Skip to content

ATM Card Trapping ("Lebanese Loop") and Cash-Dispenser Claw Scams: Why You Must Never Leave the Machine

Emergency numbers differ by country. This page uses 911, the number for the United States and Canada. Many other countries use 112, 999, or another number. Find the number for your country.

Inserting your debit or credit card into an Automated Teller Machine (ATM) only to have the motorized card reader jam, swallow your card without returning it, or make the sound of counting currency while the cash-dispenser shutter refuses to open is rarely a random mechanical breakdown. Across North America, Europe, the United Kingdom, Latin America, and Asia-Pacific, organized ATM fraud crews deploy two physical trapping mechanisms, namely the "Lebanese Loop" card-slot sleeve and the Cash-Dispenser Claw / Glue Shutter Trap, specifically engineered to hold your card or bills hostage inside the bezel for the 90 seconds it takes you to give up and walk away. The instant you turn your back to look for a bank manager or walk to your car to call customer service, the criminal who was standing two meters behind you pretending to check their phone (or who captured your Personal Identification Number via a pinhole camera, keypad overlay, or thermal-imaging camera) steps up to the machine, pulls a hidden monofilament tab to extract your trapped card or cash bundle, and drains your daily withdrawal limit before you reach the street corner. If an ATM ever retains your card or fails to open its cash shutter after deducting funds, plant your feet directly in front of the ATM screen and do not walk away: freeze your card inside your mobile banking app while standing at the machine, refuse all help from "friendly strangers" in the vestibule, call the bank's fraud number on the back of your card or your local emergency numbers if threatened, and review our bank jugging and ATM withdrawal tailing guide, our parking garage and ATM vestibule ambush guide, and our express kidnapping and forced ATM withdrawal guide.

According to the European Association for Secure Transactions (EAST), the United States Secret Service Financial Crimes Task Force, and the ATM Industry Association (ATMIA), physical card-trapping and cash-trapping attacks have surged alongside EMV chip migration because a thief who steals your physical EMV chip card plus your 4-digit PIN does not need to clone the encrypted chip: they simply use your actual genuine chip card to withdraw maximum cash at five neighboring ATMs and purchase high-value gift cards or electronics within 15 minutes. Understanding the exact mechanical engineering of a Lebanese Loop film sleeve, how to spot a spring-loaded false cash shutter before you insert your card, why a stranger telling you "Press Cancel twice and re-enter your PIN" is the actual thief harvesting your code, and how to lock your card in 10 seconds on your phone without yielding the machine protects every dollar in your account.

