Fake ATM Fraud Expose

santos_douglas writes "Forget ATMs coming under attack by worms, MSNBC has this article about Dateline NBC's investigative report into fake ATMs and other ATM related scams. ATM frauds are a clever combination of social engineering and hardware hacking. The most sophisticated thefts involve the purchase and setup of real ATMs that actually do dispense cash to avoid suspicion, but are altered to save both the card's magnetic signature and the customers PIN, which are later added to false cards and used to empty bank accounts at real ATMS. The 'ATM gang' profiled managed to purchase and setup 50+ machines and steal over $4 million from over 21,000 customers. The machines can be purchased legitimately and hooked into the banking network with no more than a regular bank account. Less sophisticated attacks include building and attaching false fronts to existing ATMs to collect info, and using covert cameras to collect PINs from afar. The articles has some handy tips for avoiding scams."

Comments

Two tips

[tomstdenis]

Use banks you trust and use ATMs [or ABMs as they are called in Canada] at banks you know and trust . I'd never use a whitelabel ABM since not only do you get a surcharge but it's very easy for it to be a fake.

This isn't foolproof but much safer than using random whitelabels you find in Apu's Mealbar.

Tom

Re:Two tips

[ergo98]

A scam that recently was in the news here in Ontario is gangs that put false fronts on ATMs. The faux-fronts contain a camera over the keypad and a magnetic reader on the card reader. These were found on bank machines of the big 5 banks (BMO, TD, RBC, Scotia, and CIBC). So the moral of the story is that even if you stick to the "name-brand" bank machines, you still might get scammed. Personally I'm astounded at the intricacy involved in someone putting fake-fronts on big bank bank machines (don't these things have cameras and some sort of security? How did someone pull up and pull that off?), though I guess that's the extent that organized crime can go.

BTW: Most Canadians I know call them ATMs.

Re:Two tips

[temojen]

Count me as annother Canadian who knows noone who refers to them as ABMs.

Also, most of the chartered banks now charge a surcharge in addition to the interac fee if you don't have a card from that bank.

Re:Two tips

[Jucius Maximus]

Me: "If it's a 'white label' machine that's not operated by a bank, then it's an ABM."

You: "Anti-Bank-Missile???"

Quite the opposite. The White Label ABM business means that big banks make money. Here's How: Canada's biggest bank and one of the top 10 in North America, the RBC Financial group (formerly Royal Bank) co-owns one of the white-label ABM companies!

So let's say I am a Royal Bank customer. (This was true up until a short time ago.) Royal bank gets my money in their account and pays me less than a dollar in interest per year. And then I go to a white label machine, pay the $1.50 disloyalty fee which goes straight to RBC, pay the ABM fee to the white label company (which RBC co-owns) and then I don't use up the receipt-paper, evelopes, cause wear and tear, etc. on Royal's own machines. It's a good deal for RBC and a bad deal for me.

The bottom line is that my bank makes more money if I go to the white label machines! Even if I go to another bank's machines, I am paying Royal's disloyalty fee and making them extra money. (I pay no fee if I use Royal's own machines.)

And a note for Canadians: If you are tired of stupid bank fees and low interest rates on your balances, consider President's Choice Financial. I am a satisfied customer and do not work for them. Sure, it's owned by CIBC but I've never paid a cent in fees, I get free internet banking, free phone banking, free chequebooks, free Interac at CIBC machines, the 'points' rewards are worthwhile and attainable, and the interest rates are decent. (There are some minor downsides like spotty support for ATMs outside Canada, and most depoits over $200 except auto-payroll are delayed for 5 days so they can make interest on it. I can live with it.)

Re:Two tips

[fireman sam]

Two other tips:

1. An ATM is commonly referred to as an ATM machine
and
2. A PIN is commonly referred to as a PIN number

So we have to enter out personal identification number number into the automatic teller machine machine.

Re:Two tips

[SYFer]

While the tired old ad is indeed redundant, the signal-checking procedure it portrays is certainly not. Note also that they are careful to have him say "good" after each query--otherwise his repetition and movment would indicate that the Sprint connection truly sucks.

While the tired old ad is indeed redundant, the signal-checking procedure it portrays is certainly not. Note also that they are careful to have him say "good" after each query--otherwise his repetition and movment would indicate that the Sprint connection truly sucks.

Re:Two tips

[Bombcar]

If you like that, then you'll love The La Brea Tar Pits, which when translated is: The The Tar Tar Pits!

Re:Two tips

[Ed Avis]

The problem is that the information you give to authorize one transaction - your card number and PIN - is the same as needed to authorize _any_ transaction.

You could have a different PIN for small amounts and large amounts, being limited to one 'small' withdrawal per day, and that would slightly reduce the potential for fraud. But people would tend to forget the numbers. You could have a booklet printed with a list of one-use-only identification numbers; then someone would have to steal the booklet rather than just copy one number you typed in.

But with mobile phones being so common, can't we use those for security? You type into your phone the amount to withdraw and a PIN (which is held only in the phone itself), and it generates an authorization code signed with your private key (again held only in the phone). You type this code into the ATM, it checks the code using your public key and takes it as an authorization to withdraw *one* particular amount at *one* date and time. Rekeying the same authorization code later will not work since it includes the date and time (with say a five minute window between generating the number on your phone and it expiring), and as an additional safeguard the bank records previously-seen codes and won't accept them again.

Then even if you use a completely bogus ATM that records everything you type in, the worst that could happen is for someone to rush over to a real ATM and type in the same code to get the money - and it would be obvious something was wrong if the fake ATM didn't dispense exactly the same amount.

Re:Two tips

[EinarH]

Here is a picture of a security guy with the fake front in his right hand and the small camera in his left.

Looks like an integrated part of the ATM unless you are familiar with that ATM.

Re:Two tips

[anthony_dipierro]

The transition is already being made, but the hold up is getting the machines upgraded/replaced.

Not to mention the $5/card. Is it really worth the additional expense? I doubt this type of ATM fraud is costing the industry $5 per ATM card.

The best thing you can do right now is go through the hassle of transferring money between accounts (only have an ATM card for one account on you at a time) and transfer money between them. That is unless you want to use a credit card, and just pay it via check every month instead... I don't think you can be held liable for fraud on CCs, or at least you won't if you get the right contract.

You're not liable for fraud on ATM cards either. I transfer money between accounts, but only because my account with the ATM card doesn't let me buy stock. If I could get an ATM card for my Ameritrade account, you better believe I would.

