Sophos Cloud Optix
Ever found a card catcher in your local cash machine? A few years ago I did and they’re surprisingly easy to dismantle – but in my case, a little more thought should have been applied to the possible consequences.
On a summer evening at my local pub, I ran out of cash and headed over the road with a friend to use the ATM. All regular stuff.
The machine ate my card. Initially cursing my luck and thinking there was just an issue with my card, I explained the problem to my friend and pawed lamely at the card slot on the machine.
But fiddling with the machine made me notice something. The facing around the card slot had moved a little. I picked at it and managed to drag out the attached magnetic tape that was holding my card. A card catcher.
This is a very simple device that retains your card so that someone else can retrieve it. There are quite a few variations of the theme but they all feature a tape of sorts that slips into the machine and catches the card, plus a front piece that sits in front of the usual ATM card slot.
Feeling as though I’d vandalised a cash machine, I noticed that the ATM was no longer in service. So, something had at least been triggered. A couple of women who had been hanging around us at the machine had now magically vanished – I realised afterwards that they were probably waiting to pick up the card, once I’d decided I wasn’t going to get it back.
Sometimes a card catcher is set up with a small camera on the ATM to record the PIN and then, having snatched the card, others are able to access the associated bank account.
→ Card catchers and skimmers have a related purpose but work differently. A skimmer reads your card on its way into the regular card slot and stores the data for later. A card catcher pretends to retain your card so you assume the bank has confiscated it. Skimmers let crooks make a digital counterfeit of your card later. Card catchers let crooks get hold of your actual card (including the chip, if it has one, and the security code printed on the back).
So, card catcher in hand, and not really thinking about the fact I was holding a tool for committing crime or that someone might want it back, I took it with me back to the pub. We marvelled over the sticky panel and the now rather bent and mangled loop that I had crumpled getting my card out.
I called the bank, of course, and told them what had happened. A very kind phone operator sounded suitably horrified but had no idea what it was that I had been describing. She did however flag my account for any suspicious activity – so I guess that was a start.
I also called the local police station. They told me to throw it away. Nothing more or less than that.
I took this at face value and worked on destroying the device as much as possible before throwing it in the bin behind the bar at the pub.
I wondered if things had changed in recent years so contacted my bank and local police station to see what their advice would be now. Luckily, it’s very different. My bank told me:
In the evening, call the police and let them know if you have found a card catcher. Call the local number, or if the situation appears to be threatening to you, then call 999 [the UK emergency services number]. If you find one during the day, go into the branch of the bank and let them know.
The bank also alerted me to warning messages that are either on the ATM itself or on its screen. But when I went to check, I found the messages are in among the ads for different bank services so they’re not immediately obvious. And that’s if you even read the messages before you put your card in – I can’t say I do.
Round at the local police station, a nice desk officer told me that the advice for the public is to be wary of groups of people around an ATM, look closely at the cash machine and check if it looks shabby.
If you find a device on a cash machine, call the local police immediately and they will send someone to retrieve it.
The best advice was to use a cash machine that is inside a bank branch where possible – there’s less of a chance that something can be stuck on an ATM when it’s inside the building.
Banks are also redesigning their ATMs so that it is harder to attach a card catcher. You may have seen curved areas where you put your card in, leaving only a small area on the lip of the card slot. This makes it a bit harder to stick something to the front of the machine.
More recently a man serving time in a jail in Romania for taking part in ATM fraud decided to put his knowledge to a different use and designed a revolving system for putting cards into cash machines so that it is harder for others to commit ATM fraud.
It’s probably best not to do as I did – carrying a tool for catching cards is not a good idea and making off with it in front of people who might want it back is also not so wise.
If you can’t get your card out again, there’s not much you can do other than call your bank and cancel your card, as well as letting the local police know so they can take the apparatus from the machine.
Of course, prevention is always best so at least being wary and taking a closer look at a cash machine before you put your card in is a smart option.
These days there’s usually another machine not too far away and it’s usually worth the leg work to avoid having to cancel your card.
Here’s a demonstration of some of the things to look out for when you’re using a cash machine, courtesy of Naked Security’s friends at the Queensland Police Service in Australia. This video focuses on skimmers, but the same advice applies to card catchers too. [Note: 000 is the Australian emergency services number.]
Images of ATM machine and credit card courtesy of Shutterstock.
"Soemtimes a card catcher is set up with a small camera on the ATM to record the PIN and then, having snatched the card, others are able to access the associated bank account."
Sometimes*
Fixed, ta.
My bank allow you to request an emergency withdrawal code using a phone app… this means that I don’t actually have to put my card into their machines – actually there are three brands of machine at which this works. This, of course, would not be vulnerable to a card catcher. Unfortunately, if there isn’t a machine of that type nearby, I have to insert my card. I do however stick to machines of types I know, as a rule, so that I would recognise one with any extra devices fitted.
Excellent video. Good points made but the character was funny.
I found one in Rugby a few weeks ago, I noticed that the card slot had what looked like glue around it and low and behold there was a pin hole above the PIN pad.
I contacted the local police station and they were at the scene within 10 minutes to forensically bag the devices, which looked very well disguised and had been specially moulded for the particular machine.
Its a busy machine and I had to tell several people not to use it, in just the short 10 minutes I waited for the police, so I dread to think how many cards would have been skimmed otherwise. Scary stuff!
My first instinct after finding the catcher would have been to look around and take notice of who’s “hanging out”…
I read an article about an ATM scam where someone would glue the Enter and Cancel buttons on Touch Screen ATM’s, hoping that people would not pay attention that the machine is Touch Screen… after entering their PIN, the Enter and Cancel buttons do not work, so they leave… then the thief comes over and touches the screen and takes the maximum amount allowed and they’re gone… this was done mostly at ATM’s outside of a bank.
never ever use an outside atm. these devices are now very sophisticated and incluse a stick on numeric pad to log keystrokes and camera with wifi where these people sit in a car close by. your money is drawn out within minutes of your own transaction, i have seen it in action, it is scary and it is faster than you can phone your bank
Typical. I read this this morning, and this evening an ATM eats my card!!
I suspect in my case it was just a faulty ATM; no sign of any tampering (I looked carefully!) and it made a lot of noise trying to eject it before shutting itself down as faulty!
Still, I blame Naked Security. These things must be connected, surely?
Look close at the AMT and see if all the pieces match. Before you insert your card see if you can pull anything loose. You shouldn't be able to.
To make things worse there is also something called a “cash claw”. Thieves insert it into the slot where money comes out of the ATM and presto you get extra cash. Welcome to the 21st century!