Do this now

  1. NEVER walk away from the ATM if your card is stuck inside the slot or if the machine whirrs without dispensing your cash. Both the Lebanese Loop card trap and the Cash-Claw shutter trap rely 100 percent on you abandoning the machine in frustration. Stand directly in front of the keypad blocking access to the card slot and cash chute, pull out your smartphone right there at the machine, open your bank's mobile app, and toggle "Lock Card" / "Freeze Debit Card" (or lower your daily ATM withdrawal limit to $0) before you take a single step away from the terminal.
  2. Reject all advice from any "helpful bystander" who enters the ATM vestibule and tells you to re-type your PIN. The classic script of a Lebanese Loop thief is to walk up behind you 15 seconds after your card jams and say: "Oh, that machine did the exact same thing to me yesterday, just hold down the CANCEL button and type your PIN in one more time and it pops right out." Do NOT re-enter your PIN. The thief standing over your shoulder is watching your fingers to memorize your 4-digit PIN so they can pull your card out of the sleeve the moment you leave.
  3. Cover your typing hand completely with your other hand or wallet every single time you enter a PIN, even if the vestibule is empty. Lebanese Loop crews frequently glue a microscopic pinhole video camera inside a false plastic brochure holder above the screen, inside the overhead light bar, or inside a false keypad bezel. Cupping your non-dominant hand like a solid roof 2 centimeters (0.8 inches) above your typing fingers blinds both overhead pinhole lenses and thermal cameras, rendering a trapped card useless.
  4. If the ATM made the mechanical sound of counting bills (whir-click-click) and texted a withdrawal alert to your phone, but no cash came out: inspect the cash dispenser shutter for a false glued faceplate. Cash-trapping thieves attach a spring-loaded aluminum or plastic false door lined with double-sided carpet tape or barbed metal prongs directly over the ATM's genuine cash dispenser chute. Gently pull on the edges of the plastic cash dispenser bezel; if a false cover comes loose revealing your cash stuck to adhesive tape, take your cash, keep the trap device for police (holding it by the edges), and call 911 / 112 / 999 immediately while staying safe.
  5. Call your bank's 24/7 Customer Service / Fraud Department on speakerphone while standing at the machine (never dial a phone number printed on a sticker on the ATM). Criminals routinely paste a realistic "ATM Out of Order / Card Retained Helpline" vinyl sticker onto the front of the ATM with a toll-free number that rings directly to an accomplice sitting in a car across the street, who asks you to verify your 4-digit PIN. Only dial the official number from your bank's mobile app or website, report the exact ATM Terminal ID, and have the agent permanently cancel the card while you are standing there.
  6. Prioritize your physical safety: if aggressive individuals enter the vestibule or try to crowd you away from the stuck card, lock the card on your phone and exit immediately. Once you have tapped "Freeze / Cancel Card" inside your banking app, the plastic card stuck inside the ATM slot is nothing more than a worthless piece of dead plastic. Never get into a physical confrontation inside an enclosed glass vestibule over a dead card; walk out into a well-lit public street or inside the bank branch and call police.

Why the 'Lebanese Loop' Defeats EMV Chip Security Without Needing a Skimmer

Many bank customers believe that because their debit card has an encrypted EMV microprocessor chip, ATM criminals can no longer steal from them at a cash machine. That is only true for magnetic-stripe skimming (cloning a duplicate card). The Lebanese Loop bypasses EMV encryption completely by stealing your actual physical chip card. Once the thief slides the thin X-ray film loop out of the card slot holding your real card and combines it with the 4-digit PIN they recorded via a pinhole camera or shoulder-surfing, they walk to the next ATM and insert your genuine EMV chip. Because the card and PIN are both authentic, the bank's fraud computer approves every cash withdrawal up to your daily limit until you freeze the card.

Decision tree: ATM card trapping and cash-shutter claw emergency triage

Follow this step-by-step protocol the moment an ATM fails to return your card or fails to dispense cash after debiting your account.

flowchart TD
    Start["Anomaly at ATM: Card Will Not Eject OR Cash Shutter Stays Closed After Counting Sound"] --> StandGround["1. DO NOT WALK AWAY FROM THE MACHINE: - Stay planted directly in front of the keypad & card slot - Keep your torso blocking the machine from anyone waiting behind you"]

    StandGround --> StrangerCheck{"2. Does a bystander walk up offering 'help' or telling you to re-enter your PIN + Cancel?"}

    StrangerCheck -->|"YES: Classic Lebanese Loop Shoulder-Surfer"| RefuseStranger["REFUSE & SHIELD KEYPAD: - NEVER re-type your PIN - State firmly: 'I am on the phone with my bank security now' - If they become aggressive, lock card on phone app & exit to safety"]

    StrangerCheck -->|"NO: Alone at machine"| AnomalyType{"3. Which failure occurred?"}
    RefuseStranger --> AnomalyType

    AnomalyType -->|"Card Stuck / Retained Inside Card Reader Slot"| CardTrapProtocol["CARD TRAP ('LEBANESE LOOP') PROTOCOL: 1. Open Mobile Banking App -> Tap FREEZE / CANCEL CARD immediately 2. Call official bank fraud line on speakerphone (NEVER call a sticker number on the ATM) 3. Inspect card bezel edge for thin black X-ray film tab, fishing line, or loose glue bezel"]