I try to avoid them altogether.

[Meat Blaster]

There's very little about ATMs nowadays to inspire confidence. It used to be that you'd stop by a trusted location to use one (like the bank) but now they're virtually everywhere and aren't always set up by trustworthy entities.

If they integrated some other forms of identification that couldn't be forged, such as biometrics or retinal scans, perhaps I'd be a bit less worried. But as things stand now credit cards are a better way to go if you're worried about recovering losses from fraud.

Re:I try to avoid them altogether.

[Ignis Flatus]

If they integrated some other forms of identification that couldn't be forged, such as biometrics or retinal scans, perhaps I'd be a bit less worried.

What difference will biometrics make if some criminal has installed a modified machine to intercept and record your biometric data?

Re:I try to avoid them altogether.

[segmond]

That is even more worrisome, you can change your pin, but good luck trying to change your finger print or retina scan data.

Re:I try to avoid them altogether.

[quantaman]

If they integrated some other forms of identification that couldn't be forged, such as biometrics or retinal scans, perhaps I'd be a bit less worried. But as things stand now credit cards are a better way to go if you're worried about recovering losses from fraud.

Or a public/private key system. Say when you get your card there is some randomish value on some part of the strip that when it is decryped against the key that the ABM/ATM has they will report a value that the bank gave you when you got your card, say "BLUE" (easy enough to remember). Now when ever you use an ABM/ATM you can know it will be authentic because it will say BLUE, if an ABM says your card is RED then you call the bank to report the erroneous machine which may mean an untrustmorthy machine or the bank has changed the key. The key is changed if some crackers ever find it out then the banks will have to go to all the machines and put in a new key, they'll also have to tell everyone what their new colour is which will be a hassle but hopefully shouldn't happen with any kind of frequency if they choose a good key and have good security procedures.

Re:I try to avoid them altogether.

[Imperator]

Because it's easy to make a fake card and use a stolen 4-digit PIN, but it's hard to make a fake retina.

Re:I try to avoid them altogether.

[wampus]

SPECTRE did it in Never Say Never Again! And then they killed the poor bastard with a snake! But good old 007 fucked the murderess and then killed her!

Re:I try to avoid them altogether.

[anthony_dipierro]

You could disconnect the camera and plug it into your recording

You might as well just break into the ATM itself at that point.

or (possibly, I'm not sure) put a printed copy in front of the camera.

I'm not sure it's *that* easy, but the current technology does make fake retinas possible. Eventually (and maybe even now with the most expensive technology), this won't be possible, though (short of building a clone, anyway).

A much cheaper solution that's available today is to have some processing power built into the card itself. When I worked for Hewlett Packard we had to use these to log into the private network from home. A new password is generated every 60 seconds, so an attack like that described in this article would be useless. Of course this particular device isn't the best solution for an ATM, but something based on the same underlying technology would be. Or perhaps better yet, a public key system.

Re:I try to avoid them altogether.

[Anonymous Coward]

To get money out of your account, they would need to be you for one. Secondly, when the crook shows up at an ATM, you can immediatly identify that they are a crook and who the crook is.

Look idiot, think a little. Using a ATM, they record your biometric data (retinal, fingerprint, whatever) and allow your transaction to go through and record the info. Later, they replay the transaction electronically and rob you.

How do you think biometrics work? They scan you and convert the information into a long number or identifier. Then they compare that number with the number they have on file. If the two match (or are reasonably close) then the ATM thinks it is you. If you have an ATM (or can connect to the ATM system) you can enter the mag-stripe data, the pin, and the biometric info directly. And as others have pointed out, you can be issued a new card & pin, but biometric info is yours forever.

The ATM problem is one of the platform. Originally, ATMs were only owned by responsible people who don't (normally) rob you, i.e. banks. But now, any idiot can have one. How can you trust the machine run by someone you don't know?

If you check your hotmail account at a webcafe, your password is protected from sniffing by SSL, but how do you know the webcafe doesn't have a keylogger running? You don't. You can't trust the platform. Same thing with an ATM.

Re:I try to avoid them altogether.

[santos_douglas]

True, but with one qualifier. The law treats these losses quite differently, with the rules being slightly more lenient for credit cards. See:

http://www.ftc.gov/bcp/conline/pubs/credit/atmcard .htm

It is important to report this as soon as possible, or else your exposure rises. In the case of ATM fraud like this, it is very unlikely the people would report the theft before the cards were used since they had no idea the info was stolen. Plus, from a purely beuracratic standpoint, it is more difficult to convince a retail bank that you are not liable vs a credit card company.

Re:I try to avoid them altogether.

[sfm]

There are other ways an ATM can make your life miserable...... read on..

Once, about two years ago, I was shopping for Valentines Day gifts in a local market. The store had an ATM (and banking center) inside so I thought nothing of using their ATM for cash. As it turned out, one of the $20's that came from the ATM was counterfeit and the store clerk flagged it. Okay, so now it gets weird.....

I went immediately back to the banking center inside the store and told them what happened thinking I would be able to trade out the bad $20 for a good one. WRONG, WRONG, WRONG !!! Not only did they NOT replace the bill, but they forced me to fill out 3 pages of documentation on what happened, which was sent to the treasury department and was told to expect a call form them in a few weeks. And remember, the counterfeit $20 came from their machine.

Luckily, I was never contacted by the treasury dept or the FBI, but I am still out $20. Chalk it up to experience ?? I'll say one thing, I will never deal with "Union Bank of California" again.

Re:I try to avoid them altogether.

[ffsnjb]

VISA branded debit cards (maybe MC ones too, I don't have experience with them) in an effort to be friendly and accepted everywhere act as a credit card unless you've specified to use the debit option.

One track of the card has the CC number linked to the primary account, another has a checking account number, and a third has a savings account number. I forget the order as I haven't had access to a magstripe reader/writer since I left my sysadmin job at college (used for the student IDs). It was nice to clone my debit card when the real one got trashed by a minimum wage counter-jockey who snapped it down the magstripe while swiping the card. BTW, the account info is plaintext on the card, if you know your account numbers, you can clone a card without actually having it available.

Next time you go to the gas pumps, select the credit option with your debit card. It won't prompt you for your PIN. It will, if you select the debit option.

I'm guessing its a legacy holdover, it would be nice if PIN usage was required on CC transactions. I think its sad that the local CompUSA here still uses the imprint machines to do CC transactions. Legacy always wins in business...

Re:I try to avoid them altogether.

[smallfeet]

You could print a picture of a persons eye on a contact lens like film. Pop it in your eye and presto, instance bio-metric. All you would need is a good shot of their eye.

Should work, but what do I know.

Re:I try to avoid them altogether.

[ericspinder]

These ATM scams work so well because they are able to use legit ATMs to collect the money. You could crack into a live ATM in order to upload your fake data, but while you got it open why not just grab the cash directly. There is the posibility of using some kind of device which interfaces with the machine on a directly physical level. Something that could send a fake stream to the scanner itself, but I haven't seen anything like that yet. However once you start to see boimetric scanners, I'll bet that you'll start seeing upload devices.

• Great security is keeping 2 steps ahead of the crooks
• Good security is keeping 1 step ahead, and
• Average security sometimes a little ahead and sometimes a little behind.

Most systems only have the budget for average security.

Re:I try to avoid them altogether.

[mkldev]

It takes less than a dollar worth of materials and a matter of seconds to capture a fingerprint off of... pretty much anything. Voice identification can be captured with a tape recorder just as quickly. With the exception of retina scans, biometrics add a trivial amount of protection, and frankly, I don't want anything resembling a laser anywhere near my eyes.

What I want to see is something that reads neruoelectric signatures. For the initial version, you'd think about your favorite food while leaning your head against a sensor pad. Of course, that could be captured, but that's just phase 1.

Phase 2 is to look at am image shown on the screen. When you sign up for an account, they'd do this once and store the neural impulses generated. From then on, they would show you the image and send the neural signature to the bank. The bank would compare the results and authorize the transaction, and would send a new image to display. You would see the second image, and the neural impulses generated by this second image would be sent back to the bank to store for the next time you tried to make a transaction.

The key requirements are that each transaction could require confirming the neural signature generated by any one or several of the prior images and the images sent for generating new signatures must be taken from a large enough database to get a high degree of variation. Finally, there must be expiration for old images, as one would expect one's reaction to an image to drift over time. Thus, an account unused in 90 days would be frozen until in-person verification could take place.

In such a case, in the unlikely event that someone were able to steal access to someone's account by taking enough prior neural signatures, they would still have to generate a new neural signature for the new image, which would mean that either it would be completely fictitious (which could probably be detected), a copy of some prior signature (which would definitely be detected and an alarm would sound), or would be the signature generated by the criminal, which could then be used as positive identification once that person gets caught.

Sound like fun? :-)

Re:I try to avoid them altogether.

[LocoSpitz]

Grab the raw data from the scanner and store it. Then when you're clearing out the account, just feed this raw data to the server. If someone is willing to purchase an ATM and mod it to grab PINs, forcing them to mod it to grab data from a retinal scanner instead is not going to stop them from running their scam.

Re:I try to avoid them altogether.

[wolfb]

Biometrics won't change the difficulty of electronic attacks, where the biometric signature is copied as easily as your pin number. Biometrics might make physical attacks more difficult, but still not impossible. Time and time again it is shown that biometric systems do not live up to hype. Sometimes they can be easily fooled, and sometimes the biometric signature can be used to reconstruct an acceptable fake. You can count on someone figuring out how to explit any given system sooner or later. How will you restore your security then? Can you get new fingerprints, or new eyeballs?

Re:I try to avoid them altogether.

[McAddress]

f I'm not mistaken, they're mostly visual, so you just need something that looks like a retina -- and the machine isn't going to complain if you're holding up your "eye" to the censor as opposed to leaning down to it.

all you have to do is put your eye against the glass of a copy machine ....

Yipes!

[xeno_gearz]

Talk about the ultimate in social engineering! Perhaps the best piece of advice in the article was "Keep a watchful eye on your monthly statement, as well as your balance, and report any problems to your bank." This may seem obvious but with people buying legitimate ATM's and stealing your PIN while legitimately providing your money what much else can you do?

Perhaps I should just go to the barter system. "I'll give you this cow for that rack mounted server."

Re:Yipes!

[sugar and acid]

>"I'll give you this cow for that rack mounted server."
Throw in a pig and your daughter and you have a deal!

Aumm, so where am I safe?

[Pavan_Gupta]

So, basically in the end, anything they do to protect me, and anything I do to protect myself (short of becoming a hermit and leaving society altogether) will still leave me wide open to identity to theft. I guess I could enter a bunch of wrong PINS in the ATM.. but then the ATM would eat up my card. Maybe I could covermyself in a black trashbag and cover the front of the ATM with it, but then the bank will be like: WTF. Hell, the thieves have already installed false fronts on the ATMs, so what choice do I have?

I guess I could start using paypal. I mean, they're safe? They probably don't have evil workers at paypal enjoying a quick id. theft, I hope? Maybe, I could just start using cash again, but where I live I'll get mugged. Shoot, if I carry cash, I've even got the possiblity of washing my pants with my money in it. That's worse than having my idenitiy stolen. Seriously .. I hate it when my leather wallet starts to rot.

Screw it. I'll be a hermit.

Re:Aumm, so where am I safe?

[a1cypher]

I guess I could enter a bunch of wrong PINS in the ATM.. but then the ATM would eat up my card.

Theres an idea for a scam.. Setup a fake ATM machine that will take your card, and ask you to enter the pin three times. After the client enters the same pin number three times (the legit code of course), then it eats the card. No need to make a duplicate when you can use the origional.

Re:Aumm, so where am I safe?

[ffsnjb]

They did just that on Court TV's Safety Challenge Holiday Alert last night...

Re:Aumm, so where am I safe?

[blowdart]

I know you were kidding, but there have been scams in the UK that did exactly that. The BBC reported on it a while back.

"They began by using "Lebanese loops" - home-made devices which make the customer think the machine has swallowed the card, only for the crooks to nab them after the victim has walked off. But they have moved on to card skimmers - fake devices which are taped onto the doors of cash machine foyers - and card slot readers."

It used to be you had to press a button to get into the lobby out of hours. Then the homless started sleeping in the lobbys, so the banks replaced the button with a card reader. Now they're having to go back to buttons again.

Re:Aumm, so where am I safe?

