Fraudsters swipe your card details to get at your cash

Bank card fraud overall is decreasing, but you still need to be on the alert because the incidence of card skimming and “card-not-present” fraud continues to increase, the South African Banking Risk Information Centre (Sabric) says.

Bongani Diako, the spokesman for Sabric, says overall card fraud, including the use of stolen cards and false card applications, has declined over the past three years.

The banking industry’s losses due to the fraudulent use of lost and stolen cards fell from R92.9 million in 2009 to R37.2 million last year – a drop of 60 percent.

The main risk areas for card fraud currently appear to be card skimming, card-not-present fraud and lost or stolen cards. This pertains to all cards, including debit cards, cheque cards and credit cards.

* Card skimming: the theft of information stored on the magnetic strip on the back of your bank card through a skimming device, which can be either handheld or attached to an ATM. The bank card information is then used to manufacture counterfeit or cloned cards.

Itumeleng Monale, Standard Bank’s director of self service channels, says the bank’s policy is that any cardholder who has fallen victim to skimming will be reimbursed following an investigation.

“Our security department has recovered skimming devices attached to ATMs. The devices usually fit snugly over the card slot and the card’s magnetic strip is recorded as it goes into the ATM. There may also be a camera in place to record your personal identification number (PIN),” she says.

Monale says the authentic look of the devices makes them difficult to spot and remove. “To counter this, our ATMs are fitted with advanced security features to detect tampering or the attachment of foreign devices. We also regularly monitor and inspect ATMs for signs of tampering,” she says.

Diako says that while card skimming can occur at any place where your bank card is presented for payment, skimming incidents are commonly reported at ATMs, places of entertainment such as restaurants and bars, and even at retail merchants.

Jan Kruger, Absa’s national manager of operations and fraud risk management, says Absa’s card fraud investigators, together with the police, have made 177 arrests related to card skimming this year and recovered 26 handheld skimming devices.

Kruger says at ATMs in particular, criminals will distract you and swap or change your bank card, or swipe it through a handheld skimming device and hand it back to you without your even realising what has happened.

“In the process of distracting you, the fraudsters would have obtained or duped you into revealing your PIN. All this information allows them to remotely reproduce a fraudulent card for their use,” he says.

Monale says the main point of compromise occurs when your card is presented to a third party, for example, for payment at a restaurant. “A good rule of thumb is to never let your card out of your sight and to make sure you cover the PIN pad at an ATM when you enter your PIN,” she says.

John Simpson, the general manager of the office of the banking ombudsman, says that there is no scientific way to prove whether or not card skimming has occurred, and when faced with a complaint from a client who alleges that his or her card was skimmed, the ombudsman’s office has to decide if this was indeed the case based on the balance of probabilities.

“We look at whether the consumer could have mitigated his or her losses by regularly checking bank statements or if the consumer in fact contributed to the losses by accepting unsolicited help at a bank ATM or allowing their card out of their sight when paying at a restaurant or store,” Simpson says.

* Card-not-present fraud: this is when your card details are used online or over the phone without your actual card being used.

The increase in this type of fraud ties in with the growth of online shopping in South Africa, with consumers spending more than R2 billion on online goods in 2010. If you shop online on a website that is not secure, the chances of cyber-criminals getting hold of your card details increase dramatically and this information can then be used to commit card-not-present fraud.

According to the study “Online retail in South Africa 2011” by research firm World Wide Worx, the dramatic rise in online retail comes in the wake of an ongoing increase in the number of experienced internet users in the country.

Arthur Goldstuck, the managing director of World Wide Worx, says last year there were 3.6 million people in South Africa who had been online for five years or more. “By 2015, that figure will be 6.8 million – almost double the potential e-commerce market of today,” he says.

Rene de Villiers, the head of card risk services for Nedbank, confirmed the steady increase of “card-not-present” fraud.

“Some cases are picked up through our internal monitoring, in which case we immediately contact the cardholder directly to validate the transactions. If the cardholder denies the transactions, the card in question is immediately blocked and a fraud case is subsequently opened,” he says.

A new card is ordered at the same time that your current card is blocked and you should receive your new card within three days.

De Villiers says once fraud has been identified and a case has been opened, Nedbank tries to have the fraudulent transaction/s removed from your account within two working days.

