Rio's Airport ATM Scam

At the end of a long hall on the second floor of Rio's international airport, there is a group of ATMs designed to rob bank account numbers. Despite reports of these robberies allegedly dating back to 2008 and police reports from victims, no one has done anything.

The horrific rape of an American woman in Rio earlier this month, as well as the rapes of Brazilian women that only came to light as a result, put the city on high alert. In an ideal world, these crimes should serve as a wake-up call about impunity and rule of law--that police should actually attempt to investigate all crimes, not just those with rich or influential victims. In addition, this week's attack in Boston brings into sharp relief the need for even more security during mega-events. Foreign Minister Antonio Patriota said that Brazil will take "all necessary measures" to do so. The city government is already taking steps to try to reduce crime, with programs like the pacification units (whether that is really working is another question, but it is at least taking steps).

So with that in mind, I realize that an ATM scam pales in comparison to any of the aforementioned unspeakable crimes, or many of the crimes taking place in Rio, for that matter. But it's emblematic of a continuing problem in Rio with the police failing to act and of impunity in general. Police sometimes are unhelpful; the last time my husband tried to report a card getting cloned in Rio a few years ago, the police actually wouldn't even file the report. When people do report crimes--in this particular case, both foreigners and Brazilians--nothing is done. All in all, this is the kind of thing that makes Brazilians purse their lips and shake their heads, and say something about how that's a shame but that's Rio. But it doesn't have to be this way, not for smaller crimes nor for the more serious ones. It shouldn't have to be.

***

I became the unwitting victim of the scam last week while traveling in Rio. I was alone and didn't want to wander around the streets with cash, so I thought I'd take out money as soon as I got the airport. The airport, after all, should theoretically be one of the safest places in the city. Theoretically.

I remembered that there were some banks on the top floors, but I just needed an ATM. I asked around and was sent to the second floor. I remember thinking that it was nonsensical that there weren't any ATMs on the arrivals floor. But I went upstairs anyway. I headed down the long hall, recognizing a drugstore where I usually buy stuff before departing flights. The drugstore was open, but the place where the ATM guard would sit was empty. A man in front of me seemed to have trouble taking out money, and gave up. I should have known better, but I was exhausted and impatient. I picked the HSBC ATM, quickly took out money, and left.

A few days later, my bank emailed me saying my account had been blocked. When I called, they told me that someone had tried multiple times to take out large sums of cash from my account. But going through each transaction with the representative, I told her that the first withdrawal was in fact mine. "Oh, I just wanted to check that," she said. "That type of ATM is associated with fraud." I cut up my ATM card.

Later, numerous people told me they'd also been victims of the same scam at the same ATMs in Galeão, and sent me links to forums--such as this one and this one--with people reporting the same crime starting in 2011 and even allegedly dating back to 2008. Not every single person who uses the ATMs is getting robbed, evidently, but a consistent pattern is clear. These types of scams take place all over the world. But the fact that one of only two sets of freestanding ATMs in an international airport have been used for several years to rob people is something that could theoretically be resolved easily.

***

Before my flight home, I briefly stopped at the drugstore across from the ATMs. I asked one of the cashiers if he ever noticed anything unusual at the ATMs. "Well, you always see all sorts of weird people," he said. I told him about the scams. He didn't seem surprised. "Yeah, I mean, this hall is totally empty," he pointed out. The guard, I noticed, was in his post this time. "The guard isn't always there," the man added. When I left, the guard was talking on his phone.

To be honest, I'm a little tired of these pre-mega-event stories, of these will-Rio-be-ready stories and is-Rio-tourist-friendly stories, and all of that. I'm much more interested in if the UPPs are working, if new transportation projects are going to happen and if they're going to help commuters, if some of the incredible new public works being built will survive in their current form after 2016. (More on that next week.) So consider this one a freebie to all of the journalists looking for a World Cup/Olympics story. Given how and which crimes seem to get the attention of police in Rio, the media might be the easiest way to tackle this one. It shouldn't be that hard to investigate, and both the tourist and civil police should theoretically have records of some of these complaints. Theoretically.

Image: Galeão, by Zel Nunes.

Comments

[PTRio]

The old "chupa cabra" scam. The O Globo recently posted a video http://g1.globo.com/rio-de-janeiro/noticia/2013/04/policia-prende-homem-que-clonava-cartoes-em-caixa-eletronico-no-rio.html from a bank lobby showing a thief installing this device, showed the police then arresting him, and then showed up close exactly how easily the device and accompanying camera are installed. This is a device which fits over the top of an existing card scanner, with a mini-camera positioned to record entry of your PIN. You can prevent theft of the PIN by covering your hand when entering it, but the false scanner will still get your card number and it can then be used for internet purchases.

