So you’ve got all this technology and all these safeguards built into the machine, and yet no one thought of the possibility of a criminal gluing the door shut. These days, new machines are no longer manufactured with doors. They simply have slots that shoot out the money. But there are still plenty of older generation ATMs with doors on them. If a door doesn’t open, don’t shrug it off. Notify security.
Sometimes you’ll put your card into the ATM slot and, tug as you might, it gets jammed and you can’t get it out. So you leave it there, intending to contact the bank when you get to a phone or the next morning if it’s after banking hours. While it might be a broken machine, I wouldn’t bet on it. The odds are it’s a card-withholding scam.
Here’s what happens. A thief puts an adhesive of some sort inside the card slot. He steps aside and waits until someone comes and tries to use it. When someone does, the card gets glued to the slot. Then the crook slips into line behind that person and watches him enter his PIN. Sometimes, just to be on the safe side, the thief will position a sign on the ATM machine that says, “If your card gets stuck, enter your PIN three separate times to retrieve it.” If the thief can’t pick up your PIN number after three tries, he needs to find another line of work.
After you leave, frustrated by the experience, the thief moves in and removes the card with a pair of pliers. He then proceeds to use your card at other ATMs.
In Massachusetts, two men worked a card-withholding scam in ten towns in the Boston area, preying on young women. When a woman’s card got stuck, they would come up and sympathize, meanwhile memorizing her PIN as they tried to help her remove the card. Once she left, the thieves would extract the card using a fingernail file. If they weren’t able to get the PIN, one of the men would later call the customer and pretend to be a bank official or ATM security officer and get the number that way. The men stole more than ten thousand dollars from twelve different women before they were caught.
WHAT TO DO
The tip to remember here is, before you insert your card into a slot, take the time to inspect the card slot for any residue. If you notice any, don’t use it. And if you see a notice on a machine advising you to enter your PIN multiple times, don’t even think of using that machine. Believe me, the bank didn’t put that sign there.
Police in New York arrested a man who had been stealing PINs at ATM machines in Manhattan and then tricking his victims, usually senior citizens, into reinserting their card under the guise of “clearing the machine.” Once the customer did so and left, the thief would linger, punch in the stolen PIN and make additional withdrawals. There’s no need to “clear a machine.” Once your transaction is done, there’s never any reason to insert your card again, no matter who tells you to.
Common sense is always the best defense against any form of crime, but it astounds me how often people neglect to use any sense at all. Consider this con that succeeded in netting its perpetrator a nifty one hundred fifty thousand dollars. The man positioned himself outside the locked door of an ATM enclosure, and posed as a bank security officer. When customers approached the enclosure to use one of the ATMs, he would introduce himself and tell them he needed their assistance in catching a dishonest bank employee who had been driving management crazy. Could they please leave their bank cards under the locked door? He’d personally assure them he would get their cards back to them by the next day.
For those who complied, the con man would then fish the cards out from under the door. The next day, an accomplice would call the cardholder and report that the employee had been apprehended. He wanted to thank him for his help. Then he would point out that since the dishonest employee had come into contact with the card, the bank would have to give the customer a new PIN. Could he please have the old PIN to verify that he was speaking to the actual cardholder?
Incredibly enough, more than three hundred ATM users fell for this ruse. As enthralling as it sounds, I can assure you that a bank is never going to use a customer to assist it in nabbing a crooked employee. It will use a security guard or enlist a police undercover detective. Real life is nothing like the movies.
AND WITH SOME HEAVY EQUIPMENT . . .
Some criminals will physically assault an ATM. A thief in Norfolk, Virginia, broke through the ceiling of an ATM enclosure and used a crowbar and a blowtorch to try to get into the machine and collect the cash inside it. The machine put up a good fight, but it really took a pounding. There were scorch marks on the ATM from the blowtorch. There were scars from the crowbar. The handle of the door was broken off. The combination lock was destroyed.
A crook armed with the proper tools can break into many ATM machines within fifteen minutes. ATMs are actually rated on how resistant they are to physical assault. A certain model may have a TL-15 or a TL-30 rating, the number indicating the time it would take for a skilled thief to break into it with the right tools, and given a suitable environment. But a thief rarely has that much time, because ATMs are outfitted with detectors sensitive to things like vibration and heat. These detectors are usually silent, so the criminal doesn’t know the police are on the way.
There was a mechanical engineer, however, who was very successful at breaking into ATMs. At one time, he used a burning bar on ATM vaults. Later, he used an industrial magnetic drill. Then he manipulated the locks and combinations on the ATM chests. He was ultimately caught, but not before he did a lot of damage and collected a good deal of money.
I always tell banks, keep the ATM area well lit and free from obstruction. Don’t create hiding places with bushes or ornamentation near the machine. Put video cameras in the ATM enclosure to record criminals on tape. There are various types of alarms and time locks and relocking devices. If time locks are used, you can bet that no criminal is going to wait around for the time to elapse.
