraw your money as well as reading your card details …..

Madeleine Hazard ● 1479d

Different types of ATM scamsThe following are several examples of common ATM scams:Card skimming: The most common scam, the perpetrator uses a card reader to capture the data from the magnetic strip of the card. Sometimes the card reader is installed right on top of the ATM’s card slot.Cash trapping: A false ATM presenter is placed onto the cash out shutter of the ATM machine, which traps the cash when the cardholder tries to withdrawal money. Once the cardholder leaves to notify the bank, assuming there is an issue with the machine; the perpetrator removes the trap and takes the cash.Fake assistance: This scam usually targets the elderly, asking them if they need any assistance at the ATM machine. While “helping”, the perpetrator is memorizing the card number and pin to use later on.Shoulder surfing: Looking over the shoulder of the cardholder to see the PIN that is being keyed in.Fake PIN pad overlay: A device that looks like the ATM’s keypad is placed on top of the ATM machine and captures the PIN entered by the cardholder.ATM Hold-up: Although not very sophisticated, the cardholder is held up at gunpoint or with a knife while trying to take money from the ATM.“Lebanese Loop”: A metal or plastic strip is installed into the ATM card slot. When the card tries to eject, the loop prevents it from ejecting and cash is not dispensed. When the customer goes into the bank to complain, the thief removes the loop and has access to your bank account and cash.

Krysia Gdaniec ● 1479d

Thanks Krysia for sharing an amazing knowledge of the scams.  The ruthless ingenuity of scammers both online and in ATMs is truly extraordinary. On occasion though I have elderly people come up to me asking me to help me withdraw their money because they didn’t feel confident doing this themselves. I obliged but worried about the long term consequences of their method of cash withdrawal!

Jackie Elton ● 1479d

Worked with a guy once who had worked on the fraud prevention dept in a bank. His advice to me was use extreme caution and avoid if possible, any outside ATM.

Russell Pearson ● 1479d

Problem is, with so many banks closing (or being closed most of the time), it's tricky to find an indoor one. Thankfully, I pretty much do without cash and use a card to pay for 99% of what I need.

Gordon McDonald ● 1479d

Yep, I tend to use the one in Budgens. More Supermarkets should have them inside.

Russell Pearson ● 1479d

I use cash machines so I'm OK.

Basil Finnis ● 1479d

'Lebanese loop' is a common scam.

Keith Iddon ● 1479d

I'm guessing that all the money debited was by physical card presence , chip and sometimes pin. Did the Bank say if the machine had your card ?I'm going for an overlay keypad with a wifi connection to a nearby phone. And would also have to be a card reader device with a wifi to a the same  near by phone.  Since the battery cell in the overlay would be small I would say it's not connected in real time (using constant power) to the phone and would have to be told to start the connection and send the sequence of last digits pressed to the wifi - so this is where  your funny combo button press comes in.  So once this is done they have both your card details and your pin and can make up a card on the spot. They get, is it 45 or 60 tap and go per transaction but every so often get challenged for a pin which they have. But since they have your pin can also go for items above that limit.  I'm guessing no online purchases done as these would need your security printed number on the strip  or a one time authorisation by your linked mobile neither of which they have.Still, all very interesting.

Andrew Craig ● 1479d

Andrew - the Bank did not say if the machine kept my card; I didn't even know they would know. I believe that the successful fraudulent debits (3) were from two different nearby ATMs. I don't know about the £2k pending debit - presumably not; it did say on my online banking statement but it's since been removed. The attempted £1k debit wasn't shown on my online statement, as it was rejected by the bank immediately - I only know about it because the Bank text me questioning it, and the other debits. Thanks for the info - very interesting too!

Michael Brown ● 1479d

Forgot to say. Normally ATM's only start counting the money out internally once your card is ejected and it detects it is removed.  They put a hook catch on their fake facade so the card cannot come out , hence the machine goes into a loop of trying , and hence doesn't put anything on the visual screen  as it's in an interim state and there is no display info associated with this. So eventually the machine prob goes into down mode or offline as it can't work out why your card was not ejected.  Since they are not planning on hanging around they don't care about the machine. Or maybe they did and as you left were able to retrieve their facades  , but not your original card. Maybe they had accomplices to retrieve the facades when it was quiet later but they had the time to be off and go spending.  It's more likely bluetooth tech than regular wifi  , thinking about it.

