Thieves can steal ATM cards and PINs by using plastic sleeves known as 'Lebanese loops.
The tale of woe contained in the first example quoted above surfaced on the Internet in much lengthier form in January 2000. At that time, the 'Lebanese loop' theft was said to have taken place at a Chase Manhattan ATM in Houston at the 'Kirby location between Richmond and Alabama' with the swindledcustomer instructed by way of a small hand-lettered sign taped to the machine to enter his PIN, hit 'Enter,' and repeat if the card was retained.A greatly shortened version began its Internet life in April 2001. This time the cardnapping was said to have occurred at 'the Ulster Bank cash point on O'Connell's Street,' a location that placed the action in Dublin, Ireland. It included a 'helpful' woman who provided advice about entering and re-entering the PIN if the card was retained. This warning was quickly morphed into the current version (quoted above as our 'Example' text) which puts the theft in Australia and, other than the bank information and sometimes a dollar sign before the 500, is word-for-word the same as the Dublin warning.What to make of all this? First of all, disabuse yourself of the notion that anyone whose name appears at the base of the missive is the one who wrote it - as the HSBC in Melbourne discovered when it looked into the matter and tracked down two of these apparent signatories, both had inadvertently left their names on the e-mail when copying it to friends. This oversight has resulted in their receiving numerous inquiries about the warning. The real author was always anonymous and is long gone.Second, although the e-mail is suspect, the type of theft it warns ATM users to be wary of is possible. There are two forms of the 'Lebanese loop,' both of which can net a card thief your ATM card and your PIN, a combination known to be deadly to one's bank account. (Not all ATMs - particularly more recent models - can be fooled through this technique, however.)In one method, a laminated card is placed over the ATM's video screen and a device inserted into the card slot to disable that mechanism. On the laminated card are printed instructions to enter one's PIN three times. The thief then hangs about to shoulder surf the victim ('shoulder surfing' being the term for 'watching what number that person taps onto the keypad'). A customer arrives and loses his card to the machine (and his PIN, because that was picked off by the eagle-eyed thief, but he's not yet aware of this turn of events). Once he realizes the cashpoint will not be giving his card back, he will go into the bank, leaving the thief to quickly close upon the machine, remove the card-retaining device (which now contains the card), and make his getaway.In another, a 'helpful' stranger or two take the place of the fake sign, quickly volunteering the information that the evil machine held their cards captive until they hit upon entering their PINs over and over. It's a rare pigeon indeed who won't immediately act upon this freely-offered advice and take a shot at trying to get the ATM to release his own card by punching in his PIN again and again. But of course the 'helpful' stranger(s) are now busy memorizing this code and will quickly scoop up the blocking device and the trapped card as soon as the victim goes off to seek help from bank personnel.How can an ATM user protect himself from this sort of theft?Always shield your PIN from prying eyes. Use your body to block anyone's view of the keypad, or cup your non-keying hand over the pad as you use it. Do this whether you're at an ATM, a gas pump, or inside a store. (Rigging the machine to trap your card is not the only way a thief can steal your plastic. And keep in mind that scammers need your PIN to make your card work, so guard your PIN carefully.) Don't use an ATM if people insist upon standing around it. Politely ask them to move aside, and if they refuse, go somewhere else. Don't use any ATM that appears to be out of the ordinary. Turn up your nose at cashpoints sporting signs affixed to the machines or instruction screens asking you to do things that don't seem right (such as entering your PIN multiple times). Report these discrepancies immediately to the bank in question or the police. Get into the habit of using the same ATM for almost all of your transactions so as to better recognize when something is different with the machine. Be wary of any changes you see on its outside. If the ATM is affixed to a bank, walk in and ask why the changes were made. Never take advice from 'helpful' strangers about how to get your card back if an ATM keeps it. Report a machine-trapped card to your bank as soon as possible so that the card can be deactivated if it is was not kept for legitimate reasons.Although the e-mailed alert is an instance of rampant netlore (no author, the details keep shifting, and attempts to run it to ground by finding an actual victim of the scheme usually come to naught), it does reflect a real scam being perpetrated on ATM users: for example, five people were in indicted in New Jersey in March 2001 for operating a crime ring to steal ATM cards and PINs by 'plac[ing] a thin, plastic strip into numerous ATM's operated by First Union National Bank throughout New Jersey,' and reports of arrests of 'Lebanese loop' users turn up in other parts of the world, such as Ireland:A Romanian man living in Tallaght has been sent to prison for nine months after he was convicted of possession of a so-called Lebanese loop. This is a plastic loop, which enables people to steal credit cards when it has been inserted into ATM machines. Gheorgie Cirpaci admitted having the device and became the first person to be convicted and imprisoned for the fraud offence.Prudent cash card users should commit to memory the four points noted above, but their caution shouldn't end there. Be wary of distractions at ATM or debit card readers wherever they may be located, because a shoulder surfer working with an accomplice can, after memorizing your PIN, grab your card and make off with it while his partner points out a $20 bill that's apparently fallen from your hand, or yells something ('Help! Police!') that gets you to take your eyes off what you're doing. Also, if you ever do lose your card and someone from the police or bank afterwards calls to advise you they've recovered it, do not give out your PIN even if he asks for it 'for confirmation purposes.' Those who blurt out the number in a state of temporary relief soon find out they've just armed the thief with all that he needed.Barbara 'withdrawal pangs' Mikkelson
nan