Am I At Risk For Identity Theft?

September 11, 2006 11:36 AM

Several days ago, I found an unauthorized charge (a $40 withdrawal from savings) on my bank statement. I called my bank (Bank of America, Seattle customer, FWIW) and they confirmed that the withdrawal was made from an ATM in the area. This strikes me as a Very Bad Thing, because whoever did it must have had an ATM card that was mine (they didn't; I haven't lost my card) or that appeared to be mine, and (s)he also would have had to have my PIN. Now I have a few more questions.

I called BOA and they cancelled the card and are sending me a new one. They asked me all the requisite questions: does anyone else know your PIN (no), does anyone else have a copy of your card (no), have you lost your wallet lately (no), etc.

I'm worried that cancelling my card won't be enough to protect me from this happening again. Do I need to be getting new account numbers? New checks? I called the bank and asked them these questions, but the gentleman I spoke with dismissed my fears ("as long as you don't give your PIN out...").

Am I overreacting? Any advice, anecdotal or otherwise, would be appreciated.

(Also, hopefully not unrelated, are there certain banks that are better about protecting my security than, say, BOA? Not that this is neccesarily their fault, but I'm becoming more and more disenchanted with them and, frankly, am sort of looking for an excuse to switch).

posted by rossination to work & money (24 comments total)

This strikes me as a Very Bad Thing, because whoever did it must have had an ATM card that was mine (they didn't; I haven't lost my card) or that appeared to be mine, and (s)he also would have had to have my PIN.

It strikes me too as a Very Bad Thing but, oddly, my reaction would have been different than yours. I wouldn't have assumed that someone got a copy of my card and PIN and then withdrew a mere $40.

I would have assumed the Bank made a mistake and withdrew somebody else's money from my account and would have forced the Bank to look into it. I assume this would have elicited a different response from them...perhaps.
posted by vacapinta at 11:45 AM on September 11, 2006

It sounds like someone cloned your card and managed to watch you entering your PIN. Have you used any off-brand ATMs lately, or any ATMs from major banks that looked a bit off?
posted by oaf at 11:45 AM on September 11, 2006

Vacapinta: good point. I guess that I, as a poor college student, saw $40 as a large amount of money ("who wouldn't want to steal forty bucks?), but you're right, it could be a bank error.

Oaf: haven't used any off-brand ATMs, ever - I'm too cheap to pony up the fees. I used a couple ScotiaBank ATMs when I was in Vancouver BC a couple of weeks ago, but those are legit, right?
posted by rossination at 11:53 AM on September 11, 2006

Scotiabank ATMs are OK, they're a pretty major bank around here in Vancouver.
posted by cgg at 11:56 AM on September 11, 2006

Doesn't matter if it was legit or not. Did you use the card at a gas station or something like that in debit mode? It could've been anywhere. The cloners these days are absurdly crafty.

I think the secret to defending yourself here is to stop using debit mode unless you're getting cash back. Not that it'll stop the thieves, because they still got both your debit and credit numbers, but it'll at least stop them from getting *cash*.
posted by SpecialK at 11:58 AM on September 11, 2006

If you go to your 'home' branch and politely, yet firmly request new account numbers, the managers and associates there should be happy to oblige, even if they themselves deem the measure unnecessary.

Whether it is an overreaction on your part is immaterial. If they are not willing to take these steps to retain your business, they don't deserve your business.

---

Full disclosure:

I'm speaking as a satisfied Bank of America (formerly Fleet) customer, and an avid reader of the Bank of America Sucks message board.
posted by The Confessor at 11:58 AM on September 11, 2006

The quick answer to your thread header question is Yes you are always at risk for identity theft, even if you cancel your BOA accounts and switch to another bank. The threat will always be there. The important thing is how your bank handles it when it does happen. I had about 5000 dollars of fraudulent charges on my BOA debit account last summer. They handled it perfectly and professionally and had given me credit for the lost money within one day, conditional upon the results of a three month investigation. They were always available to answer my questions and I found their Fraud Dept to be be smart, willing to help and polite at all times. So that helped set my mind at ease.
posted by spicynuts at 12:00 PM on September 11, 2006

The same thing happened to me about 10 years ago, only the thieves systematically tried to clean out my account over a weekend when I couldn't reach anyone at my bank to let them know what was going on. They withdrew the daily max amount of cash at several ATMs in 7-11 stores (ATMs without cameras). If I hadn't tried to take out some cash myself and been denied because the daily max had already been withdrawn, I might not have realized what was going on for several days. This is the more likely scenario if your card was cloned. I agree with vacapinta that your one-time $40 withdrawal sounds more like a bank error. (P.S. The bank recredited me with the entire amount of money that was stolen. They probably have insurance for that sort of thing.)
posted by Joleta at 12:04 PM on September 11, 2006

$40 is a good test amount. Maybe they wanted to see if they could get away with using the card. My bank told me that this is what credit card thieves do -- they charge very small amounts, then test bigger amounts, to see if anyone is watching the card. Then they make a big transaction. I know this because the bank phones me whenever I've made several small charges followed by a big transaction. Perhaps the same tactic applies for debit cards. If they were using an "off" brand ATM, maybe they couldn't access the account balance, so they wanted to see if a small amount could be withdrawn first.
posted by acoutu at 12:08 PM on September 11, 2006

It sounds like someone cloned your card and managed to watch you entering your PIN. Have you used any off-brand ATMs lately, or any ATMs from major banks that looked a bit off?

