Motorists hit by card clone scam
Discussion
http://news.bbc.co.uk/1/hi/uk/6578595
Thousands of motorists who use a bank card to buy petrol are thought to have lost millions of pounds in an international criminal operation.
It is believed cards are being skimmed at petrol stations, where the card details and pin numbers are retrieved and money withdrawn from the account.
About 200 of the UK's 9,500 petrol stations are thought to have been hit.
The Sri Lankan government claims the rebel Tamil Tigers are to blame but police say there is no definite link.
Police are investigating complaints made in Edinburgh, Norwich, Bury St Edmunds, Peterborough, Nottingham, Leeds, Bristol and Hull.
In Hull, the economic crime section of Humberside Police are checking thousands of receipts for fuel bought with credit or debit cards at one petrol station.
Detective Inspector Paul Welton, of Humberside Police, said "Quite clearly this was well-organised and it was done on an international basis."
Those alleged to have been involved were able to obtain card details and pin numbers and put them together to clone the cards, police said.
The site in Hull is now under new management, and the new owners are not linked to the police inquiry.
Sean Gillespie, one of thousands of possible victims, noticed his bank account was being emptied of small amounts over weeks, amounting to thousands of pounds.
"I knew how much had been taken but how it was taken was an absolute mystery to me," he said.
Other fraud victims have contacted the BBC News website and some said it happened at BP petrol stations.
A BP spokeswoman said between 10 and 12 of their 1,300 sites nationwide had been affected and the firm had issued additional security advice to staff.
She advised customers to insert their bank cards into the chip and pin devices themselves and be careful no-one could see them entering their pin numbers.
Ray Holloway, from the Petrol Retailers Association, said his members had tried to tackle the problem by training staff and checking machinery.
But he added: "The criminal gangs that are involved in this offer quite large sums of money to some employees in order to actually be involved in it."
'Arms funding'
Most of the UK's petrol stations are independently run which means they are susceptible to being infiltrated by organised crime.
Maxwell Keegel, first secretary of the Sri Lankan High Commission in London, said the Sri Lankan government had evidence to suggest the scam was being used to fund the Liberation Tigers of Tamil Eelam (LTTE).
Independent security sources told BBC correspondent Keith Doyle these claims were credible.
But a Humberside police spokesman said: "Our evidence does not suggest there is a definite link with Sri Lankan gangs."
article said:
Thousands of motorists who use a bank card to buy petrol are thought to have lost millions of pounds in an international criminal operation.
It is believed cards are being skimmed at petrol stations, where the card details and pin numbers are retrieved and money withdrawn from the account.
About 200 of the UK's 9,500 petrol stations are thought to have been hit.
The Sri Lankan government claims the rebel Tamil Tigers are to blame but police say there is no definite link.
Police are investigating complaints made in Edinburgh, Norwich, Bury St Edmunds, Peterborough, Nottingham, Leeds, Bristol and Hull.
In Hull, the economic crime section of Humberside Police are checking thousands of receipts for fuel bought with credit or debit cards at one petrol station.
Detective Inspector Paul Welton, of Humberside Police, said "Quite clearly this was well-organised and it was done on an international basis."
Those alleged to have been involved were able to obtain card details and pin numbers and put them together to clone the cards, police said.
The site in Hull is now under new management, and the new owners are not linked to the police inquiry.
Sean Gillespie, one of thousands of possible victims, noticed his bank account was being emptied of small amounts over weeks, amounting to thousands of pounds.
"I knew how much had been taken but how it was taken was an absolute mystery to me," he said.
Other fraud victims have contacted the BBC News website and some said it happened at BP petrol stations.
A BP spokeswoman said between 10 and 12 of their 1,300 sites nationwide had been affected and the firm had issued additional security advice to staff.
She advised customers to insert their bank cards into the chip and pin devices themselves and be careful no-one could see them entering their pin numbers.
Ray Holloway, from the Petrol Retailers Association, said his members had tried to tackle the problem by training staff and checking machinery.
But he added: "The criminal gangs that are involved in this offer quite large sums of money to some employees in order to actually be involved in it."
'Arms funding'
Most of the UK's petrol stations are independently run which means they are susceptible to being infiltrated by organised crime.