[anethema]

Ohhh yeah, Paypal is REAL safe

This is hardly new

[Kirill Lokshin]

ATM fraud like this has been reported at least since 1988. Ross Anderson presented this at a conference in 1993 Why Cryptosystems Fail mentioning that:

The fastest growing modus operandi is to use false terminals to collect customer card and PIN data. Attacks of this kind were first reported from the USA in 1988; there, crooks built a vending machine which would accept any card and PIN, and dispense a packet of cigarettes. They put their invention in a shopping mall, and harvested PINs and magnetic strip data by modem... in 1992, criminals set up a market stall in High Wycombe, England, and customers who wished to pay for goods by credit card were asked to swipe the card and enter the PIN at a terminal which was in fact hooked up to a PC.

This is really more of a problem with the lack of attention to such security issues on the part of banks than a new type of crime.

Article Highlight

[Anonymous Coward]

Best part in the entire article:

The U.S. Secret Service says the following people are wanted for questioning in connection with the $4 million ATM heist described in Dateline's story:

Bella Magary
Hungarian white male, blond hair, 5'6", with medium build, aka Bill Gates, personal ties to California.

ATMs becoming less useful

[doormat]

As fraud has increased, I've resorted to using only ATMs at the various branches of the bank I'm with, and I've switched (back) to using credit cards instead of debit cards for point-of-service purchases, so that if I get defrauded, I end up with a huge CC bill (relatively) instead of an empty bank account.

Who needs ATMs anymore?

[wowbagger]

With every bank trying to screw you for using any ATMs other than theirs, and with the level of acceptance of credit cards nowadays, who needs ATMs anymore?

It used to be that when I travelled, I carried a fair amount of cash with me. Not anymore - I simply find that I don't need it - gas, food, lodging, all are put on the credit card.

Furthurmore, should I feel the need for cash, my local grocery store allows me to get cash back from a credit card purchase. I simply make a habit of getting $40 back when I buy groceries, and then keeping about $200 at the house. Thus, I rarely if ever need an ATM under normal conditions.

It is pretty stupid - I am sure running an ATM costs a bank far less than paying for a teller, but they seem bound and determined to drive us all away from using ATMs.

Re:Who needs ATMs anymore?

[meta-monkey]

I don't think anybody's trying to screw you there, chief. Nobody puts a gun to your head and makes you use their ATM (well, they might...I didn't actually read the article, so I don't know how violent these gangs get :) ).

• Your bank publishes the charges for using an ATM outside their network, and
  
• an ATM you use will tell you the fee for using that ATM
  

I don't know why people are so pissed off about ATM fees. What, do you think the ATM fairy just drops them off all over the place for free? The machine costs money. The network costs money. Service costs money. TANSTAAFL. If you don't want to pay the fees, don't use an ATM. Like you said, there are plenty of other methods.

Re:Who needs ATMs anymore?

[ottffssent]

I don't know why people are so pissed off about ATM fees. What, do you think the ATM fairy just drops them off all over the place for free?

No, I think the HR fairy drops them off all over the place. She says "Here you go! Tons cheaper than a real person. Enjoy!" and wanders off to do another good deed.

Re:Who needs ATMs anymore?

[dachshund]

I don't know why people are so pissed off about ATM fees. What, do you think the ATM fairy just drops them off all over the place for free? The machine costs money. The network costs money.

ATM machines are certainly not free, but they are a damned sight less expensive than the human-operated branches that banks used to provide for their customers (at no charge). In fact, cost-cutting is one of the reasons banks have consistently offered when replacing branches with ATMs. What any consumer with a brain should notice is that over the past decade or two, banks have continuously reduced their operating costs thanks to ATMs, and yet the amount of money customers tend to shell out for banking services has not decreased-- it has consistently risen. ATM fees are a big part of that.

The existence of ATM fees is due to the lack of reciprocal agreements among different banks. If bank A has thousands of machines, and wishes to provide better service for its customers, it stands to reason that it would try to enter into an agreement with another large bank B, in order to guarantee that neither banks' customers have to pay fees at ATMs belonging to either bank.

Unfortunately, experience has indicated that banks don't feel any desire to do this. In the real world, it is far more profitable for large banks to collude against their own customers through inaction-- by not creating reciprocal agreements, and collecting vast amounts of additional money through fees. This pads their bottom lines, and hey, what are customers going to do about it? There are only a few banks large enough to make such collaboration practical, and they don't seem too concerned about how much customers are paying (fees continue to rise, way ahead of inflation, despite the fact that the tech is getting cheaper.)

A similar situation exists in the world of wireless communications, where international phone companies ruthlessly assess other companies' customers absurd international roaming fees, even when the caller is only a few hundred miles from his home country. The income these corporations derive from fleecing their customers is far greater than what they would make if they chose to collaborate; since only a few companies are large enough to make this sort of agreement, and those companies make too much money off of the current arrangement, customers have nowhere to go.

Tijuana

[LittleLebowskiUrbanA]

A couple of my troops have ran into these fake ATMs in Tijuana. The fake ATMs have been there at least a couple of years from hearsay. Nasty place.

Re:Tijuana

[Ralph Wiggam]

Are you saying that something illegal is going on in Tijuana? No way. I don't buy it.

-B

Old news... But still rampant!

[node159]

Here in New Zealand we have major bank monopoly which results in 4 banks owning the market, with very excessive charges. But as a result ATM fraud is virtualy non-existant. But internet banking fraud is at an all time high. Go figure.

On another note, this is old news and has been around for years but it suprising its still so rampant, I guess the banks must be putting most of the cost on the customers as is indicitave of their inaction.

Re:Old news... But still rampant!

[Qrlx]

Here in New Zealand we have major bank monopoly which results in 4 banks owning the market, with very excessive charges. But as a result ATM fraud is virtualy non-existant.

Sounds like the bank monopoly is ripping you off, though. Technically I suppose it's not fraud, but you're still getting scammed, right. It's just a scam that the law smiles upon :)

Re:Old news... But still rampant!

[KiwiSurfer]

Its possible not to pay any ATM fees, if you are with a bank that has agreements with other banks to use their ATMs for free. For example, customers of The National Bank have been able to use ASB Bank and TSB Bank ATMs for free for many years now. The customers of the TSB and ASB banks also have free access to National Bank's ATMs.

The ANZ Bank rectently purchased the National Bank from its British owner, Lloyds TSB, and now ANZ and National Bank customers can access both National/ANZ ATMs for free. This came into effect only a week ago -- December 1st.

Nowdays the only banks that chages a fee for using any other bank's ATM are Westpac, Bank of New Zealand and some other smaller banks. The ANZ/ASB/National/TSB banks all allow their customers to use at least one other bank's ATMs for free.

