Ever found a card catcher in your local cash machine? A few years ago I did and they’re surprisingly easy to dismantle – but in my case, a little more thought should have been applied to the possible consequences.
On a summer evening at my local pub, I ran out of cash and headed over the road with a friend to use the ATM. All regular stuff.
The machine ate my card. Initially cursing my luck and thinking there was just an issue with my card, I explained the problem to my friend and pawed lamely at the card slot on the machine.
But fiddling with the machine made me notice something. The facing around the card slot had moved a little. I picked at it and managed to drag out the attached magnetic tape that was holding my card. A card catcher.
This is a very simple device that retains your card so that someone else can retrieve it. There are quite a few variations of the theme but they all feature a tape of sorts that slips into the machine and catches the card, plus a front piece that sits in front of the usual ATM card slot.
Feeling as though I’d vandalised a cash machine, I noticed that the ATM was no longer in service. So, something had at least been triggered. A couple of women who had been hanging around us at the machine had now magically vanished – I realised afterwards that they were probably waiting to pick up the card, once I’d decided I wasn’t going to get it back.
Sometimes a card catcher is set up with a small camera on the ATM to record the PIN and then, having snatched the card, others are able to access the associated bank account.
→ Card catchers and skimmers have a related purpose but work differently. A skimmer reads your card on its way into the regular card slot and stores the data for later. A card catcher pretends to retain your card so you assume the bank has confiscated it. Skimmers let crooks make a digital counterfeit of your card later. Card catchers let crooks get hold of your actual card (including the chip, if it has one, and the security code printed on the back).
So, card catcher in hand, and not really thinking about the fact I was holding a tool for committing crime or that someone might want it back, I took it with me back to the pub. We marvelled over the sticky panel and the now rather bent and mangled loop that I had crumpled getting my card out.
I called the bank, of course, and told them what had happened. A very kind phone operator sounded suitably horrified but had no idea what it was that I had been describing. She did however flag my account for any suspicious activity – so I guess that was a start.
I also called the local police station. They told me to throw it away. Nothing more or less than that.
I took this at face value and worked on destroying the device as much as possible before throwing it in the bin behind the bar at the pub.
I wondered if things had changed in recent years so contacted my bank and local police station to see what their advice would be now. Luckily, it’s very different. My bank told me:
In the evening, call the police and let them know if you have found a card catcher. Call the local number, or if the situation appears to be threatening to you, then call 999 [the UK emergency services number]. If you find one during the day, go into the branch of the bank and let them know.
The bank also alerted me to warning messages that are either on the ATM itself or on its screen. But when I went to check, I found the messages are in among the ads for different bank services so they’re not immediately obvious. And that’s if you even read the messages before you put your card in – I can’t say I do.
Round at the local police station, a nice desk officer told me that the advice for the public is to be wary of groups of people around an ATM, look closely at the cash machine and check if it looks shabby.
If you find a device on a cash machine, call the local police immediately and they will send someone to retrieve it.
The best advice was to use a cash machine that is inside a bank branch where possible – there’s less of a chance that something can be stuck on an ATM when it’s inside the building.
Banks are also redesigning their ATMs so that it is harder to attach a card catcher. You may have seen curved areas where you put your card in, leaving only a small area on the lip of the card slot. This makes it a bit harder to stick something to the front of the machine.
More recently a man serving time in a jail in Romania for taking part in ATM fraud decided to put his knowledge to a different use and designed a revolving system for putting cards into cash machines so that it is harder for others to commit ATM fraud.
It’s probably best not to do as I did – carrying a tool for catching cards is not a good idea and making off with it in front of people who might want it back is also not so wise.
If you can’t get your card out again, there’s not much you can do other than call your bank and cancel your card, as well as letting the local police know so they can take the apparatus from the machine.
Of course, prevention is always best so at least being wary and taking a closer look at a cash machine before you put your card in is a smart option.
These days there’s usually another machine not too far away and it’s usually worth the leg work to avoid having to cancel your card.
Here’s a demonstration of some of the things to look out for when you’re using a cash machine, courtesy of Naked Security’s friends at the Queensland Police Service in Australia. This video focuses on skimmers, but the same advice applies to card catchers too. [Note: 000 is the Australian emergency services number.]