Unauthorised ATM withdrawal- Ombudsman ruled in favour of bank

General_Grant

dusthug said:

This a known but difficult MO to detect. In short, it involves a compromised terminal at a TFL barrier. The terminal transmits to a fraudster using a repeater and receiver with a connected card at a nearby ATM.

The wATM ithdrawal normal happens within 2 minutes of the attempted tap at the barrier.

Where does the TFL barrier come into the story any way?  Was it not a matter of topping up an oyster card which isn't done at the barrier but at a separate payment point?

flaneurs_lobster

dusthug said:

sausage_time said:

dusthug said:

This a known but difficult MO to detect. In short, it involves a compromised terminal at a TFL barrier. The terminal transmits to a fraudster using a repeater and receiver with a connected card at a nearby ATM.

The wATM ithdrawal normal happens within 2 minutes of the attempted tap at the barrier.

I have not heard of this kind of attack before.  Do you have any links to reports?  It it specific to TFL terminals?

www.spectator.co.uk/article/fraud-victim-dont-bank-on-getting-your-money-back/

That's the closest I've seen reported publicly.

That story is nothing like your "compromised terminal" theory, it concerns a phantom withdrawal from an account, much like that reported by the OP. 

You said this type of crime is "known", by whom? reported where? For a few hundred quid a time?

Nah.

sausage_time

This (ancient) report could be relevant:

https://www.cl.cam.ac.uk/research/security/banking/relay/

But it is an old paper, and if the vulnerability was genuine and practical I'm sure it would have been addressed by now.  If not, we would see thousands of such incidents, not a handful.

Emily_Joy

For what it worth. Ages ago I received a call from HSBC which I didn't answer. I then received a text asking me to contact their Fraud department ASAP. When I got around calling them, I was told that there was chip & pin transaction for over £200 in McDonalds about 300 miles way from where I live, which they have blocked. 

I do not know anything about cloning chip & pin (though I recently learnt that when one pays contactless the information transmitted can be read/recorded from nearly 20 meters away), but I am somewhat surprised that the bank will insist it is not possible to make a fraudulent copy. 

AmityNeon

sausage_time said:

This (ancient) report could be relevant:

https://www.cl.cam.ac.uk/research/security/banking/relay/

But it is an old paper, and if the vulnerability was genuine and practical I'm sure it would have been addressed by now.  If not, we would see thousands of such incidents, not a handful.

It links to one of the earliest YouTube videos (Feb 2007), demonstrating Chip & PIN fraud:

https://www.youtube.com/watch?v=X7pjUIxKoEc

Followed by an update from October 2015 (from the same professor at Cambridge University who demonstrated the above proof of concept):

https://www.youtube.com/watch?v=Ks0SOn8hjG8

born_again

AmityNeon said:

So as far as banks are concerned:

• Customers are always lying if they claim to be victims of inexplicable fraudulent withdrawals.
• Aside from cases involving theft or coercion, ATM withdrawals are always authorised by the customer.
• They will certainly never investigate CCTV or divert resources towards courses of action that could potentially result in monetary loss via paying compensation, considering the infallibility of inherently-authorised ATM withdrawals.

Banks are not on the side of customers; bank protect only themselves from fraud, which includes attempts at fraud by their own customers.

Avoid having debit cards altogether, or keep cards frozen except at the immediate point of use (NatWest had the cheek to advise me not to do this because freezes aren't designed for such use cases — I don't care).

Banks are not the police. They do not have the authority to do this. 

Everything the banks need to prove their side of the case is on their internal systems.

Banks hand over millions in fraud refunds.