In November 2018, a bit of "helpful advice" circulated via social media promoting the claim that consumers could stymie the theft of money from their debit cards via card readers through the use of a simple technique. The most common version of the post read:
This is from a friend who just had all her bank accounts emptied after she paid a taxi driver with her debit card. She wanted to pay with her credit card but he asked for another method because he didn't want to pay the 4% visa fee.
Received some great advice from the police today that I want to share: whenever you are asked to use debit instead of credit for whatever reason, first fully enter in the wrong PIN. If it is a counterfeit machine it will pseudo process the payment and produce a receipt. An authentic machine will reject the PIN and request a "try again" of some sort.
Help spread the word, as the police tell me this type of fraud is becoming increasingly prevalent.
The problem with this tip is that although it might indeed be useful for detecting counterfeit card readers, the use of such devices is a fairly rare form of theft. Crooks are far more likely to be employing other methods with card readers to illicitly draw funds from bank accounts via debit cards.
For example, some users shared the tip reproduced above alongside a 19 July 2017 report from CTV News in Toronto, Canada, concerning a police advisory for residents. But that report said nothing about cabbies' using "counterfeit" card readers -- it described instead a completely different scheme involving the furtive switching of cards, a form of theft that wouldn't be thwarted at all through the deliberate entering of incorrect PINs:
The advisory stems from multiple reports to police about taxi drivers switching debit card while completing a payment with an electronic terminal machine.
In each instance, police believe the driver hands the customer a different debit card -- from the same bank -- at the end of the transaction.
We asked Los Angeles Police Lt. Jeff Hollis, who works in his department's financial crimes section, whether he had heard of this kind of scam and whether any factual basis underlay the idea that entering a fake number could fool this kind of machine. He told us, "No and no."
It is unclear whether the "wrong PIN" post was spun out of the news story about the Toronto debit card scam or a faulty retelling of another type of incident. But Hollis did say taxi drivers are sometimes unwitting accomplices in yet another type of financial crime: theft involving credit card skimmers. The devices can be attached to a cab's credit card reader without the driver's knowledge, leaving customers' debit card numbers and PINs vulnerable to being harvested via wireless technology.
"The suspect who placed [the skimmer] there doesn't have to be in the cab," Hollis said. "They can pick [the information] up later on when the cab passes a known location or returns to base."
Thieves who use skimmers, he said, are able to attach them to not only card readers in taxis, but also to gas pumps, ATMs, and grocery store payment terminals.
"They're very small, and they're very well-concealed, and they blend in with the rest of the machinery," Hollis warned.
Since skimmers simply record card information as it's passed along to the underlying payment processing device, purposely entering wrong PINs won't foil or reveal them.
But while card skimmers are "dirt common," Lt. Hollis added, wary consumers can still protect themselves from them:
"A good defense is to manipulate the machine with your hand at any time and see if any loose parts come off," Hollis said. "If so, that's a good indication that it may be a skimmer. It can be a gentle manipulation -- touch the machine and see if any loose parts break off."
It is also unlikely, he said, that someone could have "all her bank accounts emptied" after a single transaction. While it is probable that consumers would lose some money after their banking information was compromised, most financial institutions are able to detect and flag suspiciously large or frequent transactions to prevent the draining of entire accounts.