Laser card used fraudulently in ATMs and POS without PIN - how?

paulc2

Hi all,

First post, but I'd love to hear an answer to this, if anyone can suggest one...

I received a letter from my bank, AIB, dated 8 May 2007, that stated my ATM card was being upgraded to a Laser card that I would be able to use in both ATMs and shops, and that I would continue to use my current PIN. I thought no more about it until 21 June when it came to mind again - I realised that I had not yet received the card, so I then called AIB and informed them of this fact. They checked to see if there had been any transactions on the card, there had not.

So, they proceeded to report that card as lost/stolen and ordered me a new card and a new PIN, and told me I would receive them in the following week. As you can probably guess, I didn't receive this second card either, but I did receive the PIN. I didn't think much of it, as I thought the card would follow. So, I was just checking my current account online last Saturday (30 June), and for a minute I thought I was looking at someone else's. There were 15 transactions, 4 at ATMs (each for €600) and 11 point of sale (POS) transactions. The total came to over €3500. None of them was done by me. So, I immediately called the number on the back of my card and told them the story. They then cancelled that card. I called into my branch the following Monday (2 July) and filled in a couple of fund reclamation forms, and gave them the PIN that I had not yet revealed (to back up my case that it couldn't have been me who used the card).

Yesterday I checked my account once more. Another 20-something POS fraudulent transactions on my card, bringing the total to over €6110. Unbelievable. I legged it back to my branch, they seem to think it was from pending transactions, and that no more would come through. 3-4 weeks before their fraud dept could investigate.

So, I've more or less gotten over the shock of all this, but I am absolutely baffled as to how any of it happened. How the hell did they use a card without a PIN - in both ATMs and shops?? Or, if they knew the PIN, how did they get their hands on it? I had the untampered PIN that they sent out, and my original PIN was in my head.

Anyone got any ideas at all? The bank has so far been able to offer me no suggestions as to how this happened.

Any hints appreciated.

Thanks,

Paul.

snappieT

At POS, staff can and will accept signatures for the transaction. Call into the shops, and ask to see the duplicates from the sales, see if it's "verified by pin".

The ATM I don't really know. The only possibility I can think of is that
(a) AIB screwed up, and sent the same PIN twice
(b) There are only 10,000 possible PINs. You get 3 chances. Through this logic, an average one card in every 3,333 cards stolen will have their PIN comprimised. Think how many cards are stolen. Maybe you were that unlucky one.

Mr. Presentable

Places like Tesco, at the self service, you don't need a PIN.

vorbis

yeah, but I doubt the same criminal is going to rob 3333 cards!
Never knew staff would accept a signature in Ireland for a laser transaction.
(Although it is the same over here in the US)

Not sure if its the same at home, but here if you sign for a transaction with a debit card you have better fraud protection (compared to using a PIN) as signing means the transaction is processed via the credit card network.
What type of shops were the transactions at OP?

Victor

I'm guessing they didn't change the PIN number. And someone is intercepting your post.

mikemac

nipplenuts wrote:

Places like Tesco, at the self service, you don't need a PIN.

This used to be the case but they are now installing machines where you type in your pin.
Tesco Drumcondra have had this for over a month now

jaggeh

Victor wrote:

I'm guessing they didn't change the PIN number. And someone is intercepting your post.

post interception was my first guess too.

steveland?

snappieT wrote:

At POS, staff can and will accept signatures for the transaction. Call into the shops, and ask to see the duplicates from the sales, see if it's "verified by pin".

Was the 17th or 18th of March this year not the deadline for PIN transactions only if your card is activated for C&P?

ie, from that date onward, if you had a chip in your card shops were no longer permitted to accept signatures?

My card is not C&P, Permanent TSB sent me a letter out about 5 months ago informing me that they'd have C&P set up within 3 months and that I would automatically be sent out a new pin and card but so far nothing. Luckily I'm off work next week so I'll call in and see what's the beef...

Saruman

Would it not be more simply a case that your original card was cloned and thats what they were using? It was coincidence about the new card but like the letter said, you could continue to use it and original pin until you got the new one.
I remember when i first got a laser card from ulster bank my original ATM card still worked so i gave that to my wife for a few months until i got her on the account and her own card.

So it does not look to me like the new laser card was used.... just a cloned copy of the original card.

Oryx

Im with saurman on the cloning idea. And shops can still accept signatures, but the risk lies with them if the card is a dud.

Sangre

steveland? wrote:

Was the 17th or 18th of March this year not the deadline for PIN transactions only if your card is activated for C&P?

ie, from that date onward, if you had a chip in your card shops were no longer permitted to accept signatures?

My card is not C&P, Permanent TSB sent me a letter out about 5 months ago informing me that they'd have C&P set up within 3 months and that I would automatically be sent out a new pin and card but so far nothing. Luckily I'm off work next week so I'll call in and see what's the beef...

Don't bother steveland there has been delays with them. Should be out by septemember. Although at least now they'll be maestro as well so you can use them as debit cards in shops abroad.

by the by shops are allowed to take sigs for cards but if they do they are liable for the money if there is fraud. (used to be the bank).

paulc2

jaggeh wrote:

post interception was my first guess too.

Hi all,

Thanks for the replies. I'm pretty sure it's someone nicking my post alright (2 cards were posted but not received!). But I think I can rule out cloning as a possibility - my original card was just a simple ATM one, it couldn't be used in shops/POS. So, I'm still stratching my head here!

