GLOBAL FRAUD ALERT

ISSUE NUMBER 2010-01 Preventing Card Trapping

FRAUD RISK SCENARIO Card trapping is on the rise in some countries. It is defined by GASA as the theft of a customers card through tampering with the card reader to ensure the card remains stuck inside the card slot and cannot be returned to the customer after it has been inserted. In this scam, the ATM will not register that a card has been entered, so the screen does not change or request the person to enter his PIN. This crime involves affixing a device to the card reader/slot, typically a loop of material or plastic V fitted to a false card slot and then placed over or into the genuine card reader. Once the card is trapped the fraudster poses as a fellow customer and Good Samaritan and offers assistance, advising the customer to enter their PIN to release the card. This does not release the card and only serves as a way for the fraudster to observe the PIN. [Dip" or "swipe" card readers are not susceptible to this type of scam because the card never fully enters the ATM on those particular models.] The customer believes the card has been retained and leaves the ATM. Fraudsters then remove the device and card and subsequently use the card fraudulently, often before the cardholder has reported the incident. Note that captured cards can be used by criminals with or without a PIN - signature-based cards, for example, can be removed and used for point-of-sale transactions instead of cash withdrawals. Types of Card Trapping Devices

Fuse wire Lebanese Loop VHS VHS tape Romanian Loop Water bottle Algerian V Tape measure Builders Loop

Variation on Card Trapping the thin plastic sleeve ploy A thin plastic sleeve is inserted into the card reader to trap the card AND to prevent the ATM from reading the magnetic stripe data. The ATM repeatedly asks the customer to enter his PIN number. The fraudster observes the customers PIN being tapped in. When the victim leaves, thinking the ATM has swallowed his card, the thief removes both the plastic sleeve and the card.

The Global ATM Security Alliance The ATM Industry Association

GLOBAL FRAUD ALERT

PROPOSED PREVENTIVE MEASURES 1. 2. 3. 4. 5. We recommend daily checking of ATM interface in addition to cardholder security education. The use of a painted defensible space around the ATM will help reduce interference from fraudsters. Educate and encourage customers to contact their bank immediately should a machine swallow their card. That way it can be blocked before the criminals get a chance to use it.1 Cardholders should also be informed never to accept help from strangers at ATMs. Many non-visible anti-skimming solutions also offer protection against the placement of card trapping devices in that any foreign objects in or near the ATM card reader will be detected. Most major ATM manufacturers have enhanced newer designs that prevent the insertion of foreign objects into the card reader.

GASA is indebted to Lachlan Gunn, Co-ordinator of EAST, for this suggestion, as well as number 4 of the preventive measures.

The Global ATM Security Alliance The ATM Industry Association