    AnomalyType -->|"Card Returned, Account Debited, But ZERO Cash Came Out"| CashTrapProtocol["CASH-SHUTTER CLAW / GLUE TRAP PROTOCOL: 1. Check phone app: Was your balance debited? 2. Inspect the Cash Dispenser Shutter: Is there a loose plastic faceplate glued over the chute? 3. Stay at machine & call Bank + Police (911/101/112) to report active Cash Trap"]

    CardTrapProtocol --> RegEDispute["4. PROTECT YOUR FUNDS (REGULATION E / PSD2): - Obtain Bank Fraud Reference # and ATM Terminal ID - Photograph the ATM card slot, cash shutter, and overhead pinhole camera area - If any unauthorized debit posted, file formal Regulation E / unauthorized EFT claim"]
    CashTrapProtocol --> RegEDispute

Anatomy of physical ATM traps: How the 4 hardware attacks work and how to spot them

Unlike deep-insert electronic skimmers that copy data silently while letting you complete your transaction normally, trapping attacks physically intercept your card or currency inside the bezel. Here is how each device is constructed and how to detect it during a 5-second pre-transaction physical tug test:

Attack Mechanism How the Criminal Builds & Installs It What Happens During Your Transaction Visual & Tactile Tells Before / During Use
1. The "Lebanese Loop" (Card-Slot Sleeve / Hook) A strip of thin dark photographic X-ray film, VHS magnetic tape, or flexible acetate plastic (18 mm wide) folded into a loop with tiny inward-facing barbs, or a spring-steel wire hook attached to clear monofilament fishing line tucked under a false plastic bezel lip Your card slides into the film sleeve inside the motorized slot. The sleeve prevents the ATM's internal rollers from gripping or ejecting the card (or blocks the card from seating on the rear microswitch), so the screen either loops "Unable to read card" or freezes while your card stays jammed inside - Card feels unusually tight or spongy when you push it into the slot
- A tiny 1-to-2 mm black film tab, clear fishing line, or folded tape edge protrudes at the bottom corner of the green/flashing card-reader throat
- The plastic card-reader snout wiggles slightly when tugged
2. Cash-Dispenser Adhesive Shutter Trap ("Glue / Velcro Bar") A counterfeit anodized aluminum or molded grey plastic cover that snaps directly over the ATM's motorized cash-dispensing shutter door, lined on the inside face with high-tack double-sided foam carpet tape, rat-glue adhesive, or upward-angled metal teeth You insert your card, enter your PIN, and request $400. Inside the machine, the bill counter counts out twenty $20 bills (whir-clack-clack) and pushes the stack into the delivery throat, where the bills slam straight into the sticky tape on the back of the false shutter instead of pushing the door open - The cash dispenser shutter looks slightly recessed, protruding, mismatched in color, or scratched around the perimeter
- You hear the internal bill counter run and receive an SMS debit alert, but the shutter stays shut and the screen displays "Transaction error / Please take your cash"
3. The "Cash Claw" / Wire Fork ("Trident" Internal Catcher) A long, articulated flat spring-steel wire fork or comb pushed deep into the cash dispenser throat during a prior small $10 withdrawal while the shutter was momentarily open The thief wedges the metal claw inside the cash transport path and walks away. When the next victim withdraws $500, the bills are impaled inside the wire fork deep in the throat; the thief returns 30 seconds after you leave and pulls the wire fork out with your cash - Tiny scratches or pry marks on the bottom lip of the cash dispenser shutter
- A thin wire tip or metal tab visible inside the bottom seam of the cash chute
4. Acoustic / Thermal / Optical PIN Pad Overlays & Pinhole Bars Because a trapped card is worthless without your PIN, the thief installs either:
- A 0.5 mm silicone/metal false PIN pad overlay directly over the genuine keypad that logs keystrokes onto an internal flash chip, OR
- A tiny pinhole lens hidden inside a false plastic brochure rack, light diffuser bar, or side mirror		 As you type your 4-digit PIN, the overlay records the exact button sequence (or the pinhole camera records your fingers). Even without a camera, criminals seated in a nearby car use smartphone FLIR thermal cameras right after you leave to read the residual heat signature of the 4 metal keys you touched (brightest key = last digit pressed) - Keypad feels thick, spongy, raised flush with the bezel surround, or lacks crisp tactile click
- A tiny 1 mm black dot (pinhole) drilled into the plastic trim directly above the screen or in a plastic leaflet box attached to the side of the ATM

