You could be out of the country and out of luck with your ATM card

As thieves become better at cracking ATM codes as well as stealing credit-card numbers, banks are getting more aggressive about locking down their international systems when they suspect fraud, leaving travelers stranded without access to their cash, and no warning.

Take the case of Frank Conlon, a retired University of Washington history professor, who tried to use his Wells Fargo Bank-issued Visa debit card at a cash machine in London recently. It wouldn't work, even though he had used it six weeks earlier in India and Thailand.

The problem didn't have anything to do with his account. Nor was it a technical glitch, he found out after making calls to his branch and to bank headquarters in California.

"Wells Fargo had put a hold on any ATM transaction in the entire U.K.," Conlon said. "When I asked them why they had not informed the customers, they said it was to 'not compromise our investigation.' "

He was told to take his card into any bank and get cash over the counter, but he could find no bank willing to do this. Finally, he obtained the cash he needed by writing a personal check at an American Express office and showing his Amex card.

"