Maxwell Keegel, first secretary of the Sri Lankan High Commission in London, said the Sri Lankan government had evidence to suggest the scam was being used to fund the Liberation Tigers of Tamil Eelam (LTTE).
Independent security sources told BBC correspondent Keith Doyle these claims were credible.
But a Humberside police spokesman said: "Our evidence does not suggest there is a definite link with Sri Lankan gangs."
My card was cloned after avisit to a petrol station about 12 months ago, I never knew until they withdrew £500.oo cash from my credit card acct.
Credit card co were dreadful and almost disinterested, Police were exactly the same when I reported it. Got the £500 back but the lack of interest shows why its so easy for these scams to happen
Credit card co were dreadful and almost disinterested, Police were exactly the same when I reported it. Got the £500 back but the lack of interest shows why its so easy for these scams to happen
vipers said:
All his hype about "Chip & Pin", when was the last time you had anyone check the name on your card, providing you enter the correct PIN, purchase complete.....................
In our local shop the other day I used the Mrs' debit card by mistake, signed my name for her card, no one noticed or cared. In 3 years of living in Ireland, most of which is before Chip 'n' PIN I've only witnessed the cashier reading the card name and checking the signiture once.
I was so astounded I actually made comment and told her that I was impressed by her actions. Over here they swipe your card, tell them you've forgotten your PIN and scribble on a bit of paper. I do it every week for our familly shop.
One time in the UK I sent my friend upto the bar with my card to buy a round of drinks. When he came back after signing 'Mickey Mouse' on the ticket and had all the beers with him, we got the manager over and made a complaint. After all I could have dropped my card and someone else could have been using it for the rest of the night.
It's truly appauling, I think having a PIN is a great idea, but the muppets at the checkout assume that it's infallible and don't make the most basic of checks, such as reading the name on the card.
TheExcession said:
In our local shop the other day I used the Mrs' debit card by mistake, signed my name for her card, no one noticed or cared. In 3 years of living in Ireland, most of which is before Chip 'n' PIN I've only witnessed the cashier reading the card name and checking the signiture once.
I paid for an item on Ebay with a cheque, and accidentally used my wifes cheque book (same bank). I didn't realise this until my wife discovered the stub with my handwriting on (must remember that for next time
). Anyway the money came out of her account so I guess banks don't cheque signatures too often either. TestaDelPistone said:
Should'nt the thread read "Banks hit by credit card fraud"?
Er, no. The change to 'Chip-n-PIN' was introduced not to enhance card security (which it doesn't) but to transfer the liability from the card issuers (banks) to the merchants and the card holders - Streaky Mr2Mike said:
I paid for an item on Ebay with a cheque, and accidentally used my wifes cheque book (same bank). I didn't realise this until my wife discovered the stub with my handwriting on (must remember that for next time ). Anyway the money came out of her account so I guess banks don't cheque signatures too often either.
They don't. I once changed my signature because the old one was getting difficult to reproduce. I went into the bank to sign a new form etc. This was in the days when you wrote cheques all the time... anyway, over a year later I happened to write a big cheque(several £1,000s) to a friend, and the bank bounced it. The reason? It was the first time anyone had actually checked the signature on a cheque since I changed it and the muppets at the bank had never forwarded the change of signature form to the clearing centre.
I suppose the answer to the petrol station scam is that it's best to use a credit card*, as it's someone else's money they're stealing and, unless you really don't notice and pay the balance in full, you're not even out of pocket initially. And you usually have fewer items on a credit card bill, so it should be easier to check. Although there are probably 3 or 4 petrol stations I use regularly, so if someone put through a second transaction for up to £50 at one of them I'm not sure I'd notice.
* you can always use cash of course, but personally I find it easier to budget using plastic and paying it off every month.
Edited by saxmund on Sunday 22 April 09:19
herewego said:
vipers said:
All his hype about "Chip & Pin", when was the last time you had anyone check the name on your card, providing you enter the correct PIN, purchase complete.....................
How does reading the name on the card help security?
If a bloke comes in and pays on a car that says "Mrs. Smith" on it, it's either his partner's or he's nicked it, which would be worth getting suspicious about.