How to perform the "5-Second ATM Physical Security Check" before inserting your card

Every single physical trapping device (whether a Lebanese Loop sleeve, a false card-reader bezel, a keypad overlay, or a glued cash-shutter plate) is attached to the exterior of the ATM using double-sided tape, weak silicone adhesive, or friction clips so the criminal can rip it off in 2 seconds after stealing your card or cash.

Before you ever take your debit card out of your wallet, perform this 5-second physical inspection:

1. Switch to Contactless NFC Tap (Apple Pay / Google Pay / Tap Card) Whenever Available

  • Most modern bank ATMs have a Contactless NFC Symbol (four curved radio waves) next to the keypad.
  • If you tap your smartphone wallet or tap your physical card against the contactless pad instead of inserting the card into the motorized slot, a Lebanese Loop cannot trap your card and a deep-insert skimmer cannot read your magnetic stripe. Always use Contactless Tap at ATMs that support it.

2. Grab and Wiggly-Pull the Card Reader Snout (The 2-Finger Tug Test)

  • If you must insert your card, grasp the plastic card-reader bezel (the protruding green, blue, or silver snout) firmly with your thumb and index finger and pull and wiggle it left, right, up, and down.
  • A genuine factory ATM card reader is bolted to the internal steel chassis of the vault and will not budge a single millimeter. If the plastic bezel shifts, flexes, feels loose, or has sticky glue residue or a tiny black film tab inside the slot lip, do not insert your card.

3. Run Your Fingernail Under the Edge of the PIN Keypad

  • Look at the stainless-steel PIN keypad: a genuine ATM keypad sits slightly recessed inside a protective privacy shield surround.
  • If the keypad sits raised up, feels rubbery or hollow when tapped, or can be lifted at the corner with your fingernail, it is a false PIN-logging overlay.

4. Inspect and Tug the Cash Dispenser Shutter Door

  • Before inserting your card, look down at the Cash Dispenser Chute (where the bills come out).
  • Make sure there is no extra aluminum or grey plastic plate glued over the shutter opening, and check that the shutter sits flush and unobstructed.

5. Defeat Thermal & Optical Cameras With the "Two-Handed Roof + 5-Key Touch" Technique

  • Step A (Block Optical Lenses): When typing your PIN, rest your left hand flat over your right hand like a roof so no overhead, side, or shoulder-surfer angle can see which keys your fingers press.
  • Step B (Erase Your Thermal Heat Signature): Because metal ATM keypads retain finger heat for 45 to 60 seconds, as soon as you press ENTER, rest all five fingers of your flat palm across all 10 numbered keys (0 through 9) for 2 seconds. Touching all keys warms the keypad uniformly and destroys any thermal signature.

What happens inside the ATM when a Cash-Dispenser Trap blocks your money (and why you should wait 3 minutes)

When a criminal glues a false shutter trap over the cash dispenser chute and you request a withdrawal, a specific mechanical sequence happens inside the ATM's internal safe:

  1. Seconds 0 to 15 (Dispense & Jam): The ATM debits your bank account electronically, pulls the bills from the internal cash cassettes, and pushes them against the blocked exit shutter.
  2. Seconds 15 to 90 (The "Present Timeout" Window): The ATM's optical sensors detect that the bundle of cash has not been removed. On many ATMs, the bills stay wedged right behind the false shutter against the criminal's sticky tape or wire fork.
  3. Seconds 90 to 120 (Automatic Cash Retraction OR Exposed Trap):
  4. On modern ATMs equipped with anti-cash-trapping firmware, if the shutter cannot open within 30 to 60 seconds, the machine attempts to retract the bills backward into an internal purge bin and credits your account.
  5. However, if the bills are stuck fast to the thief's adhesive plate or impaled on a wire fork, the machine cannot pull the bills back inside. They remain sitting inside the outer lip of the chute waiting for you to walk away so the thief can pry off the false plate and pocket your cash.

