Fraud experts said last week that they would not use their cards at petrol
stations because of a spate of cloning cases since January.
Criminal gangs are thought to be targeting garages because they are often
manned by only one person and have a large turnover of staff.
Fraudsters fit “skimmers” to the chip and pin machines, sometimes with the
knowledge of the petrol-sta-tion employee, or when he or she is distracted.
These devices read customers’ card details and allow the criminals to make
counterfeit copies. The chip cannot be cloned, but crooks can use the cards
abroad in countries that have not adopted the chip and pin system.
Victims have had money stolen from their accounts using cash machines as far
afield as Thailand, India and Jordan, showing the international scope of the
problem.
Their problems are exacerbated by the slow response of banks when they try to
recoup the money.
In some cases it can take a month to get a refund despite the victim being
cleared of any wrongdoing, during which time the customer may be racking up
overdraft charges and living off his or her savings.
Danny Harrison of CPP, an identity-protection firm that works with banks
including HSBC, Barclays and NatWest on security issues, said: “I will stop
using cards at petrol stations. You have to consider the risks at the
moment, and it seems petrol stations are a particular target.”
He said he would use cash instead, but admits this may not be possible for
many people.
Saar Drimer, a security expert and researcher at Cambridge University, also
said he had stopped using his cards at petrol stations. “The more we look
into the ways that you could be defrauded, the more worrying it becomes.
Cash is always better to use because there is no record and you’re not
giving away any of your secrets,” he said.
Since the beginning of this year, hundreds of people have had their cards
cloned at petrol stations up and down the country. More than 100 people fell
victim at a petrol station in Edinburgh, while in Humberside, police are
investigating a forecourt after receiving 90 calls from card-clone victims.
Other cases have been reported in Bristol, Portishead and Leeds.
Detective Inspector Richard Budd of Avon and Somerset Police’s serious crime
group said he had dealt with three “significant operations” involving
credit-card fraud at petrol stations since January.
“Fraudsters tend to target anywhere there is a large turnover of staff, such
as petrol stations or restaurants,” he said.
Jemma Smith of Apacs, the payment and clearing authority, said: “Fraudsters
seem to be targeting petrol stations, although there is no clear reason why.
It may be because petrol stations are often open 24 hours and manned by a
single person, so it’s easier to be discreet.
“The petrol industry is wide awake to this problem, and we continue to work
with it to improve the situation.”
Antony Clark, 44, a salesman from Hull, had three cards cloned at the same
petrol station within the space of 10 days. He had £900 stolen from his
Lloyds TSB account and £96 from a Capital One card on January 5. He also had
£200 taken from his Barclaycard on January 15.
Transactions had been made in Jordan and America — both countries where chip
and pin has not yet been adopted.
Lloyds TSB refunded him nine days after the incident, but Barclaycard took 27
days. He is still waiting for a refund from Capital One.
A Capital One spokesperson said: “We will be contacting Mr Clark to make a
refund and to understand and resolve any outstanding issues.”
A Barclaycard spokesperson said: “Card-fraud cases are usually resolved within
a month, but some cases can take longer to carry out a more thorough
investigation.”
However, Mark Radin of Bank Charge Auditors, which helps victims of card fraud
reclaim money from banks, said: “They tend to start from a position of
blaming the customer and they seem to make every effort to make a claim
difficult.
“They always say you have to have taken all precautions when using your card,
otherwise you are liable, but there is no way of proving this. How do you
prove, for example, that you have never written down your pin or made sure
nobody was looking over your shoulder when typing in your number?”
Radin, who receives more than 30 queries from card fraud victims a month, adds
that in 90% of the cases he receives, banks have told victims that they will
not refund the money taken from their accounts — although they eventually
back down.
Gillian Lewis, 62, from Deal, Kent, was targeted by fraudsters at her local
garage. Her card was cloned and used in Germany to make withdrawals of more
than £500. Her bank, Halifax, told Lewis that she would have to wait months
before they would pay back the money.
“I didn’t understand why it would take that long,” she said. “I could easily
prove I wasn’t in Germany at the time, but they said they had to pass it on
to the fraud department, and that it could take months.”
Lewis was forced to eat into her savings while the situation was resolved.
Halifax did, however, pay up after three days, but Lewis feels she was put
through a lot of stress, thinking she would be without funds for months.
Sean Gillespie from Hull had thousands of pounds taken from his account which
he intended to use for a deposit on a house. His card was cloned at a Jet
petrol station. Though he received the money from Halifax after two weeks,
he says it took a lot of wrangling.
“At one point I was told it would take another 10 days to resolve so I
demanded to see a manager. After speaking to him, I received my money the
following day. So they can do it quickly if they want to.”
Counterfeit card fraud cost the British consumer £53m in the first half of
2006 — an increase of £7.4m from the same period the previous year,
suggesting that criminals are increasingly finding ways round chip and pin.
Detective Sergeant Dave West of Kent Police, warned: “Be vigilant in how you
allow your card to be handled.
“Do not let it be removed from your sight, protect your pin, and check your
statements.”
