Most ATM fraud in India does not involve hacking. It relies on a small device attached to the machine, a hidden camera, or a “helpful” stranger. A 20-second check before you insert your card stops most of it.
The four common tricks
| Trick | How it works | What you notice |
|---|---|---|
| Skimming | A fake overlay on the card slot copies the magnetic stripe; a pinhole camera or fake keypad records the PIN | A slot that sticks out, wobbles or looks different from the machine next to it |
| Cash trapping | A strip glued inside the cash slot holds the notes; you leave thinking the ATM failed, the fraudster collects them | The machine sounds like it counted, but nothing comes out |
| Card trapping | A loop in the slot keeps your card; someone nearby suggests you “re-enter your PIN” to free it | Card stuck, a stranger offering help |
| Shoulder surfing and card swap | Someone watches your PIN, then distracts you and swaps your card for a similar one | Crowding behind you, an offer to “help with the screen” |
The 20-second check
- Wiggle the card slot. It should be solid. Loose plastic is a warning.
- Look above the keypad for a strip, a small hole or a light-coloured box that does not match the machine.
- Cover the keypad with your other hand every time you type the PIN, even if you are alone.
- Refuse all help inside the ATM cabin. Bank staff never approach customers at the machine.
- Stay at the machine if cash does not come out, and call your bank from there. Do not walk away to get help.
Bank websites now end in .bank.in
To make fake banking websites easier to spot, the RBI directed banks to move their websites to the reserved .bank.in domain by 31 October 2025. Only verified banks can register these addresses. SBI, for example, now uses sbi.bank.in. If a link in an SMS or WhatsApp message claims to be your bank but does not end in .bank.in, treat it as suspicious.
If money is stolen: report fast
RBI rules on customer liability for unauthorised electronic transactions reward speed:
- Reported within 3 working days of receiving the bank’s alert, when the fraud was a third-party breach (not your negligence): zero liability. The bank must restore the money.
- Reported in 4 to 7 working days: your liability is capped, at amounts that depend on the account type (for ordinary savings accounts, up to ₹10,000).
- After 7 working days: liability depends on the bank’s board-approved policy.
If you shared your PIN or OTP yourself, you may have to bear the loss until you report it. That is why the very first step is to block the card through the app, SMS or helpline, and the second is to call the cybercrime helpline 1930.
Choosing a safer ATM
Machines inside bank branches and well-lit e-corners with a guard and visible CCTV are targeted less than isolated kiosks. Our city pages show where each ATM is: Kochi · Mysore · Aurangabad
Common questions
Is a contactless (tap) card safer at ATMs?
Some newer ATMs accept tap cards, which keeps the card in your hand and out of the slot. The PIN still needs covering.
Should I change my PIN after using a suspicious machine?
Yes, change it from the bank’s app or a trusted ATM, and watch your SMS alerts for the next few days.
Are bank alerts required by RBI?
Banks must send SMS alerts for electronic transactions, which is why your mobile number must stay up to date with the bank.
Last checked: October 2026, against the RBI circular on customer liability in unauthorised electronic banking transactions (2017) and the RBI announcement on the .bank.in domain.
Añadir comentario