Å®ÉúСÊÓƵ

Conclusive evidence emerged this week that money can be stolen from
cash dispensers with forged cash cards. A man convicted of credit card fraud
has explained to New Å®ÉúСÊÓƵ how, using published information and an off-the-shelf
machine costing less than £1000, it is possible to make working cards
in seconds. In a separate investigation, forged cards have been used to
withdraw money from Barclays Bank dispensers.

Thousands of customers complain every year to banks and building societies
that money has been removed from their accounts at cash machines without
their knowledge. Most banks deny that such ‘phantom withdrawals’ are possible.
Instead, some suggest that the cards and personal identification numbers
(PINs) must have been taken by family or friends.

But Andrew Stone, who is serving a prison sentence for using forged
credit cards in shops, says the only information needed to make a fake card
is the number embossed on a valid card. His testimony and the demonstration
that forged cards can fool cash dispensers will undermine the banks’ defence
in an impending court action in which hundreds of customers who say they
are victims of phantom withdrawals will challenge the banks’ position.

Stone agreed to talk to New Å®ÉúСÊÓƵ because he believes it is unfair
for banks to pretend to their customers that phantom withdrawals are impossible.
‘It is very easy,’ he says. ‘And whatever they do, there will always be
a way.’

According to Stone, the easiest way to forge a card is to ‘shoulder’
a genuine customer – looking over the person’s shoulder as the PIN is tapped
in. The next step relies on the person throwing away their receipt or balance
slip. Many banks still print the customer’s entire card number on the slip.

The forger then ‘writes’ the customer’s card number on the magnetic
strip on the back of a blank card using a machine that can be bought in
Britain for as little as £800. The machines and blank cards, which
cost only a few pence each, are freely available.

The magnetic strip must carry information other than just the card number.
But all cash cards conform to international formats which are laid out in
published documents. Knowing the formats, it is possible to construct a
fully functioning fake card. ‘The whole process once it is set up would
take just two or three seconds a card,’ says Stone.

The forger then puts the fake card in a cash machine and enters the
‘stolen’ PIN. The dispenser pays out and debits the customer’s account.

‘Barclays is the easiest,’ says Stone, partly because of the simple
format recorded on its cards and partly because it prints the full card
number on receipts. BBC’s Newsnight programme this week showed how a fake
card can be used to take money out of a Barclays account which the programme
had specially opened. The Newsnight reporter stressed that the fake card
was made using only the number printed on the receipt.

‘This is very, very serious and something we should sort out straightaway,’
said a spokeswoman for Barclays. ‘They obviously have done it.’ However,
she denied the programme’s claim that anyone could pull off the same stunt.
‘There are a couple of things they could not have done if they had been
ordinary fraudsters.’ A spokesman for Newsnight said Barclays’ position
reflected the bank’s complacency.

Barclays has always refused to accept that phantom withdrawals take
place. In letters to customers who complain it has replied: ‘If you did
not use the card, another did so, being able to take, use and replace the
card (in conjunction with the PIN) without your knowledge.’

A firm of Merseyside solicitors, J. Keith Park, is coordinating the
attempt by customers to sue the banks and building societies for phantom
withdrawals. It has received more complaints from customers of Barclays
and Lloyds than any other bank or building society. But the solicitors say
these banks are not alone. ‘We have complaints against every bank and building
society that operates the ATM (Automated Teller Machine) system,’ says Whalley.

The first recorded case of shouldering took place in New York in 1985.
It is easily avoided by not printing the full card number on receipts and
balance slips. Many overseas banks and some in Britain have adopted this
practice.

In March, banks and building societies adopted a code of conduct which
limits customers’ liability to £50 if the bank accepts that the withdrawals
were fraudulent. It is up to the bank to show that no fraud took place.
The scheme, however, does nothing for customers whose dispute with the bank
started before March.