Andrew Craig ● 1479d

Oh Ok,  its just that most cards have a per day limit of cash withdrawal by all ATM's in total , not by transaction, that most people keep at the time of issue although you can raise it by prior request. SO yeah it used to be 250 to 300 but might be 400 these days. Not heard of anything more than that

Andrew Craig ● 1479d

My feeling at the time, and since, is that the machine had been rigged in some way, which I guess involves some sophistication; but it seems odd that such sophistication needs to be accompanied by a crook running around the ATM in broad daylight shouting instructions to the user; but maybe your guess is right, and that's how it's done.

Michael Brown ● 1479d

As others have said, it sounds like a false front placed on the ATM.

Susan Kelly ● 1479d

It's not that. He only intervened because you were hanging around too long and it could have scuppered the scam. Most people would wander off before your 15 mins stated. He would most likely press those buttons himself to send the info after you left.

Andrew Craig ● 1479d

What to do in such a situation?  Hang around for as long as it takes for the crooks to get bored and go and find another target?  Meanwhile call the police and see if your card can be retrieved after removing any of these scam devices?  Shout and scream blue murder to cause a fuss?

Vivienne Cox ● 1479d

Call your bank, away from the cash point to keep safe.

Russell Pearson ● 1478d

Was it the Tesco Superstore in Hayes?

Carl Johns ● 1478d

Tesco Extra, Glencoe Rd UB4

Michael Brown ● 1478d

"He only intervened because you were hanging around too long..."I put the card in the slot, entered my PIN and pressed '£200'. He intervened during that process, so quite early on.

Michael Brown ● 1478d

I had a similar experience outside Metro in Chiswick.There was a "helpful" man there. How he stole the money I have no idea, perhaps he was a member of the magic circle? When the cash was not forthcoming I reported it in the bank, and next day phoned the head office.  I asked that they let me see the CCTV, so I could see what I had done wrong,  but they didn't, but refunded my loss.

James Roy ● 1477d

Having to been a victim recently of a scam like this at a cash machine, I can say the person who asked/told you to press other buttons to return your card was in on the scam. His job was to get you to hold other buttons while entering your pin, which using your hands in this way stops you from covering (as you would normally do) your pin number, he would have an accomplice on your other side, who makes a note of your pin.

Stuart Wood ● 1476d

Ok, so he intervened early just to try to expedite the sending of the data held in the memory buffer of the skimmer  tech  to the phone his accomplice had round the corner. Still makes sense.  There are US police vids on youtube about this. Seems it's hit there first.  Criminlas are doing anything that has a terminal and card reader.  ie self service gas station pump, as well as ATM's.  Their police now have bluetooth signal detectors specifically designed for this. The limited suggestion so far is you should try to wriggle the card reader entry port  and the keypad before use. These things are just stuck on with double sided tape.  If you feel it's too loose  then walk away.

Andrew Craig ● 1476d

What about this one, Andrew - the screen seemed really bright when I used it. Any connection to the crime? Maybe it's always that bright but I often struggle to read these screens in daylight, but not on this occasion - the screen was bright white with clearly defined blue digits.

Michael Brown ● 1476d

To avoid these scams, would it be an idea to watch someone else obtain cash before starting? If devices are in place surely no one would get their card and money.

Vivienne Cox ● 1476d

That's exactly what I did today Vivienne and ask my partner to stay with me, thank you Michael for posting this, terrible thing to happen to anyone.

Janice Evans ● 1475d

Not likely. Their tech is just overlays, they have no interaction with the operating system of the ATM. I notice screen brightness and contrast are very variable wherever I use. This should be set by the installer. A good one will check these things a bad one will probably skimp on it.First line advice is to try and use an ATM inside or in a lobby. The scammers target outside machines as they need quite a few mins to install it all in peace. Inside usually covered by other camera monitoring tech.

Andrew Craig ● 1475d