How to use debit cards in ATMs: A safety guide

ENS,  New Delhi | October 21, 2016 Over 3.2 million debit cards from several banks in India were hit over the last two months following an ATM security breach through malware infestation.

The issue was highlighted after SBI, India’s largest commercial bank, on Wednesday said that it had blocked 6 lakh debit cards to ward off security threat , “Card network companies NPCI, Mastercard and Visa had informed various banks in India about a potential risk to some cards in India owing to a data breach. Accordingly, SBI has taken precautionary measures and have blocked cards of certain customers identified by the networks,” SBI said in a statement.

Keypad jamming fraud

The risk department of the banks have termed it so because the modus operandi of defrauder involves jamming both the ‘Enter’ and ‘Cancel’ buttons on the ATM machine by applying glue or by inserting a pin or blade at the edge of the button. So when the customer tries to press the ‘Enter/OK’ button after entering his ATM PIN, the key does not function and the customer can’t proceed with his transaction. At this juncture the customer thinks that the machine is not working and tries to cancel the transaction, which also does not go through as that button is also jammed. Thinking that the transaction is cancelled, he leaves the ATM machine. As soon as the customer leaves or is prompted to visit the nearby ATM machine, the fraudster takes over the machine and since the transaction is active for around 30 seconds in most cases (some banks have reduced it to 20 seconds), he keeps the transaction active by pressing some functional buttons and in the meantime removes the glue or pin from the ‘Enter’ button to go ahead with the transaction. The fraudster then withdraws the cash from the customer’s account, leaving the customer unaware of the fraud till he checks the message from the bank.

There is, however, a limitation to the cardholder’s loss in this case as the fraudster can transact only once and he will need the card to be swiped again and the PIN to be entered to defraud the same customer.

Experts say that firstly the customers should not seek a strangers help during ATM transaction and also ensure that the transaction is cancelled, before they leave the machine to be accessed by someone else.

It is important to note that in case of such a fraud, the bank does not take the liability on itself as it considers it to be negligence on the part of cardholder.

Card swapping

Another form of ATM-related fraud that has come to banks’ notice is card swapping. When a customer visits a merchant establishment, a restaurant or a petrol station and uses his/her debit card for transaction, the attendant (fraudster) notes down the ATM PIN when it is keyed in by the customer. Later, while returning the card to the customer, the attendant swaps the customer’s card with a dummy card that is identical to the customer’s card. Since the customer is unaware of the swapping, he secures the dummy card whereas the fraudster gets both the card and the PIN which he uses to withdraw cash till the card is blocked by the customer. Experts say that the fraudsters keep several dummy cards of various banks and depending upon the card provided by the customer for the transaction, they pull out a similar card and hand it over to the customer. Since most customers don’t check if the returned card is theirs or not, the fraudsters are successful in cheating the customer.

Industry insiders say that in a lot of cases customers also tell the attendant the PIN to be punched into the ‘point of sale’ terminal and this is something that one should completely avoid. Also while the cardholder should ensure that his card is always in his eyesight, he should check if the card returned his own card.

Even in case of card swapping fraud, the bank does not take the liability on itself and holds the cardholder liable for the financial loss incurred by the cardholder.

Skimming

This is a more technical mode of duping and the cardholder can hardly do anything about it as the miscreants plant a small skimming device in the debit card slot of the ATM machine and it can read the magnetic tape information of the card when the card goes through the skimming device. With the copied magnetic information, the defrauder can reproduce a duplicate card (on any plastic card) to be used later to withdraw cash. In order to access the PIN, the fraudster also installs a small camera at the ATM kiosk that can capture the ATM pin when it is entered by the cardholder.

Bankers say that while such frauds were more common in Southeast Asian countries such as China, Philippines, Taiwan and Indonesia among others, it is happening in India too. While customers can’t do much about this kind of fraud, a senior official with HDFC Bank said that customers should avoid visiting ATM machines that are not guarded as the fraudsters mostly target such ATM kiosks for planting skimming device and installing a camera.

While skimmers can also copy the magnetic information of the card at ATMs, they can also do it at petrol stations or merchant establishments where the customer hands over the card to them.

“The customer must ensure that the card doesn’t go beyond his eyesight so that any chance of skimming is avoided,” said the HDFC Bank official.

Another banking source said that in skimming frauds, normally the miscreants leave the skimming device planted at the machine for a few days and copy as many card details as they can and later conduct the unauthorised transactions using the cloned cards.

In the case of a skimming fraud, since the customer is not at fault and skimmers plant the device at the ATM machine, the banks generally take the liability onto themselves and refund the customer for the financial fraud. The customer, however, needs to block his card after the first instance of misuse.

Dos and Don’ts of ATM transactions

Do’s

* Conduct your ATM transactions in complete privacy, never let anyone see you entering your Personal Identification Number

(ATM Password)

* After completion of transaction ensure that welcome screen is displayed on ATM screen

* Ensure your current mobile number is registered with the bank so that you can get alerts for all your transactions

* Beware of suspicious movements of people around the ATM or strangers trying to engage you in conversation

* Do check if the card given to you by the merchant after completion of the transaction is your card

* Look for extra devices attached to the ATMs that may be put to capture your data

* Inform the bank if the ATM / Debit card is lost or stolen and immediately report if any unauthorised transaction

* Check the transaction alert SMSs and bank statements regularly

Don’ts

* Do not write your PIN on the card, memorise your PIN number

* Do not take help from strangers or handover your card to anyone for using it

* Do not disclose your PIN to anyone, including bank employees and family members

* Do not allow the card to go out of your sight when you are making a payment

* Avoid speaking on the mobile phone while you are transacting