Generally speaking, it’s not that easy to find an environment where a crook can spend even as little as fifteen minutes with a blowtorch opening up a machine without attracting attention. That’s why crooks who are after the cash inside a machine—a convenience store machine may have as much as ten thousand dollars in it and one at a bank could contain something like seventy-five thousand dollars—will more likely just cart the whole machine off with them. A few years back, two criminals walked into a convenience store and identified themselves to the seventeen-year-old clerk as representatives from the bank. They said the ATM needed to be repaired, and they put it on a dolly and made off with it.
For the most part, though, relatively few thieves bother risking pulled muscles when they can make so much more money by ripping off card numbers.
THERE’S NOTHING LIKE OWNING YOUR OWN
Criminals are pretty nervy, and I’ve learned to never be surprised by what someone will try to get away with. And, given the right circumstances, you can get away with almost anything—up to a point.
The nerviest form of ATM fraud is when the thieves actually set up their very own bank machine. Here’s a case that I still shake my head over. One weekend a few years ago, two men dressed as bank employees arrived and set up a perfectly ordinary-looking ATM in a popular shopping mall in Manchester, Connecticut. Mall officials had swallowed their con that they were from a New Jersey outfit called Electronic Cash Machines. I’m not sure they did any background check on them whatsoever.
In any event, the machine didn’t dispense money. It wasn’t even connected to a phone line that would have enabled it to be linked to a bank network. It was simply plugged into an electrical outlet. What the bogus machine did do was record the card numbers and personal identification numbers of customers who inserted their cards in futile attempts to get some cash. That was all the thieves needed. They then manufactured counterfeit cards with the customers’ numbers, went to working machines in New York, and gradually drained their accounts.
Even though the phony machine was real in appearance, it did take a certain leap of faith for customers to actually try to use it. Or perhaps I should say, it took downright gullibility. After
all, the machine wasn’t tucked into a wall the way real ATMs are. Instead, it just sat there on wheels, outside one of the mall’s busier department stores, looking like it was still waiting to be installed. There was no bank name inscribed on it, just a few stickers affixed to it advertising various ATM networks.
And the machine never spit out any money, even though one of the thieves, posing as a repairman, spent an awful lot of time crouching next to it, doing his best to look like he was industriously working on its mysterious problems. Again and again, he would pronounce it fixed, and yet it never was. But he was a nice-looking young man, and he sounded persuasive. “I think it’s fixed now, c’mon and try it,” he would invite people. “I think it was a problem with the dedicated phone line.”
Incredibly enough, more than a hundred and twenty customers went ahead and gave the machine a try, much to their subsequent regret. There was a man who sold Nordic Trak equipment who worked nearby. He’d notice customer after customer using it, never once getting any money. He’d see that same persistent repairman constantly at work on it, never seeming to make any headway. So what did he do? He went ahead and swiped his own card in the machine. A few days later, two hundred dollars was missing from his account.
The machine remained in the mall, standing on its wheels, for a full two weeks, collecting more and more card numbers and PINs. By the time the authorities finally caught on to what was transpiring, after customers complained about missing funds, the crooks had gotten away, and so did the machine. Apparently deciding enough was enough, the two men came in one day and loaded it onto a white truck. They informed the mall that it had to be taken in for repairs.
It was unclear how the thieves got their hands on the bank machine. It was speculated that they bought it on the used ATM market. Or they might have stolen it. Not that long before, there had been a wave of thefts in New England, during which a band of robbers wrested bank machines off of their foundations and took them away in trucks. In actuality, though, there are companies that make portable ATMs and will gladly sell them to anyone who wants one. You’d be amazed at the things that the general public can buy. There’s only one state in the country, Oklahoma, that doesn’t allow just anybody to buy a pay phone.
The Connecticut thieves managed to realize more than one hundred thousand dollars from their audacious crime. What tripped them up was they made the mistake of using their counterfeit cards for withdrawals in Manhattan bank machines. New York has a law requiring cameras on every teller machine. By inspecting photographs and withdrawal records, the police apprehended the two men about a month later. One of the thieves was a computer specialist. The other had a background in finance. When they were arrested, the authorities discovered that they had five ATMs, including the one used in the Connecticut caper.
There have been other extravagant variations of the open-your-own-ATM scheme. In a number of instances, a criminal has ventured into hotels, asked to see the manager, and introduced himself as a representative of a business that installs ATMs in commercial locations. He outlined a deal where he would put a portable machine in the hotel’s lobby. Every time a guest used it, his company would collect a service fee of one dollar fifty cents. He’d give one dollar of that to the hotel. It’s a deal that sounded great. The hotel would have a new convenience to offer its guests, and not only would it cost the hotel nothing, but also the hotel would make money off of it. So the manager said, go ahead, put it in.
The criminal rolled it in, and unlike with the mall caper, he loaded it with $1,500 so it functioned like a legitimate machine and actually dispensed cash. He didn’t mind this little investment, considering the returns he anticipated. His machine wasn’t connected to a bank phone line, either. It was simply registering card numbers and PIN numbers to allow counterfeit cards to be generated.
So don’t be fooled into thinking a machine must be real if it dispenses money. Criminals aren’t that cheap. They’re perfectly willing to invest some cash if the returns are much greater, as they inevitably are in scams like these. I’m always mistrustful of portable ATMs, and use them only if I have no alternative. When I go to a stand-alone machine, though, I always take a look behind it to see if it’s connected to a phone line. If it isn’t, it’s a fake.
