Ripped Off

April 07, 2006 | 25 Comments

This is a bit of a cautionary tale, one that’s not finished, unfortunately, but something I need to talk about to make me feel better.

I’m still in Vegas, CTIA was alright, but not really what we envisioned, but not too bad. I’m sure I’d feel a bit better about it if I’d not lost a really large chunk of change. No, I wasn’t gambling! Someone managed to steal my Visa check card and they also somehow figured out my PIN.

I’m still trying to figure this one out. Brian seems to think it was some kind of complicated scam where someone watched me get cash, memorized my pin and then later stole my card. I’m not sure if that’s what happened but it seems as plausible as any other option.

The strangest thing is that I still have my wallet, it’s just my card that’s missing. So I’m wondering if my wallet was lifted, the card then pulled out and the wallet put back. It’s a stretch, but I’ve heard pickpockets are pretty good and I was in some crowded rooms so it’s not impossible.

Now, why would a thief do that? Well, so that they could get maximum usage out of my card before I called it in cancelled, I guess. That makes sense, I didn’t notice it was gone until yesterday afternoon. Even with all that, I still don’t know how it could have happened. I mean, I supposed I could have left it in a cash machine (I got cash out twice the day it went missing) but how then did they get the PIN?

Something else strange happened that night. My cell phone went on the fritz, the battery just sort of stopped working. Could it be possible that the two are related? Again, to ensure I didn’t get the card shut off right away.

It’s all pretty mind boggling and I’ve just about given up trying to sort it out. Now I’m on a quest to get my money back. Since the transactions (there were about 80 of them) were all PIN based there is no automatic guarantee that I’ll get my money back. Which makes sense, I guess, as there is no hard evidence. However there is a ton of circumstantial evidence that supports my card being stolen. Things like the 5 charges in a row for the same amount at Walgreen’s and the high proportion of grocery store type transactions. Oh and the sheer number. It’s way off any sort of normal pattern.

A few things I’ve learned through this:

ALWAYS guard your PIN. The only way this person (or more likely people) could have gotten the number is from when I entered it in to get cash. Not one single person knew that number, and I’m sure I didn’t tell anyone.
Don’t rely on the whole “zero liability for fraudulent charges” bit you hear from Visa. There is still a decent chance I’ll get some of the money back, but that guarantee doesn’t count for ATM and PIN related transactions.
If you’re traveling and get cash, be aware of your surroundings and if you can, take a friend. I was alone when I made my last transaction, which might have made me an easy target.
If you can help it, don’t carry a high balance in your checking account (not that it matters too much, they were able to transfer money from my savings last night) as the more you have, the more you can lose. I had the horrible luck of just a few days back depositing a bunch of money to pay my taxes. All that is gone.

Wish me luck on getting my money back. I think I’m going to need it.

Filed under: Life
Keyword Tags: Visa fraud

Comments

1. Nathan Smith said:

Wow, that’s a crazy and very tragic tale. It sounds to me like if it was a scam, these guys were pros, and there wasn’t much you could’ve done anyway. Still, best of luck in clearing your name and your credit rating. I’m not sure how much help I could be, but if there’s anything I can do, let me know. If it came to it, I’m sure the web community would rally around you (worked for Kottke).

Posted on April 7, 2006 05:46 PM | #

2. David Chen said:

It does seem really amazing that they managed to do all this. I’m sorry to hear that it happened, and I wish you good luck getting your money back.

Posted on April 7, 2006 05:46 PM | #

3. Keith said:

Thanks guys. In doing a bit of research it seems like I should get the majority of the money back. The law seems to work that as long as I report it early and provide them with what they need to look into it, I shouldn’t be liable for the charges. Plus, some of the charges came after I first reported the loss, so that should help my case.

Still, well, see.

Posted on April 7, 2006 05:53 PM | #

4. Mike D. said:

Sorry to hear about that. As I said the last time we were in Vegas though, Keith, before you let her into the hotel room, make sure that a) your wallet is locked in the hotel safe, and b) you agree on a price beforehand.

Also, did you check to make sure you still have both your kidneys?

(Very interested to know what actually happened though… please post a follow-up when you know.)

Posted on April 7, 2006 05:57 PM | #

5. Keith said:

Mike – LOL. I did all that! ;0)

(It’s a good sign that I can have a sense of humor about this I guess. If you knew how much money was involved…)

In all seriousness, I tend to doubt I’ll ever know the full story. I mean, it’s hard to think about how it was pulled off, but at the same time I don’t really see how it could be a coincidence or dumb luck. I was thinking at first that I must have just left my card in a machine. Still possible I guess, but how then did they get my PIN?

Questions, questions…

Posted on April 7, 2006 06:34 PM | #

6. DarkWulf said:

This might not be what happened, but if I had to guess, perhaps it was a modified atm/cash machine?

I’m not sure if its actually been done in real life, but apparently its feasible to replace the front end of an atm/whatever so that the card reader and key output are stored (sort of like a faceplate that then pipes everything into the machine proper)

But thats pretty farfetched as well.

