Q. You answered a reader’s letter (Questions of Cash, 11 May) on a fraud committed at an HBOS ATM, where a ‘skimming device’ was fitted to the front of the machine. The victim was obviously unaware of this, but apparently a subsequent customer was as they reported it to the branch when it reopened after the weekend. I have no idea what to look for and many other readers will be similarly uninformed. Please enlighten us! IM, by email.
A. Devices attached to the front of ATMs are almost impossible to detect, which is why customers can be easily caught out. We do not know how one of HBOS’s customers did spot the device in this instance, or why they only chose to report it in the branch after the weekend, rather than phoning HBOS to warn it during the weekend. We are told by Financial Fraud Action UK – which speaks on behalf of the industry – that on this occasion the device used was probably not a skimming device, but a card entrapment device.
Its spokeswoman explains: “If your card is skimmed then the criminal needs to connect his device to a laptop, review the PINs from his camera bar and make up counterfeit cards. The counterfeit cards are then usually used in a non-EMV environment. [‘EMV’ stands for Europay, Mastercard and Visa – market leaders in debit and credit card technology.] Cards trapped inside ATMs by criminals are almost always used at a nearby ATM immediately afterwards. It is not uncommon for the term ‘skimming’ to be incorrectly used for other forms of ATM crime.”
Card entrapment devices are “virtually impossible” for a customer to detect. The FFAUK spokeswoman continues: “A device is glued into the card throat of the ATM. The current card trap normally utilises a piece of retractable tape measure and a razor blade. The razor blade holds onto the embossing on the card preventing it from being returned to the customer. A camera is also used with this device in order to capture the customer’s PIN. A customer puts their card into the ATM and enters their PIN. They then select the amount of cash they wish to withdraw and wait for their card to be returned. The device prevents the card from being returned and eventually the machine shuts down and the customer walks away. The criminal or his accomplice, who will be waiting nearby, will then return to the machine, prise out their device with the customer’s card and take down the camera. They will then review the camera to obtain the PIN and now they have the customer’s card and their PIN. The first thing they will then do is to carry out a balance enquiry at a nearby ATM followed by the maximum withdrawal.”
The news is not much better with an actual skimming device. The spokeswoman explains: “Card skimming is the term used to describe the fitting of an electronic device to an ATM normally attached to the card throat in order to capture bank card data from the magnetic stripe of the card. The device will either be fitted on the outside of the machine, in a housing made to replicate part of the actual machine, or inside the ATM itself. The devices are often fairly sophisticated, well made and very difficult to spot just by looking at the ATM itself. They can be attached to the ATM for some time depending on the battery life and size of the memory. Once in place, the device will potentially capture large numbers of card data.
“Criminals will also fit a camera, in conjunction with the skimming device, in order to capture the customer’s PIN. This camera is often a mobile phone set, recording video footage and placed inside some housing with the lens looking through a pin hole. The housing of the camera is also made to look part like part of the machine and also often difficult to spot. The camera is normally placed above the PIN pad looking directly down onto it.”
The advice from FFAUK is not to look for devices, but instead to focus on shielding the PIN. Devices are very difficult to detect and taking action to remove a device could put the customer at risk from the nearby fraudsters, who may be ruthless in recovering a removed device. FFARUK adds that customers should always carry the 24 hour phone number of their card issuer to enable them to report the retention of a card – remembering, of course, that these numbers are on the card that they would no longer have in their possession.
Q. Three years ago, I ordered a mobile phone from 3. After a week the phone had not arrived, I phoned them, was told it had not yet been despatched and so 3 agreed to cancel my order. I later found a card at home saying the phone was at my local Post Office awaiting collection. I phoned 3 to remind them I had cancelled the order, but 3 continued collecting payments from my account for 10 months. After repeated phone calls 3 stopped collecting the money and told me to recover the funds from a bank indemnity claim, which I did. I was promised by 3 that this was the end of the matter. But now debt collection agency Lowell is seeking to recover these funds, a total of £229.38. JO, London.
A. Lowell ceased debt recovery action as soon as they became aware of the situation. A spokeswoman for Lowell says: “We bought this account from Three Mobile in January in good faith as a valid debt requiring repayment and wrote to [the reader] thereafter. Three Mobile have now confirmed that the account has been closed. Three have also made a goodwill gesture payment.” We asked 3 for a comment, but its spokeswoman would only say: “Three has resolved the issue with the customer.” You tell us that 3 has agreed to pay you £100 compensation and ensure that your credit status is unaffected.