Summer of Scam: Beware of Card Cloning

One day in December, I logged on to my Citibank account and was shocked out of my mind to discover that I had $3 in my checking account and $9 in my savings account.

Only 5 days earlier I had gone to a local branch of HSBC in the upscale Salvador [1] neighborhood of Graça and withdrawn money from my US-based Citibank account (I do this frequently on account of the fact that much of the freelance work I do is U.S.-based for which I’m paid in lowly greenbacks). At the time, my combined balance had been in the four digits – not one!

My heart racing, I checked my account activity and saw that there had been six withdrawals, over two days, from a Banco do Brasil, during which all of my money had been extracted. I knew for a fact that I hadn’t made the withdrawals. I also knew that my Citibank card – which I hadn’t used since going to HSBC – was safe and sound in my possession. “What the hell?” I thought, racking my brain for an explanation. And then it hit me: my card had been cloned.

“Clonagem [2]” as it’s called in Portuguese is not at all an isolated phenomenon. Although I’d never had the pleasure, over the years I’ve had friends who have suffered from “clonagem”; a scam that is so widespread that Brazilian banks are actually very quick, efficient and surprisingly unbureaucratic at restituting money to clients’ accounts. In fact, cloning is one of the reasons both online and ATM banking in Brazil has so many security walls, ranging from “security cards” featuring numerical codes that you enter in response to numbers that appear during each transaction to ATM palm scanners that recognize the veins in your hand.

Unfortunately my old-fashioned Citibank debit card only comes equipped with a secret PIN number. To this day, I have no idea how the perp figured it out (I’m usually pretty careful to check out who’s lurking around me whenever I take out cash). However, (as you can see for yourself in the above video), the cloning itself is done by placing false card readers into the ATM, which enables cloners to make a copy of the card and even to steal the PIN (some cloners also temporarily install cameras that film customers entering their PINs).

While cloning is common in Brazil, I wasn’t sure how my Citibank in the U.S. would deal with the matter. To my relief, they were understanding and efficient; after cancelling my card and transferring me directly to the fraud department (where I had to answer around 40 security questions) I was told that my claim would be investigated and I would have the results within 48 hours. Two days later, the results were still pending, but another two days later all the missing money had been reimbursed into my account and a new card was being UPSed to me in Brazil.

Coincidentally, a week after my clonagem episode, in late December, I received an e-mail from a German friend of mine, Dirk. Having traveled around Brazil for two months, he was spending the end-of-year holidays in Rio de Janeiro [3] where he too had been the victim of a card cloning incident at an ATM. While the damage to his accounts was worse than what I had suffered (he’s a financial consultant while I’m a freelance writer), I knew only too well what he must have been feeling. Actually, Dirk’s reaction was much calmer and more philosophical than mine; he took the incident in impressive stride by going on a feel-better shopping spree even though, weeks later, the matter of restitution from his German bank was still uncertain.

Anyway, moral of the story. Before you head to Brazil (or anywhere else), give your bank a heads up as to where you’ll be going and the dates during which you’ll be away. Once in Brazil, use ATMs in banks with lots of traffic, during banking hours. Make sure at all times that nobody is hovering, watching you, or standing too closely behind you. It’s better to withdraw a large amount of cash (discretely, which you can then keep in a money belt) that will last you for a while; doing so is not only safer, but it keeps foreign transaction fees to a minimum. Also take care when using your credit card for purchases; don’t let whomever is swiping it take it out of your sight (many restaurants and bars in Brazil have portable credit card readers that waiters will bring to your table). Ultimately, there’s no need to panic – just stay alert and keep track of all your transactions.