ATM fraud is the fastest-growing scam in the Republic - and it's not likely to go away. Conor Lally reports
Picture the scene. You've received your Christmas pay cheque and you venture out to begin shopping for presents. First port of call is the ATM machine. Suddenly the dreaded words appear on the screen: "Your account has insufficient funds to process this transaction."
There must be some mistake. You punch in a smaller amount, but with the same result. You slink away, confused and embarrassed. A frantic call to the bank reveals that in the few days since your November pay cheque landed in your account, your entire balance has been cleared out.
You've fallen victim to Ireland's fastest growing fraud: ATM card cloning.
In the first seven months of this year, an average of just one case of ATM fraud was reported each month. However, since the beginning of August that has jumped to two cases per day. Gangs involved in the lucrative crime have cleared more than €2 million out of the ATM accounts of unsuspecting consumers so far this year.
But the threat to your cash doesn't stop there. Your money is at risk every time you use your ATM, Laser or credit cards.
The technological advances that have given rise to so many convenient payment methods are now being used with devastating effect by highly organised and enterprising crime gangs. They are the pickpockets of the 21st century and they stole €9 million from ATM, Laser and credit cardholders and their banks last year.
Gardaí say that around 10 ATM fraud gangs have come to their attention this year. These gangs usually number between eight and 12 members.
They source parts of ATM machines by buying them over the internet or making them themselves. A panel containing a keyboard pad is then placed over the ATM's existing keyboard panel. A small skimming device will be included in this panel and sits over the slot where a card is inserted into the ATM. This equipment also has the same characteristics, including colour and font-type on the keyboard, as a genuine machine, making it impossible to detect with the naked eye.
When an ATM card is put into the doctored ATM the user's transaction will be processed as usual. However, unknown to the cardholder, all of the details contained on the magnetic strip on the back of the card will be saved on the gang's skimmer. This means the ATM card can be cloned.
The only remaining detail needed by the gang is your pin number. This can be obtained in two ways. Firstly, a gang member can take up a position in the queue behind you and look over your shoulder as you punch in your pin. This process is called "shoulder-surfing".
Secondly, small cameras can be hidden in a square hollow pipe, or conduit, which will be glued to the section of the ATM cavity directly above the keyboard. A hole will be drilled in the conduit, through which the camera can film pin numbers being entered. The footage is broadcast from the camera to a laptop computer in a waiting vehicle close by.
The skimmed information is then cloned on to blank cards. This is a relatively simple process for those with access to a computer and technological know-how. Cards are then used to withdraw as much money as possible from a victim's account.
Garda sources told The Irish Times that around €2 million has been stolen in this way so far this year. One financial institution lost €50,000 in one week.
THOSE INVOLVED HAVE targeted machines throughout the State. Machines in affluent south Dublin suburbs such as Killiney and Dalkey have been worst affected. Gardaí believe some gangs come from the UK by ferry, target a number of machines close to Dún Laoghaire port and then quickly leave. Cloned cards can then be used at UK ATMs to empty bank accounts held in Ireland.
Gang members have used a card to get a monthly bank statement printout in a bank branch. From this they can see when, and how much, a cardholder is paid each month. They will then withdraw the maximum they can before midnight on payday, and again just after midnight, withdraw another maximum amount. The average sum taken from a targeted bank account is €1,200.
The Irish Payment Services Organisation (Ipso), along with the financial institutions, follows trends on card crime. It says ATM fraud is the fastest-growing payment scam in the Republic at present, representing 50 per cent of all card fraud.
Another popular ATM fraud is the more primitive "Lebanese loop". This is a small plastic device pushed into the card slot of an ATM. Once a card is inserted it becomes jammed and the card-user believes the machine has swallowed it. However, fraudsters retrieve the card by simply pulling a small piece of the loop protruding from the card slot . Criminals using this method usually obtain pin numbers by "shoulder-surfing".
Una Dillon, Ipso's head of card services and communications, says consumers using ATM, Laser or credit cards this Christmas need to be vigilant, not just at ATMs but every time they use any payment card.
"You can buy a small hand-held skimmer device which can be used to copy credit card details by skimming the card through it, allowing for the cloning of cards," she says. Such devices can store information on 10,000 cards. Often the person skimming the cards will sell the information to a criminal gang. A small white button on a skimmer can erase all the information saved, making it easy for fraudsters to hide their activities if approached by gardaí.
Cloned credit cards can be used in-store or, in fraud known as "card not present", to buy goods over the telephone or on the internet for delivery or collection.
A credit card number gleaned from a discarded receipt can also be used to carry out "card not present" fraud. Many cards are used fraudulently on websites, where significant sums can be spent very quickly. The most popular purchases are airline tickets, laptop computers and sports goods. Cards have also been used on gambling sites where an entire credit limit can be lost in seconds on one bet.
AS WITH ATM fraud, losses incurred by those who own credit cards are not always met by financial institutions. A cardholder is often dependent on the goodwill of the financial institution to absorb the loss.
Both Dillon and her colleague, Jennifer Chamberline, know of cases where criminals have cloned credit cards and also obtained false passports, on illicit websites, in a victim's name. One Irish woman this week lost €22,000 when a fraudster made several withdrawals from her bank using a forged passport.
Once a passport is obtained a victim's entire identity can be stolen, says Chamberline. "They could open a bank account and apply for everything from a credit card to a mortgage," she says. "Some will get several credit cards in the name of a victim. Once they have spent some of the funds on one card, they will transfer the balance from another to pay it off. They build up goodwill in this way."
Criminals posing as cleaners in apartment blocks have also stolen identities. Other criminals raid rubbish bins in pursuit of letters from financial institutions, bank account numbers and other details.
"You can buy a shredder for €15, so that may be money well spent," said Dillon. "People should also check their bank statements regularly for any unusual transactions. You could also contact the Irish Credit Bureau and buy your own credit rating profile. This will identify any bad debts that have been left behind. Identity theft can be very costly in that it can seriously impact your credit rating. It may take years to repair."
Go Figure
€9 million The total stolen from ATM, Laser and credit cardholders last year
€2 million The amount cleared out of the accounts of unsuspecting ATM customers so far this year
€1,200 The average amount taken by fraudsters from a targeted bank account
10,000 The number of cards whose data a standard skimming device can store
€15 The price of a shredder, which might be money well spent