Rubenerd

Despite living in Sydney for now, as a DBS cardholder this story about compromised ATMs still made my blood chill!

Photo by the writer of Some things to Remember.

The backstory

For those who aren't already sick of the news, Robin Chan at The Straits Times summarises the situation:

At least 200 DBS Bank and POSB customers have been hit by an ATM fraud that has seen some $200,000 stolen from their accounts.

The stolen funds were withdrawn from ATMs in Malaysia, DBS said on Thursday.

This was done possibly using ‘cloned’ cards created by using data stolen at ATMs here, sources say, and is the largest such case of ATM fraud to hit DBS in recent years.

The stories from various sources are heavy on reactions, but light on details. I've seen the words hacking and skimming used, which suggests the ATMs themselves were modified, or extra devices were unscrupiously installed.

The reaction

DBS released a statement on the 05th:

SINGAPORE, 05 January 2012 – Yesterday, some customers informed the bank of unauthorised withdrawals made in Malaysia through their DBS/POSB ATM/Debit cards. [..] The average amount withdrawn was about S$1,000 per account. (The bank’s standard ATM/Debit card withdrawal limit is S$2,000 per day). [..] Investigations are underway.

Sure demonstrates the value of having a withdrawal limit. I'd have mine set even lower, if I could.

The following day, DBS posted a followup with more detail:

SINGAPORE, 06 January 2012 – While investigations are still underway, increasing evidence points to the unauthorised withdrawals as being part of a card skimming operation. Preliminary investigations at this stage reveal that two ATMs at Bugis street have possibly been compromised. We have identified the specific periods when the compromise could have taken place.

I'd noticed most ATMs in Singapore had those green, bulbous "fraudulent device inhibitors" installed on card slots years ago. Either they weren't installed on all machines, or they're not as tamper resistant as we thought they were. In any case, eep.

Needless to say, if you've noticed any suspicous activity on your DBS or POSB accounts, be sure to contact the bank ASAP! If I were in my old apartment there I'd go down the street to Liat Towers and sort it out because… oh wait, they closed that branch :P