Phantom withdrawals

Spivved1987

Doing some e-mail spring cleaning, I came across this which I sent to Guardian Money a while back. They never printed it, but I would be interested to know if anybody (especially those in legal circles) has any comments:

Dear Sir,

A couple of weeks ago (unfortunately I didn't keep the article) Guardian Money ran a feature on a woman who'd claimed her money had been taken from a cashpoint without her knowledge. Irrespective of the merits or otherwise of this particular case, what was more noteworthy to me was something mentioned in the obiter dicta of the article: namely that there had been a case where a woman successfully challenged a phantom withdrawal because she had used her card in Manchester and the bank accepted she could not have got to Brighton in the four minutes when it was used again. The places mentioned may have been different, but I am writing this entirely from memory.

Now my question is this: why hasn't this case been publicised more widely? The banks are adamant that such things are impossible, and that cards can't be cloned. Yet common sense and many testaments tell us that it is perfectly feasible, given the right equipment and inside knowledge, to manufacture a card and impregnate the magnetic reader and chip with whatever information was stored on the original card. The banks maintain this is impossible, yet have accepted the customer's case in the Manchester/Brighton example. This seems to me akin to putting your fingers in your ears and singing 'la la la' to avoid hearing something you don't wish to. Or to put it in more contemporary fashion, "Speak to the hand because the face ain't listening..."

Sorry for the length of this e-mail. But I simply can't understand how any institution can maintain something is impossible, have it happen before its very eyes, agree it has happened, and then deny that it is possible again. Or am I missing something ?

dunstonh

Now my question is this: why hasn't this case been publicised more widely?

Because a refund is very common where the transaction is not able to be the individual. The majority of "phantom" withdrawals are family members using the card or the person forgetting. A cloned card is unlikely to be used locally. A family member or the person themselves is likely to be local.

The banks are adamant that such things are impossible

A phantom withdrawal is impossible. However, a cloned card used fraudulently is possible. Banks dont claim that cards cannot be cloned. They claim that magic withdrawals from machines cant happen. It should also be noted that cashpoint machines are balanced against transactions. So if there were magic withdrawals what would happen to the physical money?

Spivved1987

dunstonh wrote: »

Banks dont claim that cards cannot be cloned.

Yes they do, or at least they claim that the PIN detail contained within a card is encrypted and uncrackable. And that was the whole point of my posting; if there had been a proven case where two apparently identical cards had made withdrawals a few minutes and hundreds of miles apart, it would be irrefutable proof that there were two identical cards in existence, one real,one cloned; and at least prima facie evidence that the cloner was able to copy the encrypted PIN information or somehow bypass it.

meer53

Don't believe everything you read in the press.

Goldiegirl

It was some years ago, but I used to work in a High Street branch of a building society.


From time to time we'd get people coming in about 'phantom withdrawals'.


These phantom withdrawals would always be at my branch, or another local branch.


So it was an easy matter, to locate the journal roll for the ATM, and actually look at the transaction, as dates, times, attempts at the PIN etc are all logged.


I'd show all the details to the customer, and generally there was a pattern, for example, on a Sunday morning. It was very difficult, but I had to offer to get the police involved if they felt their card has been stolen, or was there anyway somebody they knew had access to the card and the pin, on a Sunday morning. There would then be a look of horrible realisation, when they realised their grandson was at their house while they were at church.


I never once had to get the police involved - all of these phantom 'withdrawal cases' were sorted out be the customer themselves, once they worked out what was happening.


In my experience, the explanation for the phantom withdrawal has always been the most obvious - a relative or 'friend' has been robbing the cardholder.


I was never aware of any proven phantom withdrawal my previous employers

dunstonh

Yes they do, or at least they claim that the PIN detail contained within a card is encrypted and uncrackable.

That is not the same thing though.

And that was the whole point of my posting

So, your post was based on inaccurate assumptions.

Spivved1987

I think we are on completely different wavelengths here. My point is that banks claim that the scenario of a completely unknown (to you) third party getting into your bank account via an ATM machine is impossible without an element of collusion, conscious or unconscious (eg leaving your PIN lying around). I believe that the scope of modern technology and expertise makes such a claim arrogant and untenable.

Please sir, may I believe what I want to believe?

[Deleted User]

Spivved1987 wrote: »

Please sir, may I believe what I want to believe?

Of course you can, just don't expect others to agree with you!:p

JuicyJesus

Spivved1987 wrote: »

And that was the whole point of my posting; if there had been a proven case where two apparently identical cards had made withdrawals a few minutes and hundreds of miles apart, it would be irrefutable proof that there were two identical cards in existence, one real,one cloned; and at least prima facie evidence that the cloner was able to copy the encrypted PIN information or somehow bypass it.

1) Chip cards cannot currently feasibly be cloned. The magstripe can. Most ATMs read the chip - a small few read the magstripe, or use it as a fallback.

2) Go and read the Ombudsman decisions website for some of the disputed cash machine withdrawals complaints. Most of the cases which are not upheld are ones where the use of the card is consistent with where the cardholder uses their card, or is close to their home, and the chip has been read and verified. If someone uses a cash card belonging to someone living in Portsmouth in Leeds or whatever, then that will ring alarm bells and is a far more credible story than it being used at the cashpoint down the road the customer always uses by someone completely unknown to them.