AL666 said:
herewego said:
vipers said:
All his hype about "Chip & Pin", when was the last time you had anyone check the name on your card, providing you enter the correct PIN, purchase complete.....................
How does reading the name on the card help security?
If a bloke comes in and pays on a car that says "Mrs. Smith" on it, it's either his partner's or he's nicked it, which would be worth getting suspicious about.
bimsb6 said:
and this is supposed to be news ! petrol stations and indian restaurants have been a source of card fraud for years.
Yep. Pizza parlour for me about 7 years ago, although I got the money back pretty easily.
chrispy porker said:
Often seems to involve Asians.
In my case, yes.
Edited by nobleguy on Monday 23 April 11:00
streaky said:
TestaDelPistone said:
Should'nt the thread read "Banks hit by credit card fraud"?
Er, no. The change to 'Chip-n-PIN' was introduced not to enhance card security (which it doesn't) but to transfer the liability from the card issuers (banks) to the merchants and the card holders - Streaky Interesting point of view. Issuing and acquiring banks have spent millions implementing Chip & Pin and, interestingly, latest APACS (in the case of the UK) figures suggest that this investment is paying dividends in the form of reduced fraud. No it is not perfect but it is a steer in the right direction as have been other industry measures such as on line, real time authorisation of transactions (even for card not present transactions).
The liability for any fraud has not shifted to merchants and/or cardholders. The liability shift you have made mention of, which came into place in February 2005, was designed to promote the further widespread adoption of Chip & PIN technology. The liability shift in the case of a fraudulent transaction was to the point of weakness, so if the issuing bank with a non chip card was used fraudulently in a chip enabled merchant terminal the liability was placed on the issuing bank. The reverse is true of a chip card being used fraudulently in a non chip enabled terminal where liability shifted to the acquiring bank. Status quo was maintained consistently with both merchant and cardholder. In cases where goods and or services were incorrectly billed, for example, the chargeback system has remained in place in entirety.
None of this is negotiable by the banks since all the industry scheme networks have the above embedded into their rules, bylaws and governance.
Phil
saxmund said:
Mr2Mike said:
I paid for an item on Ebay with a cheque, and accidentally used my wifes cheque book (same bank). I didn't realise this until my wife discovered the stub with my handwriting on (must remember that for next time ). Anyway the money came out of her account so I guess banks don't cheque signatures too often either.
They don't. I once changed my signature because the old one was getting difficult to reproduce. I went into the bank to sign a new form etc. This was in the days when you wrote cheques all the time... anyway, over a year later I happened to write a big cheque(several £1,000s) to a friend, and the bank bounced it. The reason? It was the first time anyone had actually checked the signature on a cheque since I changed it and the muppets at the bank had never forwarded the change of signature form to the clearing centre.
I suppose the answer to the petrol station scam is that it's best to use a credit card*, as it's someone else's money they're stealing and, unless you really don't notice and pay the balance in full, you're not even out of pocket initially. And you usually have fewer items on a credit card bill, so it should be easier to check. Although there are probably 3 or 4 petrol stations I use regularly, so if someone put through a second transaction for up to £50 at one of them I'm not sure I'd notice.
* you can always use cash of course, but personally I find it easier to budget using plastic and paying it off every month.
Edited by saxmund on Sunday 22 April 09:19
Cash is now the only sure fire way of not being scammed by this! Rather ironic I feel as most people don't tend to carry around much now.
If you've ever had someone else use your scammed card details and PIN and made a withdrawal on your account you'd already know what a pain in the a*se it is to get the disputed item in question removed! I had a disputed transaction with one of the best known visa cards in the UK over a cash withdrawal made in Thailand (country that I've never actually been) last Aug.. it took until Jan 2007 to finally have the amount removed and subsequent interest they were also charging me too!!!!! I considered cancelling my account given the hassle to get this sorted but then just decided to hold onto the card and use one of my others from now on. i.e. They ain't getting anymore business off me.
Given the recent info in the press my dodgy transaction was most def as a result of using the card to pay for petrol in the UK. Threads were running on this months ago here on PH.
