As I was walking away from an ATM at Peppergrove Mall in Grahamstown, I heard a little voice behind me saying, “Hello my friend”.
As I was walking away from an ATM at Peppergrove Mall in Grahamstown, I heard a little voice behind me saying, “Hello my friend”.
I stopped and looked around, and a small, smiling, smartly-dressed gentleman approached me and said: “I'm sorry, my friend, I am looking for an international bank that accepts the Maestro card. I see you used that bank there (he points). Does that one accept the Maestro card?” Before I could answer he said, “Which card do you possess? Is it the Maestro, or Visa?”
One part of me was instantly suspicious and wanted to tell him to go away, while another part (obviously the foolish part), felt ever so slightly inclined to help this ‘poor traveler’ find out which bank to use. The foolish part of me won the day by reassuring me that ‘no-one can steal anything from you just by looking at your card’. So I took out my card to see if it was a Maestro or a Visa, turned it over, and we both looked at it for what seemed far too long for comfort before I put it back in my wallet again.
That encounter happened on Wednesday, and on Thursday night I awoke suddenly with the realisation that the little gentleman had actually had a very sinister look on his face, even though he was smiling – a bit like the joker on Batman. So on Friday morning I checked my bank balance on the internet and everything was fine. No money gone. So I forgot about the matter – until Tuesday afternoon.
I went to the same ATM machine in the early afternoon and, surprise surprise, I couldn’t draw any money because my daily limit had been exceeded. I immediately went to report the matter, and found that I had already been ‘relieved’ of R3500 (withdrawn within two days); and I have a limit of R1500 a day!
Apparently they are able to do this by drawing money out just before midnight and again just after midnight. I say ‘they’ because within the space of a few days my card had been duplicated and the money withdrawn from an ATM in Durban, so I reckon this was the work of a highly organised syndicate.
I have always been under the impression that my bank was a safe place to keep money. Not any more, especially after hearing other stories and reading about bank card fraud. What I don’t understand now is why banks in South Africa do not keep up with the technology to outwit fraudsters.
Where was the fraud detection software used in other countries, which picks up unusual withdrawal and spending patterns (R1000 lots, exceeding the limit around midnight, 800km away from where I tried to draw money with the ‘same card’ a few hours later)?
What I had the misfortune to experience is called ‘card skimming’. Apparently what happens is a fraudulent card stripe reader, cleverly disguised to look like normal ATM equipment, is mounted like a razor-thin glove over the ATM card slot.
This captures the contents of the card’s magnetic stripe, while a hidden micro-camera, placed either on or right next to the ATM, views the ATM monitor and the keypad, and can transmit wireless photos up to 200m away, so that scammers can ‘reside’ nearby in a car and receive PIN numbers and other information, at their leisure, from the equipment they install at the ATM. The fraudulent equipment is then removed and the data used to produce duplicate cards.
Lingering magnetic-stripe technology, rather than EMV chip standard used in Europe and elsewhere, is to blame, and our crime here in SA is just a migration of fraud from Europe, where most countries have converted to the EMV chip standard.
EMV, often referred to as smart-card technology, relies on an embedded micro-chip for the storage of data on a card, rather than storing that data on a magnetic-stripe, which has proven to be vulnerable to skimming because it is very easy to copy.
Before they changed to using micro-chip technology, the European banks found various ways of combating card skimming fraud. They invented ‘jitter technology’, which works via a stop start or ‘jitter’ motion inside the card drive, specifically designed to distort the magnetic stripe details should they be copied onto a foreign card reader inserted onto the ATM.
Jitter technology was popularized more than seven years ago, but I am not sure whether it has crossed any of our borders yet. I definitely didn’t feel my ATM machine ‘jittering’ when I drew money.
Radiofrequency jamming – which uses an electromagnetic field to detect foreign objects placed or mounted on an ATM, is also used; as well as camera surveillance, which can recognise when a foreign object is placed on or near an ATM.
Our banks are multi-billion rand institutions; why can’t they keep up with the rest of the world? The first thing I was offered by my bank was an sms service charging about 45 cents an sms to notify me each time I draw money.
Could it be more profitable for the banks to resign themselves to ATM fraud and pull in 45 cents extra for many thousands of withdrawals each day rather than investing their money in new ATM technology and forensic research to make our banking system safer?
And after three weeks I still haven’t heard any news about the ‘investigation’ into my money being stolen. How hard can it be for the bank to figure out that my card was duplicated; when I tried to draw money in Grahamstown a few hours after it had just been drawn in Durban, 800km away, with the ‘same card’?
I heard from a forensics policeman, but couldn’t find any examples on the internet, of a new type of technology which is the size of a matchbox but much thinner. The criminal holds this in the palm of his hand and can surreptitiously scan your card without you knowing. He still needs to hide a camera somewhere at the ATM to get your PIN number though.
Maybe that is what happened to me, because I still can’t figure out why the little man approached me – unless he just needed some extra information from the card to seal the deal?
So what do we do to save ourselves from being scammed? Be sensible (don’t follow your ‘foolish part’), familiarise yourself with pictures of card skimming devices, and maybe pretend to hit several buttons while you actually key in your code. I suppose the other option is to cover the keypad with your other hand while you enter your PIN number. And hope that our banks get rid of magnetic strip technology ASAP!
So if you go down to the bank today, be wary of any friendly, smart-looking gentlemen looking for international banks, or people who seem keen to take a glimpse of your card or help you in any way. If this happens, smile back at the scammer, walk away normally and call the first policeman or security guard in sight to arrest him.
The police will probably find the hidden camera and skimming equipment, either on him, or on the ATM, and will later be able to verify that it was he who placed it there, by means of the genuine ATM cameras or fingerprints.
