0

So I'm abroad at the moment, yet I've just had a cash withdrawal made on my credit card from my country of origin, even though I'm not there and the card IS with me abroad.

I called the card issuer and they have cancelled the card and are sending me a replacement. They told me that this was definitely a bank machine withdrawal with a physical card so my card must have been copied at some point.

What's odd is that it's actually months since I last used this card in a physical transaction back in my home country so it's odd that if it was copied all the way back then that it's only being tested now.

Anyhow, it got me thinking, is it possible that the card wasn't copied some months back but instead a copy card was compiled using data a scammer obtained about my card and its security codes via another source such as an online shop ? Is that technically possible or is there info in the card that is required that isn't ever part of an online transaction?

Improve this question
2
  • 1
    Does your card have a chip? Chip duplication is possible but extremely unlikely. Magnetic stripe duplication is trivially easy.
    – David
    Mar 4, 2020 at 17:50
  • 1
    The important part of this is that it was a cash withdrawal from an ATM. That should require your ATM pin, which implies some sort of compromised ATM machine (cameras, etc), or some other way of obtaining the PIN, which of course is NOT on the card itself.
    – Steve Sether
    Mar 4, 2020 at 18:33

2 Answers 2

Reset to default
1

Credit card fraud is very common and very easy to perpetrate when dealing with magnetic swipe cards.

Credit cards can be duplicated very easily. All it takes is a machine that can read and store the data on the magnetic stripe; writing that data to a blank card can be done later. This process is often called skimming, and it can happen almost anywhere. The necessary hardware is very cheap and easy to find.

Skimmers can tamper with credit card machines at merchants, or they tamper with ATMs. With ATMs, they often capture the PIN entry with a small camera. Unattended machines such as gas stations and standalone ATMs are most frequently targeted, but almost any machine could be affected. It is also possible for service staff such as waiters/waitresses to carry hand-held skimmers.

This is why most banks are switching to chip-enabled cards. While there is no such thing as perfect security, it is significantly more difficult to compromise the chip. The cryptographic secret stored on the chip is never transmitted, so it cannot simply be read by an attacker.

Improve this answer
4
  • It's important to note that Adam Jones said this was an ATM withdrawal, so it's not exactly credit card fraud, but ATM fraud.
    – Steve Sether
    Mar 4, 2020 at 18:32
  • If the targeted instrument was a credit card, it is credit card fraud regardless. Also, I included all attack vectors because the skimming often occurs well in advance of the fraudulent activity. The clone may have been used at an ATM, but his original card could have been skimmed anywhere that he's ever used it. If they have his PIN, presumably he supplied it during that transaction, but some countries/banks prompt during credit purchases.
    – DoubleD
    Mar 4, 2020 at 19:39
  • I think the bank might disagree with you that this was credit card fraud, since they weren't extending credit, but rather withdrawing money from his account. The OP might disagree with you too, since he had to (presumably) get the money back, not just simply have the charge removed.
    – Steve Sether
    Mar 4, 2020 at 19:51
  • Only the foreign origin of the poster leaves room for doubt. In the US, a cash withdrawal from a credit card is often called a "cash advance", and it is considered a form of credit without exception. Accessing one's own funds is usually done with a debit card rather than a credit card, although the poster's native country might not make a distinction.
    – DoubleD
    Mar 5, 2020 at 0:12
0

It is possible to clone a card. All the information needed to withdraw money are the information on the magnetic strip, and your PIN. If someone acquires both, they have all they need to copy the magstripe data into another card, and it will work like yours. If they manage to copy the CVC too, they can even purchase things online with your card.

It won't even need to be a real bank card, that data can even be written on a magnetic card from a hotel door, and it will work just fine.

Improve this answer
2
  • Well this is my question, do they need specifically to copy the magnetic strip or can a card be generated with just my pin and a few other bits that can be obtained in various ways ?
    – AdamJones
    Mar 4, 2020 at 16:01
  • @AdamJones - No, each method of using a card (sight, swipe, chip, tap) has its own unique information that can't be read through any of the other methods. So if it was swiped in the ATM, then your magnetic strip data was stolen. It's possible for a skimmer to read your swipe data from your card as you insert it into somewhere, though, provided that you have to insert your full card (so, more often unattended devices than retail terminals).
    – Bobson
    Mar 5, 2020 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .