Two incidents of suspected ATM fraud cases were reported recently in Hong Kong. It was believed that fraudsters might have attached reading device to the ATMs to capture data stored on magnetic stripe of customers’ ATM cards and used hidden camera to obtain customers’ ATM personal identification numbers (PINs). With the stolen information, fraudsters would be able to produce counterfeit cards to withdraw money from the customers’ bank accounts at ATMs. In both incidents, the suspicious devices were spotted by customers who reported to the banks quickly and prompt actions were taken to remove the suspicious devices. So far, no financial losses were reported.
While the ATM fraud is not serious in Hong Kong, as a safeguard, cardholders should continue to take precautionary measures to keep their card safe and protect their PIN at all times, including:
Currently, when a cardholder conducts transaction at an ATM, data stored in the magnetic stripe on the card is used for authentication purpose. As indicated in a press statement issued by the HKMA on 19 October 2012, the banking industry in Hong Kong is implementing chip-based ATM technology. Chip-based ATM cards are equipped with micro-processor inside the chip which protects the sensitive data stored within the chip and therefore can further strengthen the security of ATM services.
Indeed, the HKMA issued a circular on 1 June 2011 to set out the chip-based ATM technology implementation details. The protection to cardholders will be enhanced by phases between 2013 and 2015. AIs are expected to upgrade their ATM to support chip-based authentication by the end of February 2013, and complete card replacement process by the end of March 2014 (for debit cards and credit cards linked to customers’ bank account) and 2015 (for remaining credit cards).
As many overseas ATMs are still using magnetic stripe technology, all ATM cards will continue to feature a magnetic stripe to allow overseas use by cardholders. But enhanced security measures will be implemented to offer additional protection against unauthorised overseas ATM transactions. The overseas ATM cash withdrawal capability for ATM cards will be pre-set as “deactivated” with effect from 1 March 2013 and such capability needs to be activated by cardholders through appropriate channels before ATM cash withdrawal transactions could be conducted overseas. Cardholders can set an expiry period and an overseas withdrawal limit which is lower than the local withdrawal limit. Cardholders are reminded to activate the overseas cash withdrawal capability before travelling, if they think they may need to withdraw cash from ATMs outside Hong Kong. Channels for activating such a capability in general include ATMs in Hong Kong, Internet banking, phone banking / call centre, etc. The detailed arrangement will be communicated to bank customers by their banks.
It should be noted that before the chip-based ATM technology is fully implemented in Hong Kong, cardholders may still be susceptible to card skimming fraud, in particular for cards which have not been migrated to chip-cards. Cardholders should continue to take precautionary measures to keep their card safe and protect their PIN at all times.
An ATM without any card skimming device attached at the card insertion slot
A card skimming device attached at the card insertion slot of an ATM.
Executive Director (Banking Supervision)
1 November 2012