How cashpoint fraudsters can get your Pin - Jenny Ross

I have always assumed that a debit card cannot be used to withdraw cash from an ATM in the absence of the Pin. She may, of course, have had her Pin in her card wallet but this would be negligent and her bank would be unlikely to tell her that she will “probably get the money back”. Can you answer her question?

Jenny says...

Scammers have a seemingly endless repertoire of techniques designed to part us from our cash, and these have become increasingly sophisticated: people are being duped by text messages that claim to be from Royal Mail, calls that appear to be from their bank’s phone number, and Whatsapp messages that look like they’re from family members. But older, lower-tech methods are still proving lucrative.

Card fraud at UK cash machines accounted for losses of £28.1m in 2021, according to the banking industry body UK Finance. It’s a big number, but relatively small in the context of overall payment card fraud losses (£574.2m) and losses have been falling in the past few years, so there’s no need to worry unduly.

You’re right that you can’t withdraw cash from an ATM without entering your Pin, so in all cases the fraudster would need to have access to the genuine Pin and card.

As you suggest, one way this can happen is if someone has written their Pin down in a purse or wallet, which is then stolen. Or thieves can simply ‘shoulder surf’ – they hover over you to watch as you enter your Pin at an ATM or on a card machine and then steal your card at an opportune moment.

This might be done using distraction techniques – for example by telling you you’ve dropped something on the floor, and then grabbing your card from the cashpoint slot.

Fraudsters can also tamper with ATMs to steal cards or card details by inserting a device into the card slot to prevent the card from being returned to you. To capture the Pin, they’ll either watch you enter it, or use a small camera attached to the machine.

Once you leave the machine, the fraudster will remove the device and the card and then use it to withdraw cash.

They can also fit skimming devices which scan the information stored on your card’s magnetic strip.

As always with this type of fraud, for your card details to be useful, fraudsters need to get your Pin.

Once they’ve got that they can create a fake card that can be used with the genuine Pin to withdraw cash in certain countries where machines have yet to be upgraded to chip and Pin.

Some banks now offer contactless cash withdrawals, which still require you to enter your Pin but don’t need you to insert your card into the machine, meaning you’re not at risk from skimming devices.

But the easiest way to thwart cashpoint fraudsters is to fully cover your Pin when withdrawing cash from a machine or making a payment using a card machine.

Be sure to protect it more generally by not disclosing it to anyone else or writing it down anywhere.

The good news is that even if you are unlucky enough to fall victim to cash machine fraud, you shouldn’t be left out of pocket as debit card providers are required to refund unauthorised transactions under the Payment Services Regulations 2017.