Data Mining and Your ATM Card

I thought something was amiss l when I attempted to use the ATM at my usual bank in Antigua: maybe I'd overdrawn my account when I was in Nicaragua and El Salvador several days earlier. I knew something was definitely wrong when I went back later, after verifying funds in my account. The ATM gave me a definite '˜No' message, so I called my bank in the US, asking if there was a problem or a '˜hold' on my card or account. Customer Service was very polite, asking me if I'd made withdrawals in various amounts such as $387.50, $357.80 and so on -- and so on: "where did these withdrawals originate from", I asked -- she began to slowly spell out the unfamiliar city -- "B -- O -- G -- " "Bogota?" I asked -- 'yes -- that's it."

Bogota, as in Bogota, Colombia, exactly where rumors had placed the source of the high-jackers. Spendid -- my ATM card is cancelled for fraudulent actions, and without an in-country checking account I'm now at the mercy of the issuing bank in the US to mail a replacement sometime in the next three weeks or so.

It's the new wave of data-mining for dollars in the 21st century, coming soon to an ATM near you, and especially if you live in Guatemala. And even more so in one of the most heavily visited tourist destinations of Central America, Antigua, where a rash of cash has been mysteriously withdrawn by person or persons unknown.

Starting at least in Antigua as of December of 2010, several tourists reported to their respective embassies that unauthorized debits had been made on their credit or debit cards: sometimes for a modest amount of money and a few for several thousand dollars, and some with multiple transactions overriding any daily limit. One person reported a $16000 debit via Venezuela but their bank, Morgan Stanley made the loss good. There've been higher amounts reported but the exact number of these illegal withdrawals hasn't been tallied nor the number of people who've been cyber-robbed. The US Embassy has received at least a hundred complaints but that's only a fraction of the total. Antigua is host to many nationalities of travelers and not all of whom will be aware of this issue until later.

On December 17, 2010, Moon Travel Guide issued a stern warning of the use of ATMs in Antigua, Guatemala City, Peten and certain villages around Lake Atitlan. The US Embassy issued a warning to all American citizens in Guatemala on January 27, 2011, saying that they were attempting to resolve the problem with certain banks. The Moon warning was bank-specific, pointing the finger at the BAC branch across from the central park and the Bank Industrial, nearby. The ATMs at the BAC bank has been observed undergoing repairs recently, especially the middle unit of the three in the lobby, where most of the problems have been reported as emanating from. Que Pasa, a local magazine, has a statement from the publisher, Scott Stanton. This isn't a new problem: "a number of leading hotels in Guatemala City had their ATM's hacked", per Mr. Stanton. He also related that he tried to contact the manager of one of the suspect banks but was rebuffed. The major banks involved have tried physical remedies, installing metal shields over the keypads. This isn't working: losses are still being reported daily.

What's the remedy? Not much, unfortunately. The banks where the ATMs are located have washed their hands of responsibility and anyone using an ATM in a foreign country needs to monitor their bank activities frequently (mea culpa). If the withdrawals were made, they're made. If you're fast enough to catch this, sometimes your bank might reimburse you.

How is this happening? At first, rumor had it that '˜card readers' had been installed in the ATMs. That was later debunked by people with some experience in software. There is a process called data mining, and if one were to Google '˜data mining software, atms' the whole world of possibilities suddenly opens up. It would appear that someone, somehow has hacked the banks data lines and is capturing the info-stream of account numbers, balances and PIN numbers. Why haven't the banks de-bugged or changed their data lines? Blame it on Third World complacency and manana-ville. Some have suggested having a second account, to transfer funds into. Some have decided to avoid ATMs altogether and withdraw monies from a physical person in a bank, drawing against your credit card's balance. I wish I had that option, which might be possible after the 3-4 weeks it will take before I receive a new ATM card. Is there a Blood Bank nearby? If I make a deposit today, can I take the proceeds in cash?

Sources: Moon Travel Guide, US Embassy