Posted on April 7, 2006 06:45 PM | #

7. nortypig said:

The pin just needed to be scanned with the proper device. Apparently this is big underworld stuff nowdays, they can actually scan your card while its even in your pocket.

So say they did lift your card its a small step to scan it for the pin.

The next alternative is they steal your card and plain identity theft comes into play. They convince the bank they are you and get the pin. I’d guess experienced criminals in this area could get a lot from the other contents in your wallet. Maybe you were in the shower when someone came into your hotel room - any previous tenant could have a key or anyone working there - knowing you’re in town for a conference.

Anyway just some room for the thought processes there Keith, its a hard one to nail down. The phone battery thing could be a clue if you had it in your pocket when something scanned the card… but I’m not that techie to know such things… cheers and good luck with it. Sorry to hear you were ripped off.

Posted on April 7, 2006 07:00 PM | #

8. Daniel Nicolas said:

DarkWulf is probably right.

The alternate faceplate is like a keylogger for an ATM. I’ve seen the PoC for it, and it works very well.

I’ve also watched people do proof of concept schemes involving two people, where one acts as a visual distraction so you don’t notice the very average-joe person watching you put in your PIN, or quickly video-taping you put in your PIN.

It’s scary and it sucks. I hope you get your money back.

Posted on April 7, 2006 07:02 PM | #

9. Keith said:

Wow. Interesting theories. I will say the cash machines down here are pretty sketchy in places. It sucks to know there are a whole plethora of ways this could have happened. I know one thing. I’m going to avoid using my cash card at all next time I’m on the road. I’ll bring more cash, and lock most of that up in my room when I go out.

Posted on April 7, 2006 07:16 PM | #

10. Jeff L said:

wow man that sucks - sorry to hear about it. I’ve not been to Vegas yet but I’ll keep your story in mind whenever I end up going….

definitely post a follow up when you get more info.

Posted on April 7, 2006 08:22 PM | #

11. annon said:

Ok man, I’ll tell you how they got your pin.

Shadowing. Its just really that simple. You typed your pin in on the ATM and they (quite skillfully) swiped your card.

Shadowing is not hard, I have shadowed my bankers password (quet314 - read: cutie pie) and then shaken my head as she walked to speak with a manager… leaving his computer unattended. I know the PIN numbers for the offices of two major retailers in the Austin area who have thousands of dollars in cash in the store. (know the pin, no alarm)

All it takes is a quick eye and good mind, it helps to remember the pattern and replay that in your head.

And, here’s the bad part, you will never see a shadower… you would think they would be right behind you but they could be as far as 15 ft away with the naked eye and hundreds with surveillance tech.

The good news is, with all the ATM withdraws, they should be on camera… the bad news is that in Vegas, good luck finding them… they are probably on vacation just like you :)

Good luck with visa.

Posted on April 7, 2006 08:55 PM | #

12. kf said:

Some interesting stuff, especially the last comment. I can’t believe what people have lowered themselves to.

Another strategy is too not use your debit card at all (get enough cash before your trip) and just use a credit card. If somoneone steals your credit card, Visa/MC will be more sympathetic to false charges made to it and not hold you accountable for it. Debit cards have different rules.

Good luck and stay alert, especially in places like that. There were probably many others in that week who went through the same hell. I had my wallet stolen twice, both right after birthdays with fresh cash. Good luck!

Posted on April 7, 2006 10:00 PM | #

13. Steve Ganz said:

Damn, Keith. So sorry to hear about this.

Found this piece at Snopes about the card scanner that DarkWulf and Daniel were talking about. Crazy!

What a wake-up call. I appreciate you sharing the story. It really has raised my awareness.

Posted on April 7, 2006 11:57 PM | #

14. Nick said:

If it were me I’d start with Walgreen’s, as retailers generally keep detailed records of their “customer’s” transactions - including the cashiers name/id, date/time of the transaction etc.

At least then they be aware that one of their employees, may be involved in some kind of credit/debit card scam.

Posted on April 8, 2006 03:25 AM | #

15. Michael Moncur said:

The strange thing is that they bothered, by surveillance or whatever subterfuge, to get your PIN number at all - there are machines all over Vegas that will give you cash from a Visa check card without a PIN. But apparently what they really wanted was to shop at Walgreens. (?)

At any rate, good luck and I hope it gets straightened out quickly.

Posted on April 8, 2006 04:53 AM | #

16. Eoghan McCabe said:

DarkWulf said:
“… apparently its feasible to replace the front end of an atm …”

This happens very frequently here in Dublin, Ireland. A false panel is placed over the ATM machine which is an exact replica of the genuine front panel. Within the false panel is hardware that copies the data on the magnetic strip on your card and also a small camera that records you entering your PIN. This is saved within an internal storage device or is recorded remotely via a wireless link. The thieves then reproduce a card with your data and use your recorded PIN to extract your cash. You never know until you see your statement because you still have your card.

There have been many Romanian and Latvian gangs uncovered in Dublin by the police here. Shocking, huh? http://www.rte.ie/news/2006/0109/atmfraud.html

This isn’t what happened to Keith as his card was actually taken. Hope you recover your cash Keith!

