Kolkata’s tryst with rigged ATMs began months ago

KOLKATA: The city’s tryst with the plasma-and-glue combo, which led to several dozen bank customers losing their money over the past few days and dented consumer confidence in the ubiquitous ATM, did not start with the cases that came to light this week.
Instead, it is a private bank ATM in Kasba, similarly “skimmed” seven months ago, that can lay claim to the dubious distinction of exposing Kolkata to the dangers of this simple yet dangerously effective combination. The impact, too, was significant; TOI found on Saturday that the bank had just shut down the ATM, preferring not to take chances with a set-up that had been “compromised”.

Detectives and senior bank officials probing the case say around seven-eight complaints were made by the bank’s own customers in quick succession, which alerted them to the possibility. A rapid analysis of the savings account cash transaction pattern of these customers showed that they had all withdrawn cash at the same ATM in Kasba’s Rajdanga. Officers, who probed the case, also found traces of glue in and around the keypad and the card insertion slot.

The bank immediately realised that the ATM had been exposed to skimming and, in accordance with Reserve Bank of India guidelines, refunded customers the amounts they had lost.

The month-long probe by cops, cyber forensic teams and bank officials led to some key findings but they were not enough to lead to any arrest. The CCTV grabs showed one person tampering with the ATM a few days before the skimming attack but could not throw up a clear face. “We could only make out that the suspect looked like an Indian,” an official told TOI.

Cops, who raided several ATM locations in western India (where the cash was withdrawn), returned empty-handed and the case remained unresolved.

Cops probing the recent cases say the possibility of other ATMs being manipulated by the two arrested Romanians cannot be ruled out. “Yes, there is a possibility that more bank customers may still be at risk,” an official said on Saturday.

The bank, whose ATM was targeted seven months ago, said it was aware of the dangers of the glue-and-plasma combination that could expose customers’ money to fraudsters. “We have taken several steps after that. Our ATMs in the city are now being fitted with an array of sensors, which can track any forcible intrusion on the system’s surface and immediately self-start a shutdown procedure,” a senior bank official said. “We are also enabling the ATMs to capture data from chip-based cards,” the official added.

“By end-August, according to an RBI mandate, ATMs need to have an operating systems upgrade that will make it difficult to hack data,” another senior official said. “Banks are now working towards installing them,” he added.