Stealing card numbers is big business in Brasil, just this morning the O Globo has an article http://g1.globo.com/rio-de-janeiro/noticia/2013/04/golpe-aplicado-por-carteiros-e-hackers-desviou-r-3-milhoes-diz-pf.html regarding R$3 million in thefts using stolen card numbers. It is big business, and not just in Brasil but also in the US and Europe. If chips were required on all cards, that would help where theft is face to face, but placing an order over the internet requires only the card number.

A guard or video camera could be installed at every ATM location in the entire nation, and still there would be card theft in Brasil as the guard or even bank employees are no doubt sometimes in on the scam. Several banks in Brasil recently reduced the amount of cash which may be withdrawn per day using foreign cards, HSBC cutting its limit from R$1,000 to R$300 (depending on time of day), same with BdB (but which then raised the limit back to R$1,000) and CitiBank (lowered from R$1,000 to R$600). People have reported varying limits, though, depending on whether the ATM is at a shopping mall, whether they have a chip on their card, or based on time of day.

The newest method of robbing ATM's is to simply blow the thing up. Thieves now know exactly how much explosive to use, and where to place it in order to avoid destroying the currency.

How do you stop all this? I doubt it can be stopped. Police in Rio will be devoting attention first to preventing a Boston Marathon style attack, catching a thief who robbed a few hundred dollars using a cloned ATM card is not likely to be a top priority. Definitely not before the mega events come to Rio. Those events offer the opportunity of a lifetime for all the thieves and scam artists, and will draw even more from outside the Country. Brasil is a nation full of "esperto's", who believe they are more clever than anyone else. They sell pirated good, hack websites, clone credit cards, hijack trucks, steal cars and motorcycles and basically want a shortcut to wealth, which they believe will bring happiness. Too much separation between haves and have nots, and a path to move up has only begun to exist over the past generation for those willing to earn their way up. Obviously, too many believe they know a shortcut.

People should become aware of the problem, and act to protect themselves by checking the card scanners on the ATM's they use (grab the thing and try pulling it loose, a fake one will come loose), by covering their hand when entering a PIN, and by checking their accounts online frequently while traveling. These simple steps have helped me avoid the card cloner's for 7 years now, after having had it happen three times and only later learning my card was actually cloned in the lobby of an HSBC bank in Ipanema.

[Octavio]

Hello.
On my last trip to rio my Credit Card was cloned too, have no idea where, a restaurant, bar, who knows.
Clearly nothing will work properly in these Rio and Brazil Mega Events and no legacy will be left to the population, as had happened with Pan-American games. The army will be called to be in the streets and will be a shame to the whole country. I have no hope that Brazil will ever solve these issues. Cheers

[Rio Gringa]

Yeah, credit card cloning happens.

Well, a lot of people feel that way. Hopefully things will improve, even if slowly.

[Brendan]

I'm an American living in Rio (5 years) and we avoid the ATM's in the airport like the plague because of the number of scams that we have personally heard about happening there including friends and co-workers. I read an article here that said you should always look for a transparent tape-like film in the card slot before putting your card in. Sorry about your loss. By the way, we enjoy reading your posts.

[Rio Gringa]

Hi Brendan, thanks for your concern - the bank is taking care of it, luckily. The fact that you know so many people who got ripped off is exactly why I wanted to write this - there is no reason this should keep happening, at the airport of all places.

[Rio Gringa]

PTRio, thanks for your comment as well. Typepad has been sending some random comments to spam for some reason, which I just discovered when it sent my own comment to spam. I appreciate the advice and your point about the changed ATM limits, which I didn't know about.

And I agree with your observation about the mega-events 100% - but the fact that the airport ATMs are doing this is something that strikes me as such a no-brainer to fix ahead of time.

[Jetset]

Got me on 28th July 2013 HSBC freestanding ATM on 3rd foor of Galeao. DON'T USE THESE MACHINES IN RIO AIRPORT.

[SadFace]

Got me on 8/14/2013. Same 2nd floor HSBC ATM.

[James O]

It got me too on 10/13/2013, same 2nd floor HSBC ATM but the strange thing is how did they get my PIN code??? I covered my hand carefully when i typed my pin and there is no way any kind of camera could have gotten my pin. I guess the whole machine is setup to record the information. either the keypad itself is wired to their readers or they intercept the communication between the ATM and the bank (although I thought that's encrypted).

Anyway, PLEASE DON'T USE THE ATM MACHINES AT THE AIRPORT!!!

[PTRio]

"how did they get my PIN code??? "

That is a mystery, covering your hand using a magazine or even just your other hand should shield your fingers from view and avoid having the mini-video camera record your PIN. It could be that your finger movements gave it away? I always throw in a few fake moves, make it look like I am touching numbers which are not in my PIN, while entering it. If there is a new scam method which captures PIN numbers without a video camera I hope it is figured out so counter measures can be taken.

The airport ATM's are a constant source of problems, and these problems can only continue with the aid and support of whomever is in charge of security there. That makes it especially difficult, as the same police you report the crime to are actually the ones aiding, abetting and profiting from it. I would walk to Zona Sul from the airport before using a cash machine there.

Cash withdrawal limits have been restored to R$1.000 at the BdoB, R$800 at Bradesco. I quit using HSBC, so am not aware whether their limits have been increased from the R$300 they imposed six months ago. CitiBank charges higher fees on my cards, so I avoid them as well and do not know what amount the currenly use as a cash withdrawal limit.

In all cases, you must still notify your local (US or European) bank of your travel plans or they will shut off your card after the first use in Brasil.

[ExpatRio]

I just had my card cloned at the HSBC ATM in Terminal 1 at Galeao last month. I am 100% certain because I only used it once that month and it was after I had visited the Federal Police to get my RNE card extended. I assumed the airport would be a good place to take out cash because it is less likely that someone is going to assault you afterwards. I remember being a little suspicious because an older European man was ahead of me in the queue and was taking forever to get his money out. The machine seemed unusual but gave me my 300 Reais. I assume now it was one of those machines they out over top of the real machine...like shown in the video online. The cloners took out 900 dollars worth over the next two days before I found out and blocked it.

It is unacceptable that this scam should be allowed to continue for years on years at Galeao.

BEWARE and NEVER USE AN ATM AT GALEAO airport in RIO!

[Chris]

I'm planning to move to Brasil and want to open a bank account there. Can anyone recommend a trustworthy bank? They also must be able to communicate in english. I know I need to learn portuguese but that is going to take a long time.

Obrigado

[Tim]

My wife and I have just discovered both our debit cards have been cloned after using the airport ATMs - it's unbelievable the authorities allow this to continue at the airport!

[Alan]

I just got back from a week in Rio, and my card was cloned too. Where did I take out money? The HSBC ATM on the 2nd floor. I covered the PIN pad when entering so no money was taken out. I only noticed a problem 3-4 days later when my card would not work in Sao Paolo.
I guess the lesson learnt is always use an ATM inside a branch.

[PTRio]

The newest technology in ATM theft is Bluetooth. These devices are very small, and based on what I have read (including Krebs website which has a long article on this new theft technology) they can be installed in a few minutes and will transmit the stolen information to the cell phone of the nearby thief via Bluetooth so that no physical entry into the ATM is necessary.

The Bluetooth device records your account number and the PIN you enter without a hidden camera. Other methods which are able to steal your PIN include a fake keypad, or a keypad overlay, which records your PIN and steals it even if you cover your hand while entering the PIN.

With the Olympics coming, Rio will become the center of the ATM theft world (if it isn't already). I recommend avoiding ATM's in Rio during the Olympics. Bring cash, exchange a small amount at the airport to pay for transportation, then shop around the various exchange businesses for the best rate. They usually give better rates for exchanging over US$1,000 at a time. I use a "cambio" here in Rio which delivers money to your hotel or apartment in less than one hour for no extra charge. And, their rates are usually a bit above the published "official" rate, with no add on fees. That is about as safe a means of exchanging money during the Olympics, or any other time, as I can come up with.

During the past week here in Rio, I have been unable to use Bradesco or Banco do Brasil ATM's for cash using my chip cards. Nor has anyone I know had any success. Not sure what the problem is, but it is a Brasilian problem as my bank has confirmed receiving no electronic communications with respect to a cash withdrawal request. The one chipless backup card I have worked, so the bank sent me a replacement chip card thinking that card might be defective or damaged. I use only one of my three cards at any given time for ATM withdrawals here, that way I have two backups in case a card is cloned. The new chip card arrived in three days (!!!) but it does not work either. I have heard rumors of a hacking attack on Brasilian banks (which is very common), but as usual the people working at the bank are totally clueless. So, for now, only my non-chip card is working for ATM withdrawals.

While I prefer the added security of a chip card, I recommend bringing at least one chip and one chip-less card in case you have the same issue I am now experiencing with the chip cards. Also, if you prefer not to bring cash, think about setting up an account to use only for ATM withdrawals. Fund it online only when you are going to make the ATM withdrawal. That may help avoid having to deal with a major cash loss if your card is cloned.