PROTECT YOURSELF FROM FRAUD
- Never give out your pin. Neither your bank nor the police will ever ask for
it. Never write down your number and remember to shield it when keying it in
at a petrol station or restaurant.
- Check paper and online statements from your credit card firm or bank
carefully and query any transactions you do not recognise. You should also
check your credit file regularly by contacting a credit reference agency
such as Callcredit, Equifax or Experian.
- Buy a crisscross shredder and use it to destroy any old documents that
include your bank or personal details. Sales of document shredders have
rocketed in the past 12 months. However, documents cut into vertical strips
using a linear shredder are easy for criminals to reassemble.
Being Christmas time I was keeping a close watch on my monies. Checked my balance one day to discover it was only £2.14. Got straight on to the Halifax and they told me what was pending. These withdrawals were from an ATM machine in USA. So I cancelled my card and pin. Then I discover withdrawals from the USA and Pakistan on the same day. The Halifax kindly increased my overdraft to cover Januarys bills whilst they investigated. My praise goes to the Halifax because a few days later my account was reinstated to full amount. I guard my details with my life but it just goes to show it can unfortunately happen to anyone. Be Careful.
Shaaron, Lancing, West Sussex
I have just been a victim of the Gargae credit card scam, they tried to withdraw cash in South Africa and Austraila but luckily they must have got the number wrong. The garage in question has a camera pointing to the keypad on the cash machine - where I presume they watch the number being keyed and then scan your card when you pay for the petrol inside of the garage. I know of about 60 local cases so far and both of my immediate neighbours have been done and lots vast amounts of money. As this is so widespread I don't know if the fraud teams can cope. I also know this has been going on for a while now. Why don't the banks refuse card facility to the garage in question and at least remove the ATM??
Maria, Ramsgate , Kent
Have just discovered £3110.17, probably not the final tally ! taken from my account by cloned debit card..having recently used a "new to me" Shell garage for the first time..one call to my bank manager at 08:30.. he gave me their fraud line number...was told this amount will be refunded within 7-10 days, will have a replacement card within 6 days and I only have to sign one document...and advised to use cash at all petrol stations, which I most definately will from now...thank you LloydsTSB
Dee , Hurst Green , East Sussex
I had my card cloned last year, so now I pay for almost everything with cash. I use cash in a lot of places, but I've noticed that the only places that short change me are petrol stations. It's been happening quite regularly. They nearly got £10 of mine the other day and I'm sure I lost £2 at one place last week.
Could short-changing be replacing card fraud now that card cloning is more widely known about? Or am I just being paranoid?!
NT, London,
found a debit card in cash machine at 5.30 in the morning phoned number on back of card lloyds tsb . asked for card number all they said was thanks can you cut it up and bin it
is this the best the banks can do
tony, blackburn, uk
I think the petrol stations should be held responsible for the cloned cards. It seems to be rife in garages at the moment. It seems that this is the weak link and the easiest place to clone. If they had to pay the customers back for the stolen money they might then realise that they need to step up their security. Everyone you speak to these days has had it done to them or they know someone. something has got to be done it seems that garages are getting away with it.
kay, Bisley, Surrey
I take it this crime is mainly conducted by Foreigners usually East Europeans or Asians who enter this country so easily with the prime aim of robbing us blind and the government as usual sits on the fence.
bruce, manchester, England
I've now reverted to cash at petrol stations and restaurants after my card was used in Egypt. But top marks to Tesco Visa who called me 9am the day after, cancelled the card and issued a new one in 4 days. The bogus payment never reached my account. They also added the new card to my on line servicing and organised the transfer of clubcard points. They made it very painless. But like others I worry about the lack of privacy when entering a pin - especially at Waitrose where the tills are usually in front of plate glass windows visible by a huge audience and no doubt by cctv.
Alan Lucas, Surrey, UK
I spent £450 on my Morgan Stanley card booking some air tickets on-line with Air Adria in Lubjiana. Before I had even closed my browser, Morgan Stanley were on the phone wanting to know if the transaction was bona fide. They cetainly seemed to be on the ball for potential fraud - I was most impressed.
CRT, Winchester, UK
The comment "Chip & Pin is still far, far less likely to end in fraud than chip and signature by the way" misses the point that if you sign the fraudsters cannot use the cloned card in an ATM as they don't have the PIN. As a criminal which would you sooner have, cash (from an ATM with a C&P card) or goods that you have to re-sell (from a shop with a C&S card). It's a no-brainer.
Also with a Chip & Signature card I can prove that is not my signature when a criminal has used my card fraudlently, but with Chip & Pin it is impossible to prove that I didn't disclose my Pin.
PM, London,
This article states that fraud experts, plural, "would not use their cards at petrol stations because of a spate of cloning cases since January". Yet only one of the experts is quoted as saying this.
Which of the other experts have actually said they will stop making such transactions?
I strongly beleive that cards are a safer, more convenient option than cash, if basic security measures are followed - keep your PIN concealed!
