I lost $5000 after falling victim to card skimming on holiday. Photo / 123RF
I lost $5000 after falling victim to card skimming on holiday. Photo / 123RF
The text came through as I was boarding a flight to Texas and I was sure it was a scam.
I was in the middle of a month-long trip through America and the text asked me to confirm a transaction made in Denpasar, which I certainly had no intention of doing.
The sender claimed to be a major Australian bank I had a travel money account with — oh sure, that old chestnut. I didn't recognise the number. I was suspicious.
Nice try, pal. Photo / News Corp Australia
I'm always suspicious of calls and texts I don't recognise. I'm from a digitally savvy and painfully cynical generation. If growing up in the 21st century had taught us anything, it was: Do not respond to strange messages, especially those inquiring about your whereabouts and finances.
Smug in the knowledge another would-be scammer had failed to outsmart me, I put my phone on flight mode and the whole thing out of my mind.
A few hours later, as I was waiting for a connecting flight at Houston airport, I got another message from the same sender.
Nice try, pal. Photo / News Corp Australia
"It is important you respond to our previous message," they scolded. "Please reply YES or NO."
Maybe I was compelled by the stern mum tone of the message, or perhaps just bored waiting for my flight, but I decided to check the online balance of my travel money card. You know, just in case.
The balance was $0. All my money was gone. I'd been robbed.
I'd had about $5000 in that account, mostly in US dollars and a few other currencies. With my stomach lurching and heart pounding, I checked the transactions list, and scrolled through dozens and dozens of random withdrawals and $2.50 ATM fees, all transacted in Denpasar, in rapid-fire succession until not a single cent was left.
Whoever had cleared out my account had done it only a few hours earlier. Around the time I got that first text, actually. Ironically, I'd been trying to avoid logging into online banking too often overseas, lest I fell victim to a dodgy Wi-Fi scam. Without the text, it might have been a while until I noticed.
With literally nothing left to lose, I replied "No" to the text.
In seconds, I got a call from someone in the bank's anti-fraud department (yes, it really was the bank) who delivered the unfortunate diagnosis: my card had probably been skimmed.
Card skimming is form of money and identity theft that typically uses a device — often concealed in the card reader of an ATM or EFTPOS machine — to collect data from the magnetic strip of a card. And it got me good.
The bank swung into damage control quickly. The compromised card was cancelled so my account was secure again. I was told I was likely to get the lost money recovered, but in up to 20 business days — I'd be home by then. But I could re-load money into the account in the meantime, and switch to the back-up card the bank had already given me.
It was sorted in minutes and all in all, I barely skipped a beat — although I spent a considerable amount of time deranged with panic, There were many things I'd planned for on this holiday: a crook hacking into my bank account and leaving me stranded and penniless was not one of them.
I don't know when or how my card was skimmed. Looking back, I suppose I recall using a few freestanding ATMs in some fairly dodgy locations, including a hotel lobby, a major train station and a bagel takeaway shop (I know, I know, but it was cash-only). I do think to check for skimming devices in the card slots of ATMs, but skimming technology is pretty sleek these days. Plus, when you're using a bunch of foreign cash machines, it's hard to know just by looking if they've been tampered with.
I also couldn't rule out a shopkeeper with a dodgy EFTPOS machine, and now that I mention it, I could think of at least two.
Even though I've thankfully been reunited with my stolen money — while some jerk struts around Kuta in new designer threads, courtesy of me — I'm determined to never let this happen again.
This is what I'll always do when travelling overseas in future.
* Avoid lone ATMs in random places. Sometimes you just know an ATM is risky. For the rest of the US trip, I only used ATMs located in, or just outside, legitimate major banks. Banks are more proactive with inspecting machines for skimming devices than, say, a random ATM in a bagel shop. And they generally charge lower withdrawal fees. Another tip: it doesn't hurt to cover your hand when typing in your PIN.
* Withdraw as much cash as you're comfortable carrying. I know we're living in a cashless society but if you're worried about card skimming in places you're not sure whether or not to trust, this means you won't have to use ATMs and EFTPOS as frequently.
* Have a few sources of money. As well as whatever card you're using, keep a small stash of cash somewhere. Consider bringing your credit card for emergencies (the international transaction fees are outrageous, but worth the sting if you're desperate). I'm too young to know what traveller's cheques are, but if you do, great! Bring some of those, too. The point is, a variety of ways to pay for things means you always have options. This is especially important if you're travelling with someone unable, or indeed unwilling, to cover your costs if you're broke.
* Don't load too much money on travel cards. If someone skims your card, they're going to keep taking money until it all runs out. The less you load onto it, the less they can touch. The downside is you'll have to keep replenishing your funds, which can take days if you're transferring money between banks, and you'll be at the mercy of whatever the exchange rate is at the time of each transfer. In my case, the Australian dollar was on a downward slide for the entire US trip, and with every transfer the exchange rate got worse and worse.
* Have a secondary card linked to your account. I'm grateful I had both the primary and secondary travel cards already activated, so after the theft I just trashed the card that had been skimmed and switched to the other. And just as royal heirs never fly on the same plane, never, ever store both cards in the same place. If both cards are in your wallet and you lose your wallet, you'll have no access to your money at all.
* Tell your bank/banks you're heading overseas. I told mine where I was going and how long for. I don't know for sure, but the knowledge I was in America probably helped the bank cotton onto the fact those Denpasar ATM withdrawals were not by me.
* Pick a capable bank. If you're opting for a travel money card, go with a bank you think is well resourced enough to detect and handle fraud immediately and which offers 24/7 overseas customer care. The whole drama with my card was detected and more or less resolved during the wee hours of the morning in Australia. I didn't have to wait until office hours. The bank also let me reverse charge calls from overseas, and you better believe I kept calling from Texas with new and increasingly paranoid questions my brush with fraud.
* Be smart but not too cocky. A lot of us have an instinctive distrust of calls, texts and emails inquiring about personal information, and I'm grateful for that. That said, if you're on the other side of the world and a text message is the only reasonable way your financial institution can reach you in an emergency — think about it for a second. If someone is claiming to be your bank, perhaps call customer service and ask if their apparent attempt to contact you is legit. It may not be, but then again, they may also be trying to save you $5000.
