Questions of Cash: Tell me what I should look for if crooks have rigged up an ATM

Retailer collected payments on unwanted mobile for 10 months (Rex Features)

Q: You answered a reader’s letter (Questions of Cash, 11 May) on a fraud committed at an HBOS ATM, where a “skimming device” was fitted to the front of the machine. The victim was obviously unaware of this, but apparently a subsequent customer was as they reported it to the branch when it reopened after the weekend. I have no idea what to look for and many other readers will be similarly uninformed. Please enlighten us! IM, by email.

A: Devices attached to the front of ATMs are almost impossible to detect, which is why customers can be easily caught out. We do not know how one of HBOS’s customers did spot the device in this instance, or why they only chose to report it in the branch after the weekend, rather than phoning HBOS to warn it during the weekend. We are told by Financial Fraud Action UK (FFAUK) – which speaks on behalf of the industry – that on this occasion it was probably not a skimmer but a card-entrapment device.

Its spokeswoman explained: “If your card is skimmed then the criminal needs to connect his device to a laptop, review the PINs from his camera bar and make up counterfeit cards. The counterfeit cards are then usually used in a non-EMV environment. [EMV stands for Europay, Mastercard and Visa – market leaders in debit and credit-card technology.] Cards trapped inside ATMs by criminals are almost always used at a nearby ATM immediately afterwards. It is not uncommon for the term ‘skimming’ to be incorrectly used for other forms of ATM crime.”

Card-entrapment devices are “virtually impossible” for a customer to detect. The FFAUK spokeswoman continued: “A device is glued into the card throat of the ATM. The trap normally utilises a piece of retractable tape measure and a razor blade. The razor blade holds onto the embossing on the card preventing it from being returned to the customer. A camera is also used with this device to capture the customer’s PIN. A customer puts their card into the ATM and enters their PIN. They then select the amount of cash they wish to withdraw and wait for their card to be returned. The device prevents the card from being returned and eventually the machine shuts down and the customer walks away. The criminal will then return to the machine, prise out their device with the customer’s card and take down the camera. They will then review the camera to obtain the PIN and now they have the customer’s card and their PIN. The first thing they will then do is to carry out a balance enquiry at a nearby ATM followed by the maximum withdrawal.”

The news is not much better with a actual skimming device. The spokeswoman explained: “Card skimming is the term used to describe the fitting of an electronic device to an ATM normally attached to the card throat to capture data from the magnetic stripe of the card. The device will either be fitted on the outside of the machine, in a housing made to replicate part of the actual machine, or inside the ATM itself. The devices are often fairly sophisticated and very difficult to spot. They can be attached to the ATM for some time depending on the battery life and size of the memory. Once in place, the device will potentially capture large numbers of card data.

“Criminals will also fit a camera, in conjunction with the skimming device to capture the customer’s PIN. This camera is often a mobile phone set, recording video footage and placed inside some housing with the lens looking through a pin hole. The housing of the camera is also made to look part like part of the machine and also often difficult to spot. The camera is normally placed above the PIN pad looking directly down onto it.”

The advice from FFAUK is not to look for devices, but instead to focus on shielding the PIN. Devices are very difficult to detect and taking action to remove a device could put the customer at risk from the nearby fraudsters, who may be ruthless in recovering a removed device. FFARUK adds that customers should always carry the 24-hour phone number of their card issuer to enable them to report the retention of a card.

Q: Three years ago, I ordered a mobile phone from 3. After a week it had not arrived, I phoned them, was told it had not yet been despatched and so 3 agreed to cancel my order.

I later found a card at home saying the phone was at my local post office awaiting collection. I phoned 3 to remind them I had cancelled the order, but 3 continued collecting payments from my account for 10 months. After repeated phone calls 3 stopped collecting the money and told me to recover the funds from a bank indemnity claim, which I did. I was promised by 3 that this was the end of the matter. But now debt collection agency Lowell is seeking to recover these funds, a total of £229.38. Jo, London.

A: Lowell ceased debt recovery action as soon as it became aware of the situation. A spokeswoman for Lowell said: “We bought this account from 3 in January in good faith as a valid debt requiring repayment and wrote to [the reader] thereafter. 3 have now confirmed that the account has been closed. 3 have also made a goodwill gesture payment.”

We asked 3 for a comment, but its spokeswoman would only say: “3 has resolved the issue with the customer.”

You tell us that 3 has agreed to pay you £100 compensation and ensure that your credit status is unaffected.