Your Exact Step-by-Step Action Plan If Cash Fails to Dispense:

  1. Stay planted in front of the machine for at least 3 full minutes. Never walk into the bank lobby leaving the exterior ATM unattended; if you have a companion with you, have one person stay guarding the ATM screen while the second person walks inside to get the branch manager.
  2. Inspect the cash shutter closely. If you see an obvious false cover plate stuck over the cash exit slot with double-sided tape, pulling the loose cover plate off will often reveal your entire bundle of withdrawn cash stuck to the back of the plate.
  3. Take clear photographs and video on your phone. Photograph the ATM Terminal ID plaque, the card slot, the cash dispenser shutter, and the on-screen error message with your phone's timestamp.
  4. Call your bank's official number on speakerphone while standing at the ATM. Tell the representative: "I am standing right in front of ATM Terminal #[ID] at [Address]. My account was debited $[Amount] at [Time], the machine made a counting noise, no cash was dispensed, and I suspect a physical cash-shutter trap on the machine." Ask the agent to log an Immediate ATM Dispense Dispute / Regulation E Claim and give you the claim reference number before you leave.

Beware of the 'Fake Bank Helpline Sticker' Pasted Right Above the Keypad

Organized Lebanese Loop crews in the UK, Europe, the US, and Australia frequently print high-gloss vinyl stickers bearing the bank's stolen logo that read:

"Having trouble? If this ATM retains your card or cash, call our 24-Hour ATM Technical Release Desk immediately at 1-800-XXX-XXXX and press 1 to eject your card." When you dial that sticker number while standing at the machine, an articulate scammer answers pretending to be the bank's ATM security desk, asks you to verify your name and the last 4 digits of your card, and then asks you to "key in your 4-digit PIN on your phone keypad (or tell me your PIN) so our remote server can send an eject command to the terminal." No bank on earth can remotely eject a physically trapped card over the phone, and no legitimate bank employee will ever ask for your PIN. Always get your bank's phone number from your official mobile banking app.

If a Lebanese Loop thief steals your trapped card and withdraws cash before you can freeze it, or if a cash-shutter trap steals your dispensed currency and the bank initially claims "Our ATM internal journal says the bills were dispensed," federal consumer banking laws protect you when you act within the statutory reporting windows:

1. United States: The Electronic Fund Transfer Act (EFTA) & CFPB Regulation E (12 CFR § 1005.6 & § 1005.11)

  • Zero / $50 Liability Cap When Reported Within 2 Business Days: Under 12 CFR § 1005.6(b)(1), if you notify your bank within 2 business days after learning of the loss or theft of your debit card (including a card trapped in an ATM), your maximum legal liability for unauthorized withdrawals is capped at $50 (and $0 under Visa/Mastercard Zero Liability network rules when reported promptly).
  • Why Banks Sometimes Wrongly Deny "PIN-Authenticated" ATM Fraud: Some bank first-level dispute clerks mistakenly send a form letter denying your claim because "Your genuine EMV chip card and correct 4-digit PIN were used at the ATM."
  • How to Overturn a Wrongful Denial: Under the Official CFPB Staff Interpretations to Regulation E (Supplement I to Part 1005 - Comment 6(b)-2), consumer negligence (such as having your PIN shoulder-surfed at a trapped ATM) cannot be used by a bank to increase your liability beyond the statutory $50 cap, and under 15 U.S.C. § 1693g(b), the burden of proof is on the bank to prove a transaction was authorized.
  • Submit a written Notice of Error (12 CFR § 1005.11) via certified mail attaching your Police Report Number and demanding that the bank pull the ATM Fascia Camera CCTV footage and the ATM Internal Electronic Journal (EJ) log. Under Regulation E, the bank must investigate within 10 business days or provisionally recredit your account.