The card was used in a load of different places - Footlocker, Arnotts, Dixons, Dunnes, Half Price Jewellers, Next Page, Champion Sports, Debenhams, Mace, Tesco, Lifestyle Sports, Thomas Gear Jewellers, Cafe Cucina, Spar....

The swines...

PeteK*

Imagine that!

I'm sure the bank puts your money back in your account?

Victor

paulc2 wrote:

The card was used in a load of different places - Footlocker, Arnotts, Dixons, Dunnes, Half Price Jewellers, Next Page, Champion Sports, Debenhams, Mace, Tesco, Lifestyle Sports, Thomas Gear Jewellers, Cafe Cucina, Spar....

I'm surprised the pattern of usage didn't trigger an alarm with the bank.

paulc2

Chatmaster wrote:

Imagine that!

I'm sure the bank puts your money back in your account?

They said I should get it back after about a month....

Victor wrote:

I'm surprised the pattern of usage didn't trigger an alarm with the bank.

I agree... My Visa card generates false positives quite regularly, but the real positives aren't caught at all... Great systems they have!

PeteK*

With interest I hope! Lol.

dellas1979

I would think someone had intercepted the first card that was sent and the PIN also.

So, while you were thinking they were just "lost", they were in fact stolen. The card wasnt cancelled (you never got a 2nd new card, even though you told AIB). Do you live with someone/people or any idea how they could intercept your post?

Bogger77

I always arrange to collect cards in a branch office. that way people I share with don't get to accidently open it. And pin and card never go to the same address.

Bogger77

I always arrange to collect cards in a branch office. that way people I share with don't get to accidently open it. And pin and card never go to the same address.

hshortt

Inside job possibility? Hope all goes well, and don't worry too much. The Bank will sort it out for you.

MOH

Bogger77 wrote:

I always arrange to collect cards in a branch office. that way people I share with don't get to accidently open it. And pin and card never go to the same address.

`
Last time I did that I went in and asked for the card, was handed straight to me, never even asked me for any ID.

hshortt

You must have given your name though? Chances of two people with the same name picking up from that branch would most likely be limited. That said, you should have been.

Cheers

ambro25

Whoever intercepted your card, got to sign it any which way they wanted, whereby a signature on a till receipt will of course match the card (for any cashier who bothers to actually check - I have seen so very few).

chuckles30

I had to order a new laser card recently from BOI as my own was damaged and I had to call to the branch to collect it - I thought you always had to collect it. It might be worth following up with An Post on it too if you believe it was intercepted in the post.....they might notice a trend if there's similar reports in the same area.

paulc2

dellas1979 wrote:

I would think someone had intercepted the first card that was sent and the PIN also.

So, while you were thinking they were just "lost", they were in fact stolen. The card wasnt cancelled (you never got a 2nd new card, even though you told AIB). Do you live with someone/people or any idea how they could intercept your post?

Yes, but there was no PIN sent with the first card! I was told to continue using my original PIN (in my head) - this is the whole thing - I don't understand how the card was used with no apparent access to my PIN. Only 1 PIN was ever sent to me throughout this whole saga, and I received it. It hadn't been tampered with or anything. I handed this back to the bank to prove that the PIN had not been compromised. I don't share with anyone.

Here's a quick summary:
1) Card #1 posted to me without PIN
2) Card #1 not received
3) Card #1 cancelled [no fraudulent transactions so far]
4) Card #2 with new PIN ordered and posted to me separately
5) Card #2 not received
6) New PIN received [around this time the fraud began]

So, (apparently) neither the old PIN (in my head) or the new one was compromised, but they still got a hold of it somehow (if they managed to use it in several ATMs, they must have known the PIN) - but how?!

I'm well and truly baffled by this one.

notahappycamper

paulc2 wrote:

Yes, but there was no PIN sent with the first card! I was told to continue using my original PIN (in my head) - this is the whole thing - I don't understand how the card was used with no apparent access to my PIN. Only 1 PIN was ever sent to me throughout this whole saga, and I received it. It hadn't been tampered with or anything. I handed this back to the bank to prove that the PIN had not been compromised. I don't share with anyone.

Here's a quick summary:
1) Card #1 posted to me without PIN
2) Card #1 not received
3) Card #1 cancelled [no fraudulent transactions so far]
4) Card #2 with new PIN ordered and posted to me separately
5) Card #2 not received
6) New PIN received [around this time the fraud began]

So, (apparently) neither the old PIN (in my head) or the new one was compromised, but they still got a hold of it somehow (if they managed to use it in several ATMs, they must have known the PIN) - but how?!

I'm well and truly baffled by this one.

PIN sent twice you got 1 and the other 1 was intercepted along with the intercepted card or when the new card was intercepted the person who intercepted it rang the Bank and said the PIN was never received and asked for a new one to be sent out and then intercepted the PIN - they could work in a sorting office or could be the postman?!

I think everyone knows what a PIN slip looks like so they know what to look out for.

hawker

Have you or the Guards checked the CCTV images in any of these places your card was used?

Might be worth considering.

paulc2

I've reported it to the Gardaí, so I'll let you know the outcome...

Thanks for the replies.

All the best,

Paul.

MOH

hshortt wrote:

You must have given your name though? Chances of two people with the same name picking up from that branch would most likely be limited. That said, you should have been.

Cheers

True, but if anyone overheard me on the phone arranging to collect it there, they could have chanced it.

MrPudding

Was it a new pin or pin reminder?

Skimming seems the most like method to be honest, then the pin becomes irrelevent.

MrP

Cabaal

nipplenuts wrote:

Places like Tesco, at the self service, you don't need a PIN.

actually some of them do now, they upgraded some of them I've notiiced