Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible for a person who has your ATM/debit card number and PIN, to withdraw your money? If so, how?

share|improve this question

closed as unclear what you're asking by Lucas Kauffman, NULLZ, Adnan, AviD Aug 16 '13 at 15:33

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What password..? PIN number? Online password? –  Peanut Aug 15 '13 at 23:32
    
@Peanut Edited to specify PIN as online account hacking is pretty common knowledge. (Log into internet banking (card number is usually 'username') and use password to access accounts). –  NULLZ Aug 16 '13 at 0:06
    
umm... if they have your card AND your PIN, then it is trivially obvious that they can withdraw your cash...?? –  AviD Aug 16 '13 at 15:33
    
@AviD The question is asking if they have your card number, not your card. –  Frank B Aug 16 '13 at 19:15

1 Answer 1

You need a couple of pieces of information in addition to the card number and the PIN, but this is pretty close to accurate. Card cloning is a common crime and there are criminals who even do it right on the machine itself. By copying the ATM card and recording the PIN, it is possible to access the account and withdraw money from it. Fake faceplates can be installed on most ATMs to read the magnetic strip on the card and record the PIN number entered. This is why it is always important to examine an ATM before you use it to ensure that it has not been tampered with.

share|improve this answer
    
I'm yet to see an ATM (that's being used) that can't be skimmed somehow. I've seen 'concepts' but that's about it... –  NULLZ Aug 16 '13 at 0:04
    
It's a cat and mouse game –  Lucas Kauffman Aug 16 '13 at 0:29
    
Note this is only a danger for places that use and accept mag stripe transactions, EMV (Chip and PIN) based cards using DDA/CDA aren't cloneable. Unfortunately most countries that use EMV have kept mag stripe around for legacy reasons, although the plan is to phase them out, and it's possible to get an EMV ATM to use the mag stripe if you break the EMV chip. –  Peanut Aug 16 '13 at 8:51
1  
UK ATM's use "shuffle" card entry to help reduce the threat of surface skimmers. The card stutters in and out as the card is entered into the machine. Also, machines here tend to use the chip rather than the mag stripe. –  Callum Wilson Aug 16 '13 at 11:07
1  
@FrankB - magnetic cards are read based on the timing of how long magnetic information is present. Altering that time as it is read means that the skimmer has a hard time knowing how many 1s or 0s occur in order while the magnetism is oriented in a consistent direction. It can't distinguish 1,0,0,0,0,1 from 1, 0, pause, 1. You'll actually hit the same problem if you scan half of a mag stripe at one speed and then alter your speed partway through. –  AJ Henderson Aug 16 '13 at 18:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.