I agree. Simply disabling an account that was used at more than one ATM within a certain timeframe, based on geographic area, would have limited the damage. Similar to how cell phone cloning is detectable.