Edited by sjtscott on Monday 23 April 14:16
sjtscott said:
saxmund said:
Mr2Mike said:
I paid for an item on Ebay with a cheque, and accidentally used my wifes cheque book (same bank). I didn't realise this until my wife discovered the stub with my handwriting on (must remember that for next time ). Anyway the money came out of her account so I guess banks don't cheque signatures too often either.
They don't. I once changed my signature because the old one was getting difficult to reproduce. I went into the bank to sign a new form etc. This was in the days when you wrote cheques all the time... anyway, over a year later I happened to write a big cheque(several £1,000s) to a friend, and the bank bounced it. The reason? It was the first time anyone had actually checked the signature on a cheque since I changed it and the muppets at the bank had never forwarded the change of signature form to the clearing centre.
I suppose the answer to the petrol station scam is that it's best to use a credit card*, as it's someone else's money they're stealing and, unless you really don't notice and pay the balance in full, you're not even out of pocket initially. And you usually have fewer items on a credit card bill, so it should be easier to check. Although there are probably 3 or 4 petrol stations I use regularly, so if someone put through a second transaction for up to £50 at one of them I'm not sure I'd notice.
* you can always use cash of course, but personally I find it easier to budget using plastic and paying it off every month.
Edited by saxmund on Sunday 22 April 09:19
Cash is now the only sure fire way of not being scammed by this! Rather ironic I feel as most people don't tend to carry around much now.
If you've ever had someone else use your scammed card details and PIN and made a withdrawal on your account you'd already know what a pain in the a*se it is to get the disputed item in question removed! I had a disputed transaction with one of the best known visa cards in the UK over a cash withdrawal made in Thailand (country that I've never actually been) last Aug.. it took until Jan 2007 to finally have the amount removed and subsequent interest they were also charging me too!!!!! I considered cancelling my account given the hassle to get this sorted but then just decided to hold onto the card and use one of my others from now on. i.e. They ain't getting anymore business off me.
Given the recent info in the press my dodgy transaction was most def as a result of using the card to pay for petrol in the UK. Threads were running on this months ago here on PH.
Edited by sjtscott on Monday 23 April 14:16
It is most unfortunate that a few banks, yours being notorious in this respect, make life unnecessarily awkward. Most banks clear up these matters with their customers with the minumum of fuss, like you I have had a card compromised and will remain loyal to the issuer who behaved perfectly. It is an unfortunate fact that cross border transaction attract most fraud. Simply because card skimmers operate in areas where you may be required to lose sight of your card for maybe only a few seconds, for example restaurants and so on. Card data is then skimmed and the card returned to you the skimmed data is then transferred to a clone and used in areas where chip & pin has yet to be adopted. Domestic card cloning has all but disapeared due to chip & pin introduction.
There was a case last year where card data was being compromised at a UK petrol retailer. This was tracked down to staff members hacking into point of sale terminals. This has led to the tightening up of the construction and programming of tamperproof terminals by third party providers.
Phil
In the days of signature cards, with the magnetic strip, I was always careful to watch out for double swiping. I now notice that 1 large off license chain swipes the card through the till after I've entered the PIN number. I'm told by the staff this is to 'validate the purchase'.
Anyone know if retaillers are allowed to do this or if I should be refusing to let them swipe through the till?
Anyone know if retaillers are allowed to do this or if I should be refusing to let them swipe through the till?
mouseymousey said:
In the days of signature cards, with the magnetic strip, I was always careful to watch out for double swiping. I now notice that 1 large off license chain swipes the card through the till after I've entered the PIN number. I'm told by the staff this is to 'validate the purchase'.
Anyone know if retaillers are allowed to do this or if I should be refusing to let them swipe through the till?
Anyone know if retaillers are allowed to do this or if I should be refusing to let them swipe through the till?
A large car parts chain starting with H do the same. I have also wondered about its legitimacy.
Yes its fine only the first swipe/chip read goes online through the network for an authorisation. The second uses a different device linked to the merchant's internal system. The encoded data on the stripe/chip is anonymous and cannot be used, for example, to generate junk mail.
Phil
Phil
Forums | Speed, Plod & the Law | Top of Page | What's New | My Stuff