Why would they only withdraw $40? Was that all there was in the account? Are you absolutely sure you didn't make the withdrawal yourself and forget? That's the only think that fits in my mind.
posted by cillit bang at 12:09 PM on September 11, 2006

Was that all there was in the account? Are you absolutely sure you didn't make the withdrawal yourself and forget? That's the only think that fits in my mind.

(1) There was more than $40 in the account. (2) Yes, absolutely. This was my first thought as well, but I"ve gone over receipts, talked to friends, etc - I did not withdrawal that money.

Thanks for the advice and (mostly) reassurance, all - keep it coming!
posted by rossination at 12:17 PM on September 11, 2006

I may be a bit of an overreactor, but I'm ridiculously cautious with identity theft or any personal theft of this nature.

First, I'd get new checks and insist on all account numbers changed for anything to do with that bank. If they don't want to do that, ask to speak to the manager and insist this is the least they can do to alleviate your concerns. Threaten to take your business elsewhere. If they still won't, pull all money out and close all accounts, including credit cards. Insist they send you documentation letters that the accounts were closed. Save those letters in your "Important Papers" file wherever that may be.

In addition, I'd pull my credit report to see if any lines of credit have been open or anything looks amiss. It's free, once a year for everyone. Good to do even if something weird like this doesn't happen to you.

Check your wallet to make sure everything that is supposed to be there, is there.

And finally, I'd call all three credit bureaus and alert them that you may be a victim of identity/credit theft. They'll flag your account for activity like new lines of credit opening, etc.
posted by jerseygirl at 12:32 PM on September 11, 2006

Last weekend someone in Spain started withdrawing funds from my account using an ATM and a cloned card (they cleaned it out, thank god my paycheck hadn't cleared). As I understand it the only information needed to pull this off was a skim of my card and my pin, which could either be obtained through a dishonest retailer with a modified card reader and a security camera or possibly through a new mystery hack that is burning several major banks (details and speculation here).

Both of these cloning techniques are effectively thwarted by getting a new card issued, but this is no guarantee that it will not happen again some time in the future. As long as your bank completely covers all promptly-reported fraud, I don't think it is necessary to take any more steps. In my case, all the charges were refunded within a day and they overnighted me a new card. If possible, it's good to have a second account in case you temporarily lose access to the first.

If you're afraid of identity theft, jerseygirl's advice on contacting the credit bureaus is good. You can also request free reports online.
posted by eddydamascene at 12:43 PM on September 11, 2006

Former banking agent here. I’ll assume this is strictly an ATM card and specifically NOT a Visa/Mastercard debit card tied to your checking/savings account.

First, review your account and how it was initially set up. If were you a minor when you first opened it, chances are a parent/guardian was a signer on your account. Which means, there are potentially more cards out there than you know about. Most often, family members are found responsible for a great deal of unexplained account activity.

Next, determine if the withdrawal was actually done at an ATM. Tellers and customer service reps often only see a generic code for ATM activity. If the transaction truly took place at an ATM, a little research from the bank’s fraud department will easily provide the date, time and address of the transaction.

Getting the money credited back might be a hassle. Hold on to your (now cancelled) card to prove it is in your possession. If your bank requires it, file a dispute, and do it in a timely manner – usually within 60 days of the transaction. The bank takes this sort of investigation very seriously, and know that it will take some time to be concluded. Also know that those ATM cameras actually work most of the time.

Regarding identity theft: your account number is everywhere. Everyone knows it. It's on every check you've ever written, along with other pertinent bits of personal information. If you're really worried, cancel your current account and get a new account number...but personally, I wouldn't bother. You're not liable for funds the bank might wire a scammer, but trust me, a scammer has no interest in your checking account; he wants to open new accounts. If nothing else, at least go to annualcreditreport.com and get your free reports.

FWIW, assuming none of the above applies, here’s what I think happened: a new bank customer opened a new account, and when the bank submitted a request for an ATM card for the new account, they entered your account number instead of the new one. A finger slip, human error, plain and simple. It happens more frequently than people think. Keep watching your account.
posted by cdadog at 1:08 PM on September 11, 2006 [1 favorite]

Was the ATM monitored by a camera. This type of thing happened to me once, and they were able to produce a picture of me withdrawing the money. I'm embarassed to say that I had completely forgotten about it.
posted by Chessbum at 1:14 PM on September 11, 2006

cdadog: it is a debit card as well, and I use the card as debit quite often. Also, the money has already been credited back to my account, so that's actually not too much of an issue. Your other advice, however, is very useful - thank you.
posted by rossination at 1:21 PM on September 11, 2006

I'm confused and maybe I need to read this thread more closely, but did you get your money back? Did you file a police report?

