I am planning to travel and thought about credit-card theft.

Would it be a good idea to have a piece of paper with 2 fake PINs near my credit-card?

The imagined attack goes as follows:

The piece of paper has written only this on it:

Credit-Card PIN: 
  1. Attacker steals wallet / credit-card along with the piece of paper
  2. Attacker goes to ATM, puts in credit-card and tries first PIN -> gets rejected
  3. Attacker thinks, he might have mis-typed the PIN, tries again -> gets rejected second time
  4. Attacker uses the second PIN -> gets rejected the third time -> ATM keeps the card

In my mind this is some sort of social engineering attack on the attacker. Since he has a piece of paper, he is inclined to use it in order to get fast cash, which results in the credit-card being kept by the ATM.

If the piece of paper would not be there, he might take it home and use technical devices or uses the credit-card in fake transactions to get money.

Notice: I am aware of criminals using fake / tampered terminals in order to get the card information and the pin. My question is about the physical theft of a credit-card!

I am also not sure, if there are different credit-cards, therefore I am thinking of my german banking-card, which uses Maestro. It's not a credit-card per se, but for the general idea of getting money at an ATM with a card and a PIN its the same as a credit-card if I understand both systems correctly.

PS: If your PIN matches my randomly generated PIN from the example, please offer me your credentials, so I can abuse this statistical surprise accordingly!

  • 5
    At least where I live, entering the same incorrect PIN twice only counts as one failed attempt. So you would probably need three incorrect PINs. But fun idea to troll thievs anyway.
    – Anders
    Jun 17, 2016 at 14:20
  • 1
    Are security card pins still even a security in 2016? All this "pay without contact" and "no-pin internet payment" baffles me.
    – Azami
    Jun 17, 2016 at 14:53
  • @Madward Define "security". It gives the banks a handy mechanism to abuse for shifting liability back to the individual card holder. Whether that counts as security would seem to be primarily determined by whether you're a bank or not. Jun 17, 2016 at 15:03
  • 2
    Your ATM's can physically "keep" your card? That's pretty neat I guess. Jun 17, 2016 at 15:05
  • 3
    @WorseDoughnut -- there are extremely few ATMs now that "suck in" your card at the beginning of the transaction and spit it out after the transaction is complete. I have not seen one for 15+ years, but they used to be commonplace. Jun 17, 2016 at 15:21

2 Answers 2


Anything you can do to mitigate the threat of usage after the physical-theft of the card is a great idea. Making them take longer by making them make mistakes and/or trying in multiple places is a solid idea. That is, aside from the ultimate mitigation of keeping your bank's phone numbers in your phone so you can contact them immediately to report card theft. As a piece of Social Engineering it's not the worst idea I've heard. Keeping that piece of paper in your wallet with the card might be a little more difficult and not worth the effort, but I could see it working.

In places where ATMs retain cards after several failed PIN attempts, this could be one extra level of security that might put less strain on your financial resources. Several card carriers also support larger PINs, up to 16-digits in some places. So you could enhance security on your card that way as well. You could also keep multiple closed credit cards in your wallet so it takes longer for the would-be thief to make an attempt on your good cards.

That being said, I don't know how often you expect to have your card stolen, and taking steps to prevent its theft in the first place might be more effective than a Social Engineering attempt at mitigation. Locking your wallet in a drawer at night, keeping it in your front pocket or carrying it in an odd location on your body (sock, inside your button-up shirt, secure pocket with a zipper) might be better techniques to avoid the theft in the first place.


Your scheme isn't terribly likely to work because not all ATMs keep the card, many are swipe.

Any thief that sees two pins will think only one is valid, and can easily bypass your scheme by just using an ATM that you swipe the card instead of the ATM taking it.

  • 1
    Surely 3 failed attempts would render the card useless, making physical possession meaningless? (are there really ATMs out there which will operate offline?)
    – Phil
    Aug 20, 2018 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .