Devil on Your Shoulder : Southland in the Midst of a New Wave of ATM Thievery

When Daniel Hebert couldn’t get any money out of the automated teller machine at his local bank last month, he figured his misfortune was merely the result of “a plain old-fashioned mix-up.”

After all, there was nearly $800 in his Bank of America account when he left for vacation a week earlier, and Hebert hadn’t made any withdrawals or written any checks since.

But when he called the bank, he learned that while he had been relaxing at his parents’ home in Delaware, his ATM card had been getting a workout across Los Angeles and Orange counties.

A subsequent investigation by BofA determined that Hebert’s card had been counterfeited. The bank refunded the money missing from his account.

“I didn’t lose any cash, but my account got all screwed up, and I sure wasted a lot of time talking with bankers,” said Hebert, a computer software salesman in Long Beach.

Although bank investigators and the Secret Service are still investigating the case, one thing is certain: Hebert is just one of hundreds or perhaps thousands of Southern California residents who’ve recently been victimized by a gaggle of high-tech bandits now working the region.

“ATM fraud tends to move around the country in waves, and I guess maybe the crooks have decided that Southern California is the best place to be right now,” said Dominick Albano, a spokesman for the California Bankers Assn. in San Francisco.

The new ATM crime wave is blamed on a clever breed of thieves whom law-enforcement agencies have dubbed “shoulder surfers.” Some are rogue operators who work alone; others belong to sophisticated rings.

The scam begins when a consumer pulls out an ATM card to make a transaction at a bank or other ATM site, or to use the card at a “point-of-sale” machine at a gas station or store.

The thief casually peers over the victim’s shoulder while the personal identification number is punched into the keypad, or zooms in on the PIN from across the parking lot with the help of a telescope or high-powered video camera.

Next, the thief must get the customer’s receipt, because it includes either the ATM card’s serial number or the number of the bank account--either of which can be used to manufacture a bogus card. Many consumers leave their receipts at the counter or toss them into a nearby trash can, making the crook’s job all the easier.

With the help of an easy-to-get “encoding” machine that makes magnetic strips, the thief then uses the PIN and data from the receipt to counterfeit a matching card and empty the unsuspecting cardholder’s account.

Since withdrawals and purchases at most ATMs and point-of-sale machines are usually limited to between $200 and $500 a day, “shoulder-surfing” might seem like a lot of work for a relatively low payoff.

But officials with the Secret Service--which investigates fraud involving ATM cards and other “access devices”--say a skilled surfer can easily counterfeit dozens of cards a day.

“Multiply a few dozen or a few hundred cards by $300 or $500 a day each, and you’re talking about some major money,” said Special Agent Jim Bauer of the Secret Service’s Los Angeles office.

The surfers can hit the same accounts on several consecutive days before the scam is detected, Bauer said. If the account balance falls too low, they can deposit bogus checks at the machines to artificially raise an account’s balance and take out cash the victim’s account doesn’t really contain.

Bauer said the Secret Service and a small number of other agencies have arrested about half a dozen shoulder surfer suspects in Southern California over the past six months.

Plenty of individual thieves are in business, Bauer said, as are “at least a few” rings.

When authorities broke up an elaborate operation based in an Orange County hotel room earlier this year, they arrested three men and confiscated about 500 blank cards, magnetic strips, a telescope, two guns and $20,000 in cash.

Law enforcement officials say they don’t know exactly how much money has been stolen by ATM thieves in the area, in part because most banks and retailers don’t like to talk about it.

“It would not be advantageous to let criminals know how much is available through this type of fraud . . . “ said Bill Wipprecht, director of security at Wells Fargo Bank.

“Besides, we don’t want to scare our customers and discourage them from using their cards. Overall, the chances of any one consumer falling victim to this type of fraud are very, very minimal.”

One reason banks don’t want to discourage the use of ATMs is that they collect more than $2 billion a year in fees from the use of the machines, and they save huge amounts more by not having to hire as many tellers.

Some security experts say this reluctance to talk about the matter leads to a lack of awareness among consumers that fuels the fraud. But Wipprecht and other bank officials note that many institutions now regularly include a list of ATM safety tips in their monthly statements.

For their part, some stores and other retailers are even redesigning or relocating their point-of-sale machines to make it harder for thieves to watch as customers punch in their PINs.

For example, the pay-at-the-pump card-reading machines at some Arco stations--where Hebert’s PIN was apparently seen by a shoulder surfer--are being lowered several inches to make it easier for consumers to block the keypads with their bodies.

“Several of our own (employees) have been hit by those guys,” said John Lannan, president of Arco’s electronic-payment operations.

In an effort to thwart thieves, a group of retailers and bankers recently asked regulators at the Federal Reserve Bank to change a requirement that they print customers’ card or account numbers on the receipts.

Although most banks are currently allowed to block out part of those numbers, there’s still enough information on the printouts to keep a smart surfer in business.

A Fed spokesman noted that some consumers want the numbers printed on their receipts to make it easier to balance multiple checkbooks or resolve disputed transactions. Although the Fed might eventually change the requirement, the changes would not take effect until next year at the earliest.

For now, bankers and retailers say, a consumer’s best defense against being wiped out by a surfer is to cover the keypad with a free hand as the PIN is being entered and to always take the receipt when the transaction is completed.

Thwarting ATM “Shoulder Surfers”

While most consumers would never use an ATM machine if a stranger was lurking suspiciously nearby, they forget that they’re equally vulnerable to “shoulder surfers” hoping to steal their personal identification numbers (PINs) and drain their accounts electronically. Here are some tips to thwart these latter-day bandits:

* Memorize your PIN, but don’t write it down. Bankers say it’s surprising how many consumers keep their number in their wallets--or even write it on their card.

* Don’t choose an obvious number. Among the most common: “1-2-3-4.”

* Always cover the ATM keypad when you punch in your number. Your card can’t be counterfeited without your PIN.

* Never share your PIN with anyone. Not even bank employees or the police.

* Take your receipt with you. The numbers on the printout might not make sense to you, but a clever thief can use them to access your account.

One more note: If you’re victimized by a shoulder surfer, under California law you are liable only for the first $50 if you report the theft immediately. Some banks will even waive the $50 to keep their customers happy.