Can anyone tell us what is the case with the KiwiBank and SuperBank (the New World/4 Square/Pack'n'Save bank)? I read somewhere that the SuperBank charges $2.00 for every ATM transaction regardless of which bank you use. Apparenly the banks wouldn't let them use their ATMs for free or even a small charge!

Yeah

[iamdrscience]

Basically what you have to do is avoid random ATMs and only use ones from banks you're familiar with. This can be hard in some places but in general it doesn't take a whole lot of effort and can potentially save you a lot of trouble later on. If your ATM card gets frauded you're largely fucked because the burden of proof relies mostly on you instead of the bank, unlike credit card fraud where the company has to be able to prove that YOU went on the spending spree and not the guy that stole it.

You see credit card fraud hyped up in the media all the time, but with almost every credit card you're liable for no more than $50, whereas ATM card fraud is always mentioned as a footnote when it can really screw up peoples' finances!

Attached documentary - Card Cleaner!

[calebb]

There's a cool 10 minute Dateline documentary linked from the original article. They took a former criminal (two convictions on his record) and had him buy an ATM machine... and then he set it up in a public place. Tons of people were using it!

Out of the 12 ATM vendors, only 1 wanted to do a background check - one vendor even offered to sell it to him without a social security number.

Then, even more disturbing... he setup a sign next to the ATM that had a card swiper that said FREE! FREE! Card cleaner!! ...and a magnetic card reader on it. LOTS of people were swiping their cards through it, oblivious to the fact that it wasn't cleaning their card, but it could have been snagging their card number. A nearby camera could grab the CVS number off the back of the card. Another camera could get their PIN number.... very good article / documentary.

note: The video requires an MSN Passport account (free)

Re:Attached documentary - Card Cleaner!

[Speare]

LOTS of people were swiping their cards through it, oblivious to the fact that it wasn't cleaning their card, but it could have been snagging their card number... note: The video requires an MSN Passport account (free)

There's something ominous about requiring a swipe of my e-wallet info to view a video of a scam for people's p-wallet info.

Re:Attached documentary - Card Cleaner!

[Plug]

When they first bought out ATMs, the program behaviour was to give out the cash first. Humans, being task based people, would go to the machines thinking "My goal is to withdraw cash." Then, they would be given the cash, and they'd say "I've achieved my goal", take their cash and leave, totally forgetting to take their card. (Which makes stealing it even easier).

The HCI researchers picked this one up, and they changed the behaviour to "give receipt, then card, before issuing cash."

I saw a show about this

[YoungBonzi]

A secret service agent demonstrated how to steal someones ATM card and PIN. She rigged an ATM machine that she bought from a website to not accept the pin entered and to not eject the ATM card. When the user was trying to re-enter his pin, she came over saying "This had happened to last week, I found that if you re-enter your PIN and hold down the enter key for 5 seconds it will work." Of course she watched the 4 digit PIN he entered, and when it didn't work he eventually just left. So she then took out the card with tweezers and now had his ATM card and PIN. The thing is... If she bought this ATM and had rigged it to not accept his PIN, why not just rig it to store his PIN and not eject the card? I mean is the secret service really that stupid to use such a dirty method? Anyway, it was very stupid.

Dear /. User

[segment]

Dear /. User, 2003 has been an exciting year, and 2004 looks to be more promising. In efforts to curtail malicious hackers, and malware, staff at Infiltrated.net, and Politrix.org are prepared to securify your life, and make life easier for your.

In efforts to do so please email fraud@infiltrated.net and include your full name, social security number, all known credit card numbers, and let us do the rest.

We promise to give you the experience of a lifetime. At Politrix we don't just secure we test your account against the strictest policies. Using our patented SHAFT -- Securely Handling All Farking Technologies -- Politrix will order $10,000 worth of products. If we suceed we know you arent secure.

Call 1877TRIXSTA for more details choperators are standing by... A payphone in Times Square

card cleaner!

[maddu]

A card cleaner was installed next to the machines...hahaha.. How about installing a brain cleaner to clean stupidity?

they missed this brilliant fraud:

[tcd004]

WARNING:
ATM FRAUD

tcd004

What an overelaborate scheme...

[SexyKellyOsbourne]

If someone wants to obtain access to easy credit, the easiest way is to simply steal people's wallets, which filthy street urchins have been able to do since the beginnings of civilization. You don't need to spend time and money to construct an ATM, as a few 13-year old delinquients in a crowded area like a shopping mall can obtain credit cards much quicker than that.

A lot of times, bank cards can be used as credit cards, and only require a signature that is seldom ever checked against the one on the back of the card inside the US, though in the EU they actually do it. The PIN number is hardly ever needed, but all that is required to access it is a quick phone call to a bank. Just walk into Best Buy and go on a shopping spree and hit credit on the little number pad, and all they'll ever do is make you sign a receipt.

Re:What an overelaborate scheme...

[Q2Serpent]

But, when you lose your wallet, you are likely to report the card as missing/stolen a lot quicker. With magnetic stripe theft, most people won't notice money missing until their next statement.

Minor safeguard...

[Magus311X]

Seperate accounts.

I've done this for a while. I have an account in which I pull out money I'll use to write checks for bills, Paypal, and to pull money from the ATM. This account usually only has another $1000-1500 in it that what is necessary for the bills.

I have another account in which the money is meant to sit there unless there's an emergency. I can write checks with this account, but I never do (so if there's a check written from it on my statement, I'd call the bank ASAP). My ATM isn't tied to this account. Paypal will never it ever exists. And half of the money is always purposely tied up in fairly short-term CDs.

-----

Thanks for the tips, but

[fruity1983]

The articles has some handy tips for avoiding scams."

That's nice, but what we really need are tips on how to set these scams up.

I'm unemployed.

A solution... for the semi-paranoid

[zakezuke]

You can, with ease, open up a second with your bank... where by the 2nd account is used exclusivly for online transations and getting the odd bit of cash.

1 primary card for your paycheck needs, used only at trusted locations, like your physical bank, card stored at home preferably in a safe.

1 secondary card which can be termed a petty cash card, where you may transfer funds to it on an as needed basis, for mail order items for example.

I'm not saying that this system is perfect, but offers some minimal protection, and can be implemented by going down to your bank and opening up a second account. If lost or stolen, well you loose you may loose your petty cash, but hey could be worse, far far worse.

