Ask Jenny Ross: How can we stop scammers from stealing our money at an ATM?

Question : I have always assumed that a debit card cannot be used to withdraw cash from an ATM in the absence of the PIN – so if your card gets stolen how can scammers use it to get money in this way, and how do you guard against it happening to you?

Even if you are unlucky enough to fall victim to cash machine fraud, you shouldn’t be left out of pocket

Answer: Scammers have a seemingly endless repertoire of techniques designed to part us from our cash, and these have become increasingly sophisticated: people are being duped by text messages that claim to be from Royal Mail, calls that appear to be from their bank’s phone number, and Whatsapp messages that look like they’re from family members. But older, lower-tech methods are still proving lucrative.

Card fraud at UK cash machines accounted for losses of £28.1 million in 2021, according to the banking industry body UK Finance. It’s a big number, but relatively small in the context of overall payment card fraud losses (£574.2m) and losses have been falling in the past few years, so there’s no need to worry unduly.

You’re right that you can’t withdraw cash from an ATM without entering your PIN, so in all cases the fraudster would need to have access to the genuine PIN and card.

One way this can happen is if someone has written their PIN down in a purse or wallet, which is then stolen.

Or thieves can simply "shoulder surf” – they hover over you to watch as you enter your PIN at an ATM or on a card machine and then steal your card at an opportune moment.

This might be done using distraction techniques – for example by telling you you’ve dropped something on the floor, and then grabbing your card from the cashpoint slot.

Fraudsters can also tamper with ATMs to steal cards or card details by inserting a device into the card slot to prevent the card from being returned to you.

To capture the PIN, they’ll either watch you enter it, or use a small camera attached to the machine. Once you leave the machine, the fraudster will remove the device and the card and then use it to withdraw cash.

They can also fit skimming devices which scan the information stored on your card’s magnetic strip.

As always with this type of fraud, for your card details to be useful, fraudsters need to get your PIN.

Once they’ve got that they can create a fake card that can be used with the genuine PIN to withdraw cash in certain countries where machines have yet to be upgraded to chip and PIN.

Some banks now offer contactless cash withdrawals, which still require you to enter your PIN but don’t need you to insert your card into the machine, meaning you’re not at risk from skimming devices.

But the easiest way to thwart cashpoint fraudsters is to fully cover your PIN when withdrawing cash from a machine or making a payment using a card machine. Be sure to protect it more generally by not disclosing it to anyone else or writing it down anywhere.

The good news is that even if you are unlucky enough to fall victim to cash machine fraud, you shouldn’t be left out of pocket as debit card providers are required to refund unauthorised transactions under the Payment Services Regulations 2017.

The most your bank can ask you to cover is the first £35 of an unauthorised transaction made on a stolen or lost card, unless it can demonstrate that you either authorised the payment, acted fraudulently, acted with ‘gross negligence’ or reported the unauthorised payment 13 months or more after it leaving your account.

Jenny Ross is editor of Which? Money