Using an ATM to Loot a Bank Account

How would one go about this? Yesterday, we received a call from our bank, advising us of suspicious activity in our business bank account. We pulled up the account on the computer and watched the balance draining away. We told the bank to freeze the account immediately and headed to our local bank, but by that time a tidy sum had slipped away.

The funds were being withdrawn from a series of ATM machines in New York via debit card. (We're in North Carolina.) The bank officer wanted to know how long the card had been missing, and who had the business account PIN number. The answer was: the card is not missing, and absolutely no one has that PIN.

The bank contacted their investigative division, who asked the same question. When they received the same answer, they seemed stymied. The investigator said, "but the person is using your debit card, and has your PIN. Unless the person had physical access to your card, and knew your PIN, this shouldn't be possible."

Frankly, it sounded a bit like the movie Terminator 2, when the boy used a laptop connected to a card to randomly generate numbers until he hit upon a valid combination, and withdrew cash from the ATM. Does anyone know if this Hollywood hooyah is technically possible?

A one dollar "Refund Card Activity Fee" popped up on our account, and within a couple of hours, the withdrawal activity started.

If one of you more technically savvy Monkeys had the desire to be larcenous, how would you accomplish this?

 

I have heard of PIN and card readers that can be installed on point of sale machines and ATMs that can capture the card info and PIN...though I have no personal experience and am somewhat technologically challenged myself.

 

I have had this happen a few times. If you card is used as credit you can dispute the charge. If you use the card as debit or someone else allot of the time the bank will not refund your money. Keep an eye on your account if you see a charge for a few cents it's a fishing scam to see if you have a validate account.

Jason

 

"but the person is using your debit card, and has your PIN. Unless the person had physical access to your card, and knew your PIN, this shouldn't be possible"

As far as I understand the technology if someone clones your card and knows your PIN then it's open season. I believe this is why in the UK and other countries they've opted a 'chip and pin' system that isn't reliant on just the magnetic strip on the card.

"Poke a fish in the eye with a stick and you will upset the fish, usually."

 

Good information. Thank you all. I hadn't considered that the PIN may have been harvested locally at a point of purchase, and sold. I'm bothered that the bank hadn't considered the possibility either. It's okay for me to be ignorant concerning bank fraud. One would think that they would keep abreast of such. Now, I'll be wondering which of my local merchants may be selling more than their merchandise.

Anyway, the bank has agreed to refund the money taken. That card and PIN have been deactivated, and all's well that ends well for now. Thanks again for the responses.

 

I'm still curious about what part the "Refund Card" played in the system. I had never heard of a "Refund Card." I did a search on them, and they seem to be a form of debit card widely used by colleges to refund tuition payments to students. I wonder if there is something about them that makes them particularly useful for this type of fraud.

 

There have been cases of card readers and cameras being placed at ATM machines in such a way that the card info and the pin number are collected at the same time.... particularlly in the NE (NY, Boston, Philly,....)It was only a matter of time until they headed south....

 

The ATM machine has built in cameras as well. it is recording as it is being used. the new cards are being chipped as well, hold your card to the light and look for an imperfection in the finish. if you have a small imperfection, about the size of a pencil erasure, it is most likely chipped. Powdered graphite (a dry lubricant for locks) sprayed on the key pad will show what numbers you used. (drastically cutting down the number of possible codes) by the numbers cleared by your touch. And I have read about cloned cards. only the mag strip needs to be in the right place, and carry the right coding. a cardboard card with the strip affixed will work, but the strip must be programmed, and I don't know how that part is done.