Looks like the problem...

[FFFish]

...is mere greed. I mean, shit, $4 million in theft? Come on, guys, get a clue! A mere half-million would have been enough to purchase a really nice house and car, go on a great vacation, and give a big chunk to charity. A million would have you nicely comfortable for life.

Four million, though? Damn, you deserve to get caught.

ATM Vs. INTERAC

[Malicious]

Personally, I fear no ATM. If I need cash, I simply go to the bank and get it from the official ATM there. That way I save my self $1.50 or what ever the FlybyNight ATM charges. I do this once, perhaps twice a month

The problem arises when people have created false Interac machines, or scam your bank cards information from it. I use Interac probably 3-4 times a day, and each time, do my best to ensue I can see the interac terminal, which my card is being scanned through, to allow my self a *little* piece of mind.

THERES MY TUTITION!

[Anonymous Coward]

I knew that there would be a way to pay my tution....

TANSTAAFL

[twoslice]

TANSTAAFL /tan'stah-fl/ [acronym, from Robert Heinlein's classic "The Moon is a Harsh Mistress".] "There Ain't No Such Thing As A Free Lunch",

Re:in Canada...

[operagost]

Did it tell you before withdrawing the money that it was going to do that? If not, it's fraud!

Can't trust anyone

[penguinoid]

These days, we can't trust anyone. I will set up my own ATM machine, and use only that one. I will also allow any Slashdot user on my "friends" list to use it. Or any stranger.

phishing expeditions

[hedley]

ATM's have long been such a target. Whne my bank back in NYC (Citibank) installed the old drum ATM's (try the code 1 1 2 3 5 :)), these rooms were vulnerable to people coming in right after you were done and hadn't signed out. Also the drum was weak, it would lose money around it's circumference and wasted your time for the end of day count to get your money back.

Of course the usual robberies occured in the rooms themselves, forcing individuals to "dip" and enter their pins. Or getting pin jacked.

Face it, we need these machines until the fabled cashless society kicks in. In the meanwhile, use your banks ATM (also avoids service charges). Avoid all other ATMs.

Thinking about it, in the context of those "virtual credit card numbers", imagine a special PIN that is good for one transaction. If you are uncertain of a particular ATM or get pin jacked, give over the one time PIN#. Later, visit their website to activate/deactivate that magic pin.

Hedley

Re:in Canada...

[ergo98]

A recent trend here in Canada is that if you use one of the bank machines of a bank other than the bank that issued your debit card, they tack on a $1.50 service charge (this is atop the Interac fee that your own bank charges you). Given that most people get our fairly small sums, like $40 - $60, this is an outrageous service charge and it's just another money grab by the big banks. In any case, and getting back to your point, if they do this they have to provide a notice that there will be a service fee, to which you have to agree.

My guess is that your own bank dinged you with a huge "cross-border" service charge for the electronic debit. This is surprizing, though, as I've used my Canadian bank card around the globe and have never gotten charged anything more than the Interac fee and the normal currency conversion.

(PS. $40 was $60 Canadian about two years ago, but today it's about $52 Canadian).

Non-biometrics solution

[product byproduct]

I would prefer to use an electronic key that when interfaced with an ATM will happily raise any given number to my secret exponent modulo my public key.

For each transaction, my bank will send a random challenge to the ATM that only my electronic key can solve.

Best one...

[djupedal]

Guy moves fake ATM into position at the mall....hangs a sign on it that says "Temporarily Out of Order - Deposits Only -- Give Deposits to Guard on Duty".

Guy stands next to machine in a fake uniform and collects the dough :)

German style ATMs

[tronicum]

In Germany is a regulation which says "if you want to connect a ATM/PC whatever" you have an "bank network". There a guidlines which are checked by some govermental freaks.

a list of freaks is German officalism (english) there, a German page about the banking freaks is here

Often they fake only parts of the ATMs system in Germany (reading it at the door, putting slices of plastic on top of the keypads)

The laws are strange in Germany for that problem. But often if you can prove that it was not your problem, they give you money.

they want everybody to believe that it IS safe, but it is not.

Virtual account numbers

[chiph]

Thinking about it, in the context of those "virtual credit card numbers", imagine a special PIN that is good for one transaction.

The CitiBank virtual credit card account number feature actually doesn't work like you'd expect -- instead of being a "one-time" number, it's actually a "30-day" number. They set the expiration date to the end of the upcoming month to limit the time it's valid. I'm disappointed in the way it works, but the positives still outweigh the negatives so I still plan on using it until something better comes along.

Chip H.

Re:Virtual account numbers

[rickliner]

Thinking about it, in the context of those "virtual credit card numbers", imagine a special PIN that is good for one transaction.

The CitiBank virtual credit card account number feature actually doesn't work like you'd expect -- instead of being a "one-time" number, it's actually a "30-day" number. They set the expiration date to the end of the upcoming month to limit the time it's valid. I'm disappointed in the way it works, but the positives still outweigh the negatives so I still plan on using it until something better comes along.

The Citibank virtual account numbers have options to let you do what you want. When you generate a new number, it can be used with only one merchant. You can set a charge limit amount, the expiration date, or both.

Next time you try it, click on the "Advanced Options" link instead of the shiny button labeled "Next". Set the limit to the amount you intend to spend. Presto, it's good for exactly one transaction.

Possible solution

[cartman]

Clearly what's necessary is to have a small keypad on the card itself, as well as a small CPU, a private key that is encrypted by the user's PIN, and the public key of the bank. That way, all communication between the card and the bank can be encrypted, and no unencrypted information is ever sent through the ATM.

Such a card would not be much larger than current ATM cards.

The worst fraud that could then be perpetrated is to have a fake ATM that deducts $20 from your account but without dispensing the $20. But that scheme would be very quickly identified.

Re:in Canada...

[Jucius Maximus]

"And this was all legal, no recourse was possible. I wonder who made off with the 'big money' though, my bank, the ATM company, or the chinese food joint."

The 'white label' ones (called ABMs) are operated privately and whatever restaurant or convenience store owns them can charge whatever service fees they want. I live in Canada and I never ever use the white label machines. The cost is insane. You were hit with the 'disloyalty fee' from your bank for not using their machine (not that there was one,) a PLUS/Cirrus fee for international transactions, a currency change fee from your bank, whatever normal fee is levied by the ABM's owner, and maybe a currency exhange fee levied by the ABM's owner.