2. United Kingdom & European Union: Payment Services Regulations 2017 / PSD2

  • Under UK Financial Conduct Authority (FCA) rules and EU Payment Services Directive 2 (PSD2), your bank must refund unauthorized card withdrawals by the end of the next business day (D+1) unless the bank can prove fraud or gross negligence, and the UK Financial Ombudsman Service (FOS) has repeatedly ruled that falling victim to a Lebanese Loop or shoulder-surfing trap at an ATM is not gross negligence.

Set Your Default Daily ATM Withdrawal Limit to $100 or $200 Inside Your Banking App

Most banks set default daily ATM cash withdrawal limits at $500 to $1,500 per day. Open your mobile banking app today, go to Card Controls -> Spending & Withdrawal Limits, and set your standard daily ATM cash limit to $100 (or toggle ATM Withdrawals: OFF until the exact minute you need to use an ATM). Even if a criminal captures both your card and your PIN, an active card control block stops the withdrawal cold.

Regional emergency numbers and agency protocols

Reporting physical ATM tampering, freezing cards immediately, and escalating disputed ATM withdrawals follow distinct national channels:

  • United States and Canada:
  • Police Dispatch: Call 911 if the thief is still lurking near the ATM trying to intimidate you, or call the local police non-emergency line while standing at the ATM so an officer can recover the physical Lebanese Loop or cash claw device.
  • Banking Regulator Escalation: If your bank refuses to refund money lost to a card trap or cash-shutter claw after you file a police report, file a formal complaint online with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint (US) or the Ombudsman for Banking Services and Investments (OBSI) at 1-888-451-4519 (Canada).
  • United Kingdom:
  • Universal Bank Fraud Short Code (159): While standing right in front of the ATM with a trapped card, dial 159 on any UK mobile phone. The 159 Stop Scams UK short code connects you directly to the verified fraud department of your UK high-street bank without risking a fake sticker number.
  • Police & LINK ATM Network Reporting: Call 999 if a suspect is present, or 101 / Action Fraud (0300 123 2040) to obtain a Crime Reference Number. Escalate unresolved bank disputes to the Financial Ombudsman Service (FOS).
  • European Union:
  • Emergency Dispatch & Card Stop Hotlines: Call 112 for police if a trap is discovered on a machine. Use national 24/7 interbank card-blocking hotlines while standing at the terminal:
    • France: Call 0 892 705 705 (or block instantly in your banking app) and report collet marseillais to Police (17).
    • Germany: Call the central card-blocking emergency number 116 116 (Sperr-Notruf) free of charge, and call Police (110) to report Cash-Trapping.
    • Belgium: Call Card Stop at 078 170 170.
    • Spain / Italy / Netherlands: Block immediately via your banking app and call 112 so police can seize the trapping hardware.
  • Australia and New Zealand:
  • Emergency & Police Assistance: Call 000 (Australia) or 111 (New Zealand) if threatened, or the Police Assistance Line (131 444 in AU / 105 in NZ). Escalate bank refund disputes to the Australian Financial Complaints Authority (AFCA - 1800 931 678) or the Banking Ombudsman Scheme (NZ - 0800 805 950).
  • India and Asia-Pacific:
  • India: Call 112 (Police) and the National Cyber Crime & Financial Fraud Helpline at 1930 immediately while blocking your card via SMS or mobile banking. Under Reserve Bank of India (RBI) Limited Liability Circular (DBR.No.Leg.BC.78/09.07.005/2017-18), customers have Zero Liability for third-party ATM breaches reported within 3 working days, and banks must auto-credit failed ATM cash dispensations within T+5 days.
  • Singapore / Malaysia / Japan: Call 999 (SG/MY) or 110 (JP) and use your bank's instant Kill Switch feature in your mobile app.

Frequently asked questions

Why is this ATM card-trapping scam called the "Lebanese Loop"?

Interpol and European banking security investigators coined the term "Lebanese Loop" (known in France as le collet marseillais) in the late 1990s after international fraud rings first perfected the technique in Beirut and Mediterranean banking hubs before exporting it globally. The original device used a simple strip of flexible 35mm photographic or medical X-ray film bent into a loop inside the ATM's card reader slot with two tiny folded flaps that allowed a bank card to slide inward smoothly, but caught the rear edge of the card when the ATM's motorized rollers tried to push it back out to the customer.

