You are here:

Don't clone around

Created:
15 February 2008
Written by:
Peter Temple

You couldn't say we hadn't been warned. My son's South African girlfriend, when she knew we were planning to visit her country, had told us stories about muggings and the like. The impression was reinforced when we arrived there. Most tourist literature, not to mention guides on tourist buses, caution you about the crime rate. The advice is not to walk after dark and only to visit safe places to shop.

Advertising

The robbery started in a large shopping mall in Cape Town at the end of our stay. It was, however, a virtual mugging. My wife offered her ATM card as payment for some goods in a well-known local chain. For reasons that later became clear, the sales assistant said the card payment had not been accepted. Thinking little of it, we paid cash for the goods.

A week or so after our return to the UK, my wife used her ATM card again. A few hours later we received a call from HSBC's fraud prevention unit. Were we back in the UK? Yes. Had we used the card in the UK today? Yes. Had we been in South Africa recently? Yes. Were we aware that cash withdrawals had been made against the card in the last couple of days? Er, no.

HSBC stopped the card. Alarmingly, the cash withdrawals, which we were now monitoring through the HSBC online banking system, continued for another couple of days due to the delay in communicating transactions between Standard Bank's ATM system in South Africa and HSBC's own system. They have now stopped, but not before £1,800 had been siphoned out of our account. The cloners quickly worked out how much they could withdraw in cash each day (the equivalent of £300 in local currency). But they used the same Standard Bank ATM machine for all of the fraudulent withdrawals.

My wife signed a fraud declaration itemising the transactions at our local HSBC Bank branch and the missing money and associated cash machine charges was refunded to our account within the week. We need not, it appears, provide any information about where we believe the crime took place, because the bank's systems can recognise the point at which the card details were cloned. Cloning the details was probably done either by an employee, or a friend of an employee who had access to the shop.

We have learnt a few lessons. The first is never to pay for a purchase in a foreign country using an ATM card. With a cloned credit card the thief will ultimately come up against your credit limit. With an ATM card the thief could, with enough time before the fraudulent transactions are discovered, theoretically empty your account up to your overdraft limit.

Second, using a 'high street' cash machine doesn't prevent cloning. We have since discovered that an acquaintance had a large amount removed from her account within hours of using a seemingly safe airside cash machine in Toronto airport. If you use an ATM card to make cash withdrawals abroad, the only totally safe place to do it is at a machine that is physically inside a bank branch.

Third, if you have confirmed to the bank that you are abroad and the card is cloned early on in a lengthy stay, the bank will not necessarily pick up transactions from the cloned card as being fraudulent unless you use the genuine card in a different country at more or less the same time. So it is important to be in a position to monitor your account online on a regular basis while you are abroad, provided you can do so, of course, without compromising its security.

It is certainly important to keep monitoring your account after you return, even if nothing untoward happens for a few days. The fraudulent cash withdrawals did not begin until nine days after our return to the UK.

Equally important is to monitor messages on your home phone while abroad. Unlike some banks, HSBC doesn't require its customers to notify them of any trips abroad in advance, but we received a couple of messages to contact the call centre after we arrived in South Africa to verify that we were there and the transactions that had been recorded were genuine.

In our case, too, full marks to HSBC for the software that allows them to pick up suspect transactions and for the efficient way in which the card was stopped and replaced. The new card arrived three working days after the old card was blocked, and the new PIN a couple of days after that.

Although it might seem like it, card cloning is not the worst thing that can happen. Only one of our cards was cloned, allowing us to use the rest of them and the money was restored without much delay.

Market data

Comprehensive UK stock market data - who's up, who's down, stocks hitting new highs, best yielders and much more!

Click here for data!