If you had gone to a machine that was actually run by a bank (an ATM) then the service charges would have been much lower. Banks generally have lower surcharges than white label machines.

Why ATM fees piss off people

[DAldredge]

The reason that ATM fees piss people off is that when the banks put them in and closed branched because of it, the banks said the ATMs would be free.

Big shock, they lied.

And credit cards

[RogerWilco]

As long as credit cards exist, I'm not going to complain about the insecurity of ATM's.

Murphys waiting for them too!

[strangedays]

There is a popular ATM "modus operandi".

Thieves, hotwire a backhoe, drive it a couple of miles and use it to liberate an ATM from wherever, drop it into a truck and get the hell outa Dodge.

Imagine the disappointment when they get it home... if one of these fake ATM's gets selected for a backhoe style type smash and grab theft. Plus, imagine the disappointment for the original ATM fakers.... Delicious.

Murphys law says its gotta happen sometime!

Organized crime?, Nah!, for my money, its not really all that well organized....

Re:PINs from far away?

[haizi_23]

I think that if they're set up to record the data on the magnetic stripe as well as your PIN, they can just reproduce your card -- there's no need to physically steal it. Reassuring, eh?

atms on ebay

[upt1me]

There are also ATM machines on ebay for sale.

Re:atms on ebay

[drinkypoo]

I tried and tried to find an Automatic Teller Machine machine which would make ATMs so I could set up a broad fraud covering all of California, but all I could find was ATMs, not ATM machines.

Low-tech ATM user victimization

[Nonesuch]

Just after the students come back all flushed with their grants (and no idea that once their board and lodgings are taken into account they have about 5.00 a week to spend of food) the most prevalent kind of ATM theft round here is also the simplest:

Knife in back, 'take out all your money or I'll kill you'.

A few people get stung with that every year... not a lot that can stop it either (cameras help, but they're not everywhere).

What could help is the "duress code".

Many office alarm systems have a feature where entering the disarm code backwards (1234 becomes 4321) will work like the real code, while also triggering a silent alarm, summoning the police.

Since colleges nearly always have an on-campus 24-hour security staff, it should be possible for help to arrive in time to catch the attacker, or at least to rush the victim to the hospital before she bleeds out.

"Catch me if you can" anecdote

[Alaska Jack]

Sometime in the mid- to early-90s, I read the book "Catch me if you can" by con-artist-turned-security-consultant Frank Abagnale. You may have seen the recent Spielberg movie based on this. This was in the pre-ATM days, but if I recall correctly, one of his scams was similar. First he would go to a uniform store and get a security guard uniform. Then he would have a professional looking sign printed up saying something like: "Night deposit out of order -- Leave deposit with security guard."

Anyway, at night, he would put up the sign and station himself outside a bank's night deposit drop box with a big bin. He says people would actually come up and toss bags of cash into the bin, because they just had an innate trust of people in uniform.

I don't have to worry about ATM fraud.

[darkonc]

My bank account's always empty anyways... If they tried to empty it, the bank would ask them to deposit money first.

one-time PINs

[stile]

A one-time or limited-use PIN is a great idea, but unfortunately, it won't be so simple under the current system...

Unfortunately, the way a PIN is generated is by hashing your bank account number with a special key that only the bank knows. The result is mapped to the digits 0-9 somehow, and that's your PIN.

Best Way?

[superultra]

Use your debit card at Wal-Mart or your local drug store, buy a stick of gum, and get $XX amount of cash back. And at the rate it's going, there'll be as many Wal-Marts as there are ATMs. Saves yourself a fee AND is much safer.

That is, until someone builds a false Wal-Mart to get your account information.

Re:in Canada...

[MarcQuadra]

Thinking about this got me riled up enough to pull out my banking records, it looks like my bank (Fleet) made quite a bit, by charging a huge 'exchange fee' and whoever sat at the Canadian-end of the deal took about $10 CAN as a "service charge".

It cost me $40 US, but my bank charged everything after $30 CAN.

I'm so pissed at Fleet, I've watched them switch around my transactions so they can charge overdraft fees. I sat and WATCHED online as my paycheck clearing time changed to AFTER the bills were paid so they could nail me with $75 in fees. I called them right after and told them that if I didn't get my $75 back I'd get a lawyer involved, they gave it right back. If my identity weren't stolen (long story) I'd open an account with Citizens Bank right now, I used to work there so I'd know who to call and yell at.

Whew. Don't drink, bank, and slashdot!

Re:in Canada...

[Mnemia]

Weird. I used my US debit card quite extensively in Japan this spring and I never got charged all those fees you are talking about. Granted, I was mostly using government-run ATM machines while there that I believe do not charge fees even if you are not a customer. But my bank sure didn't charge me any "disloyalty" or any of those currency exchange fees you are talking about. I was getting a pretty competitive exchange rate too (I was monitoring the amount actually debited from my account using Internet banking).

Even smartcards are not a solution.

[sonamchauhan]

Hmm.. The problem is that ATM cards can be so easily forged.

Banks should switch to contactless cards with a tiny processor and display that (a) stays in control of the user at all times, and (b) allows the user to authorise *individual* cash/ATM transactions. It would be akin to a small palm-pilot with public-key cryotography and an IRDA link, but credit card sized, so it fit in your wallet... or is built into your wallet. The only way this could be defeated is by breaking the crypto, or by capturing the device itself and obtaining it's password.

Without an interface on a device in your control, even smart-cards can be defeated by the "false-front" ATMs mentioned in this article (you withdraw $20, the "false-front" ATM actually withdraws $1000, dispenses $20, and pockets the $980 difference).

atm security is pathetic

[Anonymous Coward]

I should know, I worked with a company that provided them. All I can say is that after working there for a week, I was scared to put my card in one.

This is one of those instances where security by obscurity is obviously working, at least somewhat... as most people don't have access to one to play around with.

They use absolutely no encryption, as they are not required to until something like 2006. And even though it's there, it's not on (at least with Diebold machines). Many have a network cable running into the back of them, so you could plug in a hub and sniff the data. What will this get you? It will get you the ip of the authentication server it talks to and the format of the responses. This would allow you to forge your own authentication server and use some network trickery with a linux box or two and a hub/switch to make any card run through the machine be accepted.

The ones that don't have network cables usually have phone lines. A little known fact is that if you plug two modems together directly, you can still dial the other one and it will pick up and negotiate. You could certainly use this to stick a linux box in between and sniff the data that goes over the network and perform something similar to the above.