How can I tell the difference between a real ATM mechanical malfunction that "ate" my card and a Lebanese Loop trap?

When a legitimate ATM intentionally confiscates ("captures") your card (for example, because you entered the wrong PIN three times in a row, your card expired, or you left the card sticking out of the slot for more than 30 seconds), the ATM's internal motorized rollers pull the card all the way back into a locked metal capture bin deep inside the vault, and the screen displays a clear message stating: "Your card has been retained by your financial institution." In a Lebanese Loop trap, the card never reaches the internal vault bin; it is wedged halfway inside the outer plastic throat, the screen often hangs on "Please wait" or "Unable to read card," and the card bezel feels loose or shows a tiny black film or fishing-line tab. However, you should treat BOTH situations identically: freeze the card on your phone app while standing at the machine before you ever walk away.

If I pull on the loose plastic cash shutter and find my cash stuck to glue tape behind a false cover, should I take my money?

Yes, if your money is visibly stuck to the back of a false shutter cover and there is no criminal confronting you, reclaim your cash immediately, handle the false plastic cover only by its outer edges so you do not smudge the perpetrator's latent fingerprints on the tape, step into the bank branch or a safe public spot, and call the police and your bank. Taking a photo of the trap attached to the machine first provides ironclad proof to both police detectives and your bank's fraud department.

Why did the stranger who walked into the ATM vestibule tell me to "Press Cancel twice and type your PIN again"?

That stranger is almost certainly the criminal who installed the Lebanese Loop inside the ATM slot 10 minutes earlier. If the criminal did not have time to glue an overhead pinhole camera above the keypad, they need a way to learn your 4-digit PIN before you give up and walk away. By strolling into the vestibule pretending to be another customer and telling you a believable lie ("Oh, this machine always sticks, just hold Cancel and type your PIN again"), they trick you into typing your PIN in plain view while they watch your fingers over your shoulder.

What if my bank denies my refund claim saying "Your real EMV chip card and correct PIN were used, so it must have been you"?

Do not accept an automated first-level denial. Under U.S. Federal Reserve / CFPB Regulation E (12 CFR § 1005.6) and UK/EU PSD2 rules, the use of a genuine EMV chip and correct PIN does NOT prove you authorized the withdrawal when the card was stolen via an ATM trap and the PIN was compromised by shoulder-surfing or a pinhole camera. File a written appeal attaching your Police Incident Report Number, demand that the bank pull the ATM's built-in fascia camera video from the timestamp of the fraudulent withdrawals, and file a complaint with the CFPB (US), Financial Ombudsman Service (UK), or AFCA (Australia) if the bank does not refund the balance within 10 business days.

Sources and official guidance

  • European Association for Secure Transactions (EAST) & Europol European Cybercrime Centre (EC3): European Payment Terminal Crime Reports - Physical ATM Attacks, Card Trapping (Lebanese Loop), and Cash Trapping Typologies.
  • Consumer Financial Protection Bureau (CFPB): Electronic Fund Transfers (Regulation E, 12 CFR Part 1005) - Consumer Liability Limits for Unauthorized ATM Withdrawals and Official Staff Commentary on Compromised PINs.
  • United States Secret Service (USSS) & Federal Bureau of Investigation (FBI): Financial Crimes Task Force Advisories on ATM Skimming, Pinhole Camera Overlays, and Physical Bezel Tampering Inspection.
  • ATM Industry Association (ATMIA) & Diebold Nixdorf / NCR Security Advisories: Best Practices for Physical ATM Card Reader Protection, Anti-Cash-Trapping Sensors, and Customer Awareness.
  • United Kingdom Financial Conduct Authority (FCA) & Financial Ombudsman Service (FOS): Disputed Cashpoint Withdrawals, Lebanese Loop Device Claims, and the 159 Stop Scams UK Banking Protocol.