Posted on April 8, 2006 06:24 AM | #

17. Rogerio Axel Enríquez Muñoz said:

Good luck, man. I don’t ever trust financial institutions and keep my wallet on a chain.

This seems to be on the rise globally. Locally I’ve heard more tales of pickpocketing here in Cuernavaca in the last week than in the whole 14 years I’ve lived here… including myself before I changed my wallet to one with a chain (13 years ago).

Posted on April 8, 2006 07:48 AM | #

18. Nick Fitzsimons said:

As has been suggested, they could get your PIN either from having a fake fixture on the ATM with a video camera, or simply by shoulder surfing; as your card has been stolen rather than cloned, it’s probably the latter. The general technique is that one member of the gang will shoulder surf at the ATM, and when they get a number they’ll signal an accomplice down the street who will lift the wallet. Taking the card and replacing the wallet is a weird one, but as you say it gives them a longer run before the card is cancelled.

I adopt a simple low-tech strategy to guard against this: when I’m entering the PIN my left hand holds my wallet directly over my right hand, covering my fingers completely, and I use multiple fingers to enter my PIN so they can’t deduce the number from the movements of my hand. That way somebody behind me or to the side doesn’t see anything useful, and neither does a camera if a skimmer has been attached to the ATM.

For the curious, there’s a Flickr set showing an example of a skimming device removed from a UK ATM. A similar device was recently found on an ATM near my home; not one I use, thankfully.

I hope you get your money back.

Posted on April 8, 2006 09:29 AM | #

19. Jesse Skinner said:

The card scanner thing happened to me a couple of years ago. I remember noticing there was a box in front of the scanner, but I just thought maybe it was broken, and hardly gave it a seconds thought. A few weeks later my card didn’t work. When I called the bank they told me what happened, and said all the money had been taken out.

But they were really helpful, they gave me a new card (and new pin) and even gave me overdraft so my rent would come out OK and I’d have some money until they got it all figured out. It was still a bitch, gave me a few days of having no access to my money, and then a few weeks before my account was back to normal.

VISA’s really good about fraud, though. Don’t worry, they’ll fix it for you. Just the other day, VISA cut locked my account because I had bought 3 plane tickets on the same day, and it seemed suspicious. Good luck!

Posted on April 8, 2006 01:47 PM | #

20. Jan Brašna said:

> “but how then did they get my PIN?”

Small camera, keylogger or inlay card scanner, these days you can find yourself in a similar situation even without your card missing, just simply cloned, unfortunately.

That’s the reason I rather use AMEX traveller’s checks, it’s more secure in similar situations.

Anyways - fingers crossed, I hope you’re gonna solve it with your bank quickly and without some sort of damage.

Posted on April 9, 2006 07:15 AM | #

21. STB said:

Everyone knows you are supposed to roll into Vegas with a phat pimp roll of Hamiltons and Washingtons for certain gentleman’s entertainment that goes on there, but stays there.

Posted on April 9, 2006 09:00 AM | #

22. Rob Weychert said:

Damn, Keith, that sucks. I got taken for about $1500 in online transactions last year, so I know how you feel. I still haven’t figured out exactly how it happened, but it wasn’t as baffling as your situation. After a crazy amount of paperwork and a useless police report, insurance did get me my money back, though. Here’s hoping you get yours back too!

Posted on April 9, 2006 09:28 AM | #

23. Matt May said:

If most of the charges are places like drugstores, odds are pretty good that you were the victim of a meth ring. The people who cook speed send armies of tweakers out to buy as much Sudafed and other drugs with pseudoephedrine as they can, so that they can extract the active ingredient. It’s called “smurfing,” and it’s why cold medicine is now behind the counter at QFC. They go after cards with PINs because they don’t have to show ID, and they can’t be tracked down based on their purchase records.

They were pros, definitely. Meth is huge now in Vegas, and this is one of the biggest scams.

Posted on April 10, 2006 06:54 AM | #

24. Jason Beaird said:

I know I’m a day late and… well, let’s just say I haven’t been keeping up with my feeds. That REALLY sucks and I’ll definitely be more careful with my debit card in the future.

You mentioned not to keep much money in your checking account and that the scammers actually transfered money from your savings. One thing my wife and I do that would prevent this is keeping our savings separate from our checking. You should check out the American Dream Savings account at EmigrantDirect. Not only is it more secure by having it separate from your checking account, but they just raied their interest rate to 4.5%!

Posted on April 17, 2006 08:29 AM | #

25. Keith said:

Thanks for all the comments. Here’s a bit of an update.

I sent in a request to dispute the charges. I had to write up an explaination and outline each individual charge. The bank then called me for a quick follow up where they had me clairify a few details. A few days later I was provisionally given my money back. Now the bank issues an investigation. They’ll be pulling video records and such but chances are this is the last I’ll hear of it as my part is pretty much over.

I’m not sure what they do as far as going after the people who used my card. I expect they’ll do what they can. It is good to know that it’s not my problem any more and that people more equipped to deal with this kind of thing are taking care of it.

For me, I’m going to be MUCH more careful with my debt card in the future.

Posted on April 17, 2006 04:40 PM | #