ATM ripoff uses glued-down keys

ATM crooks in San Francisco have a clever trick: they glue down the ENTER, CANCEL and CLEAR buttons on an ATM, and wait for customers to go into the bank to complain. The fraudsters then complete the transaction using the on-screen equivalents -- the victim having already keyed in a PIN -- and skip away before the victim comes back out.

Since January, there have been four such thefts in the Richmond District alone, Corriea said.
"And you have to figure it's not always reported to us," Corriea said.
Often, bank customers don't notice the thefts for days, San Francisco police spokesman Officer Albie Esparza said.
"Best thing for consumers is to monitor their bank account," Esparza said.
There are several nonviolent ways crooks can steal cash from ATMs, but the glue method is less risky, Corriea said.
A thief caught applying glue to an ATM would be slapped with a misdemeanor vandalism charge, but likely won't face a felony fraud charge because it isn't easy to prove that the crook intended to steal, Corriea said.

Glue-gun goons target unwary ATM users (via Schneier)

(Image: Glue, a Creative Commons Attribution (2.0) image from kodomut's photostream)

I write books. My latest is a YA science fiction novel called Homeland (it's the sequel to Little Brother). More books: Rapture of the Nerds (a novel, with Charlie Stross); With a Little Help (short stories); and The Great Big Beautiful Tomorrow (novella and nonfic). I speak all over the place and I tweet and tumble, too.

MORE: Business • Gadgets • ripoff

More at Boing Boing

Ants and Stars: Bruce Sterling and Jasmina Tesanovic visit the Sardinia Radio Telescope in Italy

The Snowden Principle

TEKNA2007

And some people still don’t believe in evolution.
Anonymous

I’m sorry. Any time someone is dicking around with a ATM machine, their intent is obviously to STEAL MONEY!!!
Anonymous

I just called AMEX about replacing my card. I was at a restaurant earlier and sense that I needed to keep track of my card throughout the process. The young kid swiped my card though the register and then, without missing a beat, move his hand down pocket level and acted like he was wiping the card off.
quail

Read over the summer of 2010 that crooks are also using paper towels as a low tech way to grab money. They’d shove paper towels into the money slot in such a way that the paper wasn’t obvious. When someone tried to get money out, the cash would hang up inside the machine. While the victim went off to go to the bank or made plans to tell someone about a malfunctioning ATM, the crook would fish out the paper towel and the cash.
BB

I don’t understand why more people aren’t charged (with anything), or that these machines aren’t regularly monitored and repaired. Aren’t there surveillance videos at all of them? Can’t the banks tell when someone is attaching and positioning mirrors, etc? Why do the banks have no culpability when a customer is eventually ripped off? How often do they examine these machines?

I’ve gone to using only credit cards, or cash that I withdraw from the bank directly-old school. The banks don’t really care enough about you getting ripped off, in my opinion.
- Anonymous
  
  ” Aren’t there surveillance videos at all of them? ”
  
  Yes. Yes there is. More on that later.
  
  “Can’t the banks tell when someone is attaching and positioning mirrors, etc? Why do the banks have no culpability when a customer is eventually ripped off? How often do they examine these machines?”
  
  Machines are examined no less then three times a day for ATMs attached to a brick and mortar bank and examined daily for stand alone machines. Bearing in mind a reasonable ATM network, owned by a bank, could be over 6000 ATMs. To check every day.
  
  Ultimately, that’s not important because your premise is flawed. The banks DO have culpability and more often then not the customer is reimbursed. In the event of out and out fraud like this, they are almost certainly given their money back because banks are insured.
  
  It’s fascinating how your anger is directed at the bank not the criminal.
- Anonymous
  
  @1 (bb):
  
  monitoring and repair: because this would cost the bank money? a few weeks ago there was an atm at the main office building of my bank that looked broken but did in fact still work. it remained so for four weeks after my complaint. police told me that “skimming looked different than this” and the bank promised to repair that darn thing right away.
  
  but wrt the article above: that’s a nice hack. pretty evil, but the logic is simple and quite effective.
  
  .~.
GuidoDavid

!!!!!
Finally!

Locally somebody has been doing that for 8 years or so. I did not understand why some jerk was gluing the keys. Luckily I always wait until the system kicks me out.
optuser

You would think the ATM interface would read three simultaneous key presses for more than a few seconds as “bad”, take itself out of service and notify the monitoring station.

Durrr…
- CastanhasDoPara
  
  Good catch, but…
  
  It’s probably more of a problem with the way the lead-in is written. Certainly gluing the keys “down” would cause a malfunction to the point where a user wouldn’t even be able to enter their PIN. Likely, the crooks just glue the keys, not glue the keys down. It’s amazing that one word can sometimes cause big differences in understandability.
Anonymous

You’d have to glue the keys up then release them with solvent to finish entering the money request, ATMs here require you to hit enter after you’ve typed in how much you want.
Anonymous

good thing no criminals read BB! is this information or instruction? lol
lyd

Why is this a theft from the customer and not a theft from the bank? The bank is still in possession of the money when the theft takes place.

Should this be considered money still “in” the bank and therefore FDIC insured and all of that?
- Tynam
  
  Why is this a theft from the customer and not a theft from the bank? The bank is still in possession of the money when the theft takes place.
  
  Because then the bank would be at risk of losing out, and they’d have to put more effort into security. In this case that’s not actually so bad, but they don’t want to set a precedent.
  
  It’s the same principle by which “identity theft” usually means “theft of money that you’d entrusted to the bank for safekeeping, but somehow it’s your problem not theirs.”
  - PaulR
    
    Mitchell & Webb Sound – Identity Theft
    http://www.youtube.com/watch?v=CS9ptA3Ya9E
Anonymous

Crooks and thieves do all kinds of shenanigans basically in full view of security cams, and ‘it isn’t easy to prove that the crook intended to steal’.

My door closes as I go out to pick up the mail while in a towel, and video of my attempts to jimmy my window as the towel falls is on Youtube in minutes, and police arrive to taze me.
Or crystal-clear seccam stills from protesters during demonstrations and protests end up being quite useful to arrest teens. Soemthing’s fishy in here.
jesseg

I don’t get it. If there are on-screen equivalents of the buttons for the scammer to press, why wouldn’t the customer just use those?
- CastanhasDoPara
  
  Because a lot of people are not tech savvy still. And also, I would think that most people when presented with physical buttons would opt for those instead and not even realize there was a virtual equivalent. Or they get frustrated and leave to inform the bank about the problem.
  
  This is actually a pretty clever little scheme. Good thing it’s been exposed and more people will now be wary of this ploy too.
Anonymous

That doesn’t make ANY sense – just wait 30 sec or so and the machine will spit your card back out. Glues keys or not. And Logic fail: If there is a screen equivalent key available why doesn’t the ATM user not fall back on them?
HD

The law can be written to ignore intent, apparently. Herping in California, the picking up of snakes and other reptiles and amphibians, is illegal without a valid CA fishing license whether or not you plan to keep the creatures.
millrick

is this why we should all be using Glen Beck’s gold instead of cash?