JUST SKIMMING ALONG
The latest approach to ATM theft is skimming. Skimmers similar in function to the ones I spoke about for credit card fraud are specially manufactured for ATMs. Criminals fit them over the card slot on a standard ATM, and they have a magnet in the back that holds them in place. The skimmer is motorized, so that when you put your card in, the motor nudges the card along so it actually penetrates the real hole as well. That allows the machine to function normally. But while the card passes through the skimmer, your card information is stored on its chip. At the end of a day, the criminal retrieves his skimmer, as well as dozens of account numbers and PINs.
Anytime you notice something protruding from an ATM, be suspicious. The card slot should be flush. Someone I know once encountered a skimmer, yanked it off the machine, and went in and handed it to a bank officer. “You might be interested in this,” he told him. “I found it on your machine.”
WHAT TO DO
It’s the simple things that can prevent you from becoming a victim of ATM fraud, and so let me review the key safeguards to keep in mind. Never give out your PIN to anyone, especially someone who maintains that he’s a bank officer or a security guard. All a crook needs is your card and your PIN, and he can go to town. If others are waiting in line behind you to use the ATM, don’t be lackadaisical, and block the keyboard when you enter your PIN. Some banks have redesigned the ATM keyboard or enclosures to make it particularly difficult for an observer to watch the cardholder punch in his PIN, but even then you need to be watchful.
Never write your PIN on your card or on a piece of paper that you keep in your wallet or purse. I know some people who put it on a little sticker and attach it right to their ATM card. That’s credit suicide. If your ATM card is lost or stolen, immediately report it to your bank so that card can be disabled. Crooks move fast, and you need to move faster.
Don’t consider using an ATM unless you’ve checked out the area carefully. If people seem to be loitering by the machine, don’t assume they’re there for innocent purposes. And check across the street for people with cameras or binoculars, those long-distance surfers I mentioned. If something about an environment makes you uneasy, err on the side of caution and come back later or use another machine.
If you feel threatened while processing a transaction, press the “cancel” button and leave the area. If you sense someone is following you, drive to the police station or nearest business with a lot of people around. Once you’re done getting your money, don’t just stand there at the machine and count your cash, advertising your withdrawal. Put it away, leave the area, and count it once you’re in your car or back in the office.
The receipt that gets spit out of an ATM machine is a nice convenience for the customer. It’s also a great convenience for the criminal. It has part of your account number on it and how much money is left in your account. In some cases, it even has your PIN. Until a few years ago, federal law mandated that ATM receipts had to carry your full account number on them. That made it too easy for crooks. I was among those who testified in behalf of a change in the law, known as Regulation E. It was finally changed, and now receipts only have to carry half of an account number.
Even so, don’t throw away your receipts at the ATM machine in those receptacles banks (or crooks) put there. Criminals retrieve them and use even fragments of information to carry out shoulder surfing scams. Rip the receipts up before you throw them away, or take them with you. If you’re going to leave them behind, you might as well leave your bank card, too. When I use an ATM, I always choose the option, “No receipt.”
All ATM cards have a daily limit that prevents the cardholder or any other user of the card from withdrawing more than a certain amount of money in any o
ne day. Cardholders, however, are seldom aware that certain banks allow a cardholder to go into the bank and withdraw larger amounts on the card using only the PIN and card. No further identification or signature is required at these banks. This allows a thief who has a person’s card and PIN to withdraw the maximum allowable at the ATM and then, after checking the account holder’s balance, to go into the bank and withdraw additional amounts at the teller. If my bank did that, I’d have them put the same limit on a teller withdrawal, unless further identification is furnished.
And here’s some advice about PIN numbers: be a little bit more inventive in your choice of number. Surveys of our habits are interesting fodder, but—guess what—criminals read surveys, too. They know that 70 percent of people use their birthday or their street address as their PIN. If a thief gets hold of your purse or wallet, he’s got your street address. If it’s a four-digit address, that’s probably your PIN. Any number of cards in your wallet will have your birthday. Another common choice is the first four digits or the last four digits of your Social Security number. Thieves love that, too. Use an easy-to-remember number that’s not tied to you, a number that isn’t going to be found on any piece of personal identification. I have three sons, and so I use their birthdays for my PIN numbers. I never forget my kids’ birthdays, and yet no one can find those dates on anything in my wallet.
LEAVE MY EYES OUT OF IT
Because PIN numbers are the weak link in the system, there’s been a lot of discussion about doing away with them. The hot new technology for ATMs is biometrics, which is the statistical measurement of biological phenomena. An array of devices have been invented that will identify people through physical characteristics, whether by hands, faces, voices, eyes, or even smells. One of the most promising is a machine that identifies you by your eye. When you insert your bank card, a pea-sized camera locates your face, homes in on the eye, and snaps a digital image of your iris. It can do this from as far away as three feet. The computerized “iris code” then gets compared with one that the customer furnished to the bank. If the two codes don’t match, the ATM won’t work. The entire process takes not even two seconds.
The Art of the Steal Page 15