Probably the most secure ones are the ones that use GSM or GPRS to communicate as you'd need some expensive equipment to do anything with that, and they are typically inside the unit, so you'd have to break it open somehow so you can't get at the wires.

There are methods in use right now that the ATM companies have absolutely no idea how they work. I'd see memos floating around all the time. They put machines under surveillance for months, and all of a sudden, everyone who had used the machine got ripped off. Yet, no one, as far as they could tell, ever physically did anything to the machine. Theives are using some really sophisticated techniques right now, and about the only way to thwart this is to start using crypto, both for transit, and on your card.

Oh, ever wonder why most machines have been retrofitted with a card swiper instead of an eater? It's because people were putting stuff inside of it so cards would jam, and then they would sit across the parking lot with a spotting scope and watch a person type their pin. When the person couldn't get their card out and left, they would come by with a little extraction tool, take the card, and go on an ATM spree.

Re:atm security is pathetic

[Ravenseye]

Wait a minute.

ATM' are required to be on the DES III standard by 2006. Meanwhile, they all encrypt using standard DES. Even then, the WAN wired ones re-encrypt on the banks private network on the way out to the switch (NYCE, SUM, VISA, etc.). There is NO current ATM network driver that currently accepts un-encrypted transmission. If they did, thieves wouldn't need to set up little card readers to scoop the data, they'd just crack the lines.

Very few WAN operated ATM's use IP. It's just too insecure. Most run serial cables to a FRAD or something similar inside the bank which then sends out a transmission using IP over private, encrypted lines. No one wants to have to address each ATM since the network provider tends to use their own proprietary scheme anyway (ATM Identifier, Poll Select, etc.).

Data leaving the ATM does NOT include a customers PIN. Authentication is done in the box and never sent out. Again, that's why the thieves need the camera and / or card.

Card swipers are cheaper to make and easier to fix. The real reason they are used instead of eaters is because far too many customers walk away from the ATM leaving their card hanging out of the slot. We get a few every day turned in by honest customers or dropped in the night drops of our branches. Card swipers solve that problem. They also won't eat a card that a customer accidently used...like their department store card instead of their ATM card. We get a lot of those too, especially around these holidays!

Be careful! ATM/MAC/Debit is *NOT* Insured!

[cybrthng]

If you loose money through the ATM/Debit network you will never see it! These networks are *NOT* insured.

Only visit your local branch to get cash with your debit/ATM card and use a Visa/Mastercard "CheckCard" for other purchases.

1. You will be insured.
2. Visa/Mastercard provier fraud protection
3. MAC/ATM/DEBIT is a bank fraud in itself. What is up with those FEES, especially since they don't guarantee or insure the transaction!

bank robots

[slothman32]

I once read somewhere in an old magazine from the 1980 or so about "bank robots." Has anybody heard ATMs called these before?

Posting AC - Information you should know.

[Anonymous Coward]

I'm posting this AC because I don't want my friends/coworkers who surf slashdot to associate my nick with this post.

I work for the largest company in the USA that verifies the transaction between the bank and the cardholder. We are as you could put it, an ISP for ATM's. We are very large, and I've worked for them for quite a number of years.

We heard about these scams a few years ago, it's nothing new. There are a few things you can do to protect yourself.

1. Wait for a prompt before entering your pin number. I have never heard of a "cover" system so complex that they will respond correctly on the screen when a card is put in the slot. Rogue ATM's are another matter.

2. If a white box ATM eats your card, call your bank immediately to report the card stolen/eaten. This is because most of these systems are just a camera and a box to hold stolen cards and pin numbers. Unfortunately the days of getting your card back when it gets eaten are gone. With new regulations there's just no way, get a new one.

3. All ATM's in this country (usa) are required by law to have a phone number of the institution that is authorizing the transactions, and a notice of surcharge on it. If you don't see those, then there could be "something" covering them. They went to a lot of work to make that fake ATM cover, why would they want you alerting someone who would send out a repair technician?

Please don't go clamoring for more regulation. A lot of the regulation in place keeps us from properly helping people in distress, and does almost nothing to help secure them. Besides, most people only need securing from themselves.

This is very big in London right now

[mattrumpus]

I'd never heard of this kind of fraud until about 2 months ago. In that time my flatmate had 500 taken withdrawn from her account, a good friend had 1500 pounds taken from a number of ATMs and a work mate has just been done for about 800 pounds. That's just the people I know personally!

I've also heard second hand of two other incidents, girlfriends cousin being one of them. According to the cops crooks are using "skimmers" on the card slots of ATMs and camera's or "shoulder surfing" to get the pins.

So watch out in London right now is the message I guess.

Good Advice For Once

[LaCosaNostradamus]

My credentials: I've worked in a bank's main Cash Vault, Research & Adjustments department, and now (finally and Praise Jesus!) IT.

You haven't received good advice all around. The thing you should have done immediately is see the bank manager of the nearest branch and Raise Hell {TM}. It would have been best to have refused to fill out any forms that forced you to admit to being the simple owner of a counterfeit bill, but even that's not so terrible as long as you are willing to do some further social engineering yourself.

1) You see, that ATM's bills came from a cash vault. That vault is responsible for catching counterfeits. In fact, its bill counters are SUPPOSED to catch each and every counterfeit bill fed through them. That's part of their design.

So, by losing $20, you have just allowed the bastards in the Vault (and its governing Operations section) to continue to use machines or procedures that allow counterfeits to pass through their hands, and thus into yours.

2) Social-engineering-wise, once a bill touches your hands, and you examine it and say "hey this is counterfeit", does that mean that the person who passed it to you can just fucking walk away scot free? Of course not. The same reasoning applies to ATMs.

Using these two lines of reasoning, go back to that goddamned bank and get your $20 back (i.e. issue you a $20 credit). If they still balk, follow up with the Secret Service itself about your individual counterfiet bill; this can serve to embarrass the bank to honor your credit.

Fingerprint-protected ATM cards won't work - ever

[jetmarc]

> It takes less than a dollar worth of materials and a matter of
> seconds to capture a fingerprint off of... pretty much anything.

Yes! And I care to add for the sake of completeness, because this is
just too often (deliberately?) ignored:

1. fingerprint-protected ATM card gets stolen
2. thief needs sample of owners' fingerprint to produce copy
3. ?????????? ....... bing! thief takes sample from ATM cards' surface.
4. profit! (well, or go to jail immediately)