Remeber that although it may take banks a while to refund card fraud, if it was cash that is stolen you won't ever get any refund? If the fraud takes you overdrawn or incurs charges, simply insist that the bank refund these - they always will.
Carl Boumford, Edinburgh,
Yup, it happened to me too, at a petrol station in Hertfordshire. I bought some petrol, and a few hours later someone in Kuala Lumpur was taking £450 out of my account...
Elisabeth, Welwyn Garden City, UK
In South Africa you can have the credit card company send your mobile a txt message every time your card is used.
Iain, Northants,
One way to reduce the risk is never to use a debit card at any point of sale
terminal, always use a credit card that is not connected to your bank.
In the event of fraud the credit card company must prove that you are to blame.
Let them do the work...
Graham Nash, Cookham on Thames, Berkshire England
Is it safe to use a credit/debit card which is inserted outside into the petrol pump, and which does not require a PIN? I think it would be difficult to fit a skimmer to these. At my local Tesco I insert the Tesco card, and then a debit card, and fill up, and then the debit card again to get a printed receipt.
GW, Southampton, UK
This week, my card was blocked because I tried to take money from an ATM in Bucharest where I live and work. I phoned Britain 3 times and was shunted from department to department before I finally managed to reach someone in a position to lift the block.
But the solution is simple. Each time money is taken from one's account, a message should be sent by e-mail telling you. All the banks need is an e-mail address that could be attached to your private details. All of this could be done with an automated system. No need for an increase in costly manpower.
Angus McFarlane, Bucharest, Romani
As per the comment above - First Direct also refunded my money extremely quickly and professionally all in the space of 5 days.
The advice therefore is bank with somebody who resolves what is an inevitable occurance in a streamlined and effective way.
(and Chip & Pin is still far, far less likely to end in fraud than chip and signature by the way - It has been used in Australia a couple of years before it was rolled out in the UK for debit & credit cards)
Consumer A, Melbourne, Australia
Why not make the petrol stations liable for keeping their card readers safe? Impose some penalty on them if it emerges that the details were stolen from there.
Here in Russia, we use Citbank and every time we use our card in the machine, an alert is sent within a minute to our mobile phone showing the amount deducted.
Alice, Moscow, Russia
Technology has been a wonderful thing to speed up transactions and allow private access and control online. Avoiding the issue is not a solution, we must continue to support banks and the task of keeping things secure.
Ade, chester, uk
I now use cash for nearly all transactions. When I am forced to use a card (internet etc) I use a prepaid card with a small balance. Not only do I spend far less as a result, I have no credit card debt, have no risk of ID theft or card fraud and feel no less secure carrying a bit more cash. My cash transactions are private and banks will not be leaving my confidential details in their rubbish. The banks have led us by the nose into using them and ripped us off (as evidenced by their illegal charges, lack of care with our ID and insecure systems.) Stop using them and stick to cash, you'll be alot happier as a result.
john smith, manchester, UK
It would be quite simple to automatically text or e mail the cardholder everytime the card was used. Within moments of the card being used fraudulently it would be detected and the card could be cancelled.
j davis, bradford, uk
In many petrol stations, a pin number is not even required-you just put in your card it gives it back and there isn't any identification needed. This also needs to be tackled-as any stolen cards can be used to fill up before its reported missing.
Roz, Plymouth, Devon
Although on the face of it chip and pin is more secure. There is a store locally to me in Yiewsley middlesex where you cannot move the pin pad to hide your pin. It is held in a rigid cradle which is so tight against the perspex screen bt the till, that the pin pad cannot be moved or removed. Really Tesco's you should know better!
sharon knight, uxbridge, england
About three weeks ago I was rung at night by my Bank, First Direct. They had spotted cash being taken from my account from a machine in Hong Kong. I am very very careful about protecting my pin at cash machines but they had obtained the number probally as I keyed in at one of two large petrol stations on a route I use every weekend. It was suggested a camera recorded the pin input ( the swipe machine in garages is usually in a fixed position on the counter) whilst my card was cloned. How did this happen without help from inside? TOP Marks to First Direct who stopped the card, sent me a replacement & refunded the money, all in 5 days !
Peter Clarke, Dursley, Glos
LH Paris is totally right - chip and pin has been operated for some time in France and is very secure. Do we have a different system here or are we just more dishonest?
Margaret Weston, Portsmouth, Hampshire
James, you say that the UK was the first country to roll out chip and pin - could you clarify exactly what you mean? I can't speak for other countries, but France has has chip and pin for a number of years.
LH, PAris,
BIN your PIN until the world is Chip & PIN or Chip & Signature compliant.
The UK was the first country to roll-out EMV (Chip & PIN) , and UK consumers are now paying the price.
The good Sergeants advice is sound. But how can YOU prevent hardward and software capturing your PIN?
A PIN is the key to instant cash via ATM's in the UK and overseas. Take away a PIN and you're solving half the problem.
BBC Watchdog covered liability issues concerned with Chip & PIN misuse. Their advise too was that Chip & Signature offered cardholders a much higher level of protection.
James, Scarborough, North Yorkshire