If someone is fraudulently using/stolen your card then your bank should have told you to report it to the police and refunded all the money. The police go to the ATMs and check the cameras. Every bank has a procedure for claiming fraud. This happened to me and should be taken seriously.

And you can't prevent this from happenning. Sheild your pin number with your hand when you enter it and use a good bank with harder cards to copy (BofA has great cards so you're already there with that one).
posted by scazza at 1:27 PM on September 11, 2006

Ah, I see, you got the money back.
posted by scazza at 1:28 PM on September 11, 2006

I agree with cdadog new account numbers are really not going to prevent anything - they will hoever make your life harder because you will have to change any pre set up payments you have with the old account transfer your direct deposits, etc, etc. Your account number is not nearly enough information to gain funds from said account, a new card will more then "reset" any access route a possible card duplicator would have or could have... With this being said checking your credit report monthly for the next 3 months and or starting one of the several monitoring sevices is a great idea to see if the would be theif accomplished their real goal "opening new lines of credit"

cheers
posted by crewshell at 3:49 PM on September 11, 2006

Just piping up with some contrary evidence to other posters. While someone cloning the card might have been testing to see if they could withdraw smaller amounts, it's not certain they would have done this. Here's what happened to me:

About four years ago, I was banking online and noticed my balance was about $300 below where it should be. I don't recall exactly why, but I didn't call the bank until the next morning. Turns out another $600 had been withdrawn from my account. Of course I had just sent in my rent check and had to borrow a few hundred from a friend to cover it.

I went into the bank, showed them my card, and they couldn't figure out what could have happened. They asked if anyone else had access to my card, and I told them that technically, my girlfriend did. They got suspicious of her but I made it clear that she wouldn't have done this and in any case didn't know my PIN. They told me they would credit my account, gave me a new account, card, and PIN, and told me to get a police report.

When I finally got to talk to a police officer, she told me that this had been happening to a lot of people and that she was surprised the bank hadn't known about it.

About a week later, I found a NY Post article that some thieves had set up false fronts on various deli ATMs, along with cameras to record people entering their PINs. Turns out they were able to steal hundreds of thousands before skipping town.
posted by lackutrol at 4:56 PM on September 11, 2006

There was a leak of ATM card numbers conjoined with PINs earlier this year which involved some major retailers (including OfficeMax and Walmart) . Thieves managed to obtain card numbers in conjunction with PINs, and used these to clone cards and make fraudulent transactions.

A friend of mine had this same type of thing happen to him (ATM used to make a withdrawal, indicating that the thief had both a card and PIN, even though card had never been physically out of friend's possession). BofA issued him a new card, refunded him his money, and he has not had any problems since.
posted by Wavelet at 6:09 PM on September 11, 2006

There was a leak of ATM card numbers conjoined with PINs earlier this year which involved some major retailers (including OfficeMax and Walmart) .

My bank *called* (as in, on the phone) their customers who may have been affected, pre-emptively issued them new cards and PINs (I hate saying "PIN number"), and setup stricter account monitoring for them when this went down a while back.

The letter they sent just said "Major Retailer", but we suspect OfficeMax.

Luckily, my account wasn't one of the ones that got hit but they made me replace my card anyway.
posted by mrbill at 6:38 PM on September 11, 2006

Seconding what lackutrol said. In my town there was just a case of some guys who attached a false front to an ATM at a (reputable, national) bank branch. The false front apparently looks pretty much like a normal plastic ATM enclosure, but it allows them to record PINS in conjunction with account numbers. So you don't need to have used an "off-brand" ATM to be vulnerable to theft. Be aware of the front etc of the ATM you're using, or other places where you enter your PIN. If something seems off about it, be wary. (Not helpful advice now, I realize, but for the future maybe.)
posted by LobsterMitten at 7:04 PM on September 11, 2006

Hmmm. I just talked to my bank last night about a fraud claim. Although neither my husband or I lost our credit card, someone racked up some interesting charges at a mall near our house over Labor Day Weekend. (The charges had store numbers attached, so I tracked them back to there.)

At first, I thought that they had somehow gotten our number and used it. Then, Chase told me that they had an actual card that had been swiped in the machine. (They can tell if a card has been swiped or keyed in.)

This absolutely blows my mind. I hate credit cards anyway (we have only two) and hate thieves more. They are creating fake cards with fake magnetic strips. Holy cr*p.
posted by jeanmari at 12:00 PM on September 12, 2006