“The fraud investigation can take anything from one day up to six months. In some cases, there are no leads to follow up. Normally it takes three days for money to be refunded or returned to the cardholder, but for disputed ATM withdrawals it can take up to two weeks for the money to be refunded or returned if there has been no negligence on the part of the cardholder,” he says.

This has implications for your credit limit – if fraudulent transactions go unchecked, you may reach your limit and find that you are unable to use your own credit facility. And if you do not pay the amount required on your credit card while waiting for disputed transactions to be removed from your bank account, your credit profile may be adversely affected.

* Lost and stolen cards: if your card has been stolen, the banks require you to report the loss to the nearest police station, and your bank may ask you for a police case and reference number. If you have lost your card through negligence, you need to report it to the bank as soon as possible to place a hold on your account and order a new card. If, for example, you realise that your bank card is lost but only report it to the bank two days later, and fraudulent transactions take place on your account during those two days, the bank may not reimburse you for your losses.

If you suspect that your card has been stolen for the purposes of cloning or skimming and has not been lost due to negligence, you need to lodge a formal claim with the bank in the form of an affidavit and a crime incident report after you report it stolen to the police.

Tips from banks to prevent fraud

Banks offer the following tips to keep both your bank card and your banking details safe from skimming and card-not-present fraud:

* When you make a payment with your bank card, check that the card you receive back from the cashier is, in fact, your card and has not been substituted with a dud card;

* Sign up for an SMS notification service to alert you to activity on your bank account. This will help you to quickly identify fraudulent transactions;

* Never give your bank card details to unsolicited callers who offer to sell you something over the telephone;

* Report a lost or stolen card to your bank immediately;

* Store the number of your bank’s lost and stolen cards hotline on your cellphone, so that you can contact your bank if your card is lost or stolen while you are away from home;

* Respond quickly to requests from your bank to collect new or replaced cards;

* If a replacement card does not reach you within the specified time, report this to your bank immediately;

* Check your monthly bank statements thoroughly and report any irregularities to your bank;

* Dispose of your bank statements in a way that ensures they cannot be read;

* Never force your card into an ATM card slot – use a different machine if you experience difficulties with an ATM;

* Make sure that no one is watching you when you enter your PIN – shield the ATM keypad with your free hand;

* Always choose an ATM that is in a well-lit and safe area;

* Do not allow anyone to distract you when you use an ATM and avoid making conversation while waiting to use an ATM;

* Never allow anyone to assist you at an ATM, not even a bank employee;

* Never share your password or PIN with anyone, not even a bank employee;

* Do not allow websites to remember your password – always press “no” when you are presented with this option;

* Load the latest anti-virus software applications on your computer;

* Ensure no one has unauthorised access to your computer;

* Do not make your passwords too personal – rather create passwords that have letters and numbers that cannot be guessed by anyone with access to your personal information;

* Always log off or sign off at the end of either an online banking or online shopping session; and

* If you are shopping online, look for a lock icon that tells you the website you are on is secure or that your bank card details will be kept confidential.

Microchip cards still being phased in

The new microchip card technology that is supposed to protect you from card fraud does not yet afford you a high level of protection because it is still being phased in.

Bank cards – that is credit, cheque and debit cards – with microchips, which require you to use a personal identification number (PIN) whenever you use your card, are supposed to be more secure than traditional bank cards, which have only a magnetic strip on the back.

But Susan Potgieter, the general manager of the South African Banking Risk Information Centre’s (Sabric) commercial crime office, says chip-and-pin bank cards also have a magnetic strip on them, and criminals can copy the information on the strip in the same way they skim regular bank cards.

“The criminals then use the information to manufacture counterfeit cards without chips to be used to draw cash and make purchases – at your expense,” she says.

Sabric spokesman Bongani Diako says the reason the magnetic strip is still present on chip-and-pin bank cards is that not all point-of-sale machines in the country are chip-and-pin compliant.

“The banks are working towards a stage where all point-of-sale machines will be able to read the microchip on the newer bank cards, but until then the magnetic strip will still be included on the card to ensure that you can use it wherever you go,” he says.

If you have a credit or cheque card, the banks are replacing your cards with chip-and-pin cards when they expire. However, if you have a bank card that does not expire, you may find that you will have to go into your bank and request a chip-and-pin card.