ATM thieves use glue and 'tap' function to drain accounts at Chase Bank
abc7news.com
abc7news.com
> Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.
I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin...
This bit is interesting though:
"So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out."
How can a customer log out in these circumstances?
I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan.
It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction.
The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators.
This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location.
No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization.
Plus it gives me, the customer, additional leverage in the case where they do screw up.
I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz.
No jury would allow these withdrawals to stick on the original account.
Having to log out for contactless but presumably not for a contactful transaction looks like a huge UI oversight.
> "There are 52,258 cash machines in the UK, of which about 8,400 – or 16% – support contactless withdrawals,"
Although I see the question "Which countries are leading the way in adopting contactless ATMs?" goes unanswered.
> The rollouts will go largely unnoticed as adding contactless capability to an ATM doesn’t really provide any additional services.
Certainly unnoticed by me!
[1] https://www.retailbankerinternational.com/analysis/david-gri...
PINs could be bluetoothed to the attacker.
The main problem here is not requiring proof of the card for each transaction.
This is mostly all on the bank.
"If you are in a contract containing an arbitration clause naming the AAA Rules, you may still be able to bring your dispute in small claims court instead of arbitration, as long as the claim falls within the jurisdiction requirements of the small claims court"
< https://www.google.com/search?q=do+abitration+clauses+cover+... >
But arbitration is also your friend, probably even easier than small claims.
Long story short, I deposited a valid check, but chase fraud dept closed my account with close to 13k in it. I made a lot of trips to the bank, countless hours on the phone and what I found is different departments don’t communicate or share data.
Every time I call or go to the bank the first agent would say a check was mailed, after I insist they never mailed anything, I get transferred to someone else that says they have not received the requested document - which I had submitted in person at a local branch. This process repeated few time and got escalated to their “executive office” twice - which restarted the process.
It felt like I would never get my money and after two months I filed a complaint at CFPB. About 3 weeks later chase magically found all the documents and issued a check for the balance.
I’m not sure what is going on at this bank but they should not be allowed to treat customers like this. Just read this from the linked news article
> Victims said Chase would not review surveillance video because the amounts were below $5,000.
Why wouldn’t chase review videos if amount is less that $5000?