Like many bank customers in the UAE, last week I received a message on my mobile: there had been reports of "ATM misuse" and I should change my personal identification number immediately. Not exactly a welcome message coming from the institution that holds all of my ready cash. Like many other worried UAE bank customers, I dutifully went to a nearby ATM and keyed in a new number (nothing, luckily, had been stolen).
Yet a week after queuing up and changing PINs alongside the hundreds of thousands of people who were warned of the fraud, consumers in the UAE are still largely in the dark. How extensive it was, how much money was taken and whether the breach has been closed off remain unanswered questions. The UAE central bank, which in previous cases of ATM fraud in 2003 and 2006 stepped in to reassure customers that their money was safe, has been conspicuously absent. The institution, which regulates the country's banking system, has not even deigned to issue a statement about the fraud, and repeated attempts by reporters to get information have elicited little more than a shrug and a finger pointed at the banks.
That leaves consumers in a precarious position. The banks appear to be doing their best to root out whoever was responsible and stem the tide of unauthorised transactions. That, however, has far from eased the concerns of consumers, especially those who were cleaned out in the Ramadan raid. Even if you were not one of the victims, now is a good time to review the steps you can take to try to protect yourself against ATM fraud. While none of these measures can fully insulate you ? if criminals breach your bank's files, you are stuck ? if you follow them, at least you will not be blaming yourself later for leaving your money vulnerable.
Change your PIN Most experts say you should change your PIN about once a year. It also makes sense to change it, say, after a trip abroad during which it could have been stolen. If you worry about remembering an ever-changing PIN, use numbers that are meaningful to you but would be nearly impossible for a thief to guess. A few examples: you and your spouse's ages (which conveniently change every year), your children's ages, the last few digits of your phone number from childhood or an old street address. Avoid using your birth date, as it is not too difficult to find and is likely to be the first number enterprising criminals will try.
Different PINs for different cards Many people make the mistake of using the same number for their ATM card and credit cards. That creates an extra hassle if your PIN gets ripped off along with your purse or wallet. Clearly, thieves will try a PIN that worked on one of your cards on all of them. One good strategy is to rotate PINs among your cards every year, solving the annual PIN-changing and different-PIN problems in one swipe.
Cover your PIN One age-old method with which thieves rip you off at the ATM is called "skimming". They insert a device into the ATM to record your bank details, and then point a pinhole camera at the keypad to get your PIN. That is why ATM security experts recommend that you place your left hand over your right hand (or vice versa) as you type in the numbers. Cameras for skimming are usually installed above the keypad, not to the side.
Use the right ATMs Ideally, you should use only your bank's ATMs, as they do not charge fees for withdrawals and are likely to be more secure than non-branded machines such as those you might find in a petrol station. If you cannot find one of your bank's machines nearby, though, look for ones that have strong security measures and are not in crowded areas. The ideal ATM for a skimmer is one in a bustling area where a lot of transactions take place and where he can watch to make sure the operation is working.
"They want to be somewhere crowded where they can watch the ATM to make sure the device doesn't fall off and that somebody doesn't pull it off," said Graham McKay, the executive director of the ATM Industry Association for the Middle East and Europe. "Something like a large car park near a major store that's got ATMs would be a perfect place for committing the crime." So stick to ATMs in secure and uncrowded places. Your safest bet: bank lobbies, which are secure and heavily monitored by cameras. Skimmers dare not go there.
If you are withdrawing cash from an unfamiliar ATM, you should also look for something called a "fraudulent device inhibitor", a chunky plastic card slot, often green and with flashing lights, that is meant to protect against the insertion of skimming devices. Set up SMS alerts Most large banks these days let customers set text-message alerts that flash you if you buy something that costs more than a predetermined amount. They can also tell you if your balance dips below a certain threshold or if you receive a large deposit. Some banks will even alert you of all your transactions, letting you know immediately if anything fraudulent is going on in your account.
While these tools cannot prevent fraud, they at least give you a way of detecting it early. They can also give you peace of mind if you happen to misplace your card - for example, leaving it in a restaurant one night after paying the bill. If you have no messages when you discover it is missing the next morning, you know no one has taken you for a ride. "Customers should go to banks that provide real-time SMS transactions," said Tamer Gamali, the chief information security officer at the National Bank of Kuwait. "That enables them to change their PIN the minute something comes up. If I skim your card today and take out Dh2,000, you get an SMS, you change your pin and stop me from taking any more money out. It's not going to prevent it, but it will control it. Don't just fly on the idea that nobody knows your PIN."
Check for fraud-detection software While most banks in the developed world have sophisticated fraud-detection software that monitors spending patterns for unusual activity, the UAE is lagging somewhat in this respect. Some have it and others just don't. Banks that do have it call their customers when the software sees a transaction it considers unusual. If you live in Dubai, for example, and you start charging up large sums in Mexico, a flag might go up, prompting the bank to call you to see if that was a bona fide purchase.
When you are shopping around for a bank, look carefully over its security features; banks that use fraud-detection software often advertise it prominently ? or, at least print it in brochures and account literature. Follow all the steps above and your money should be quite safe, at least as safe as it can be in this complex world. If another ATM fraud happens in the UAE, you may have to stand in line to change your PIN again. If you set up SMS alerts, though, at least you know you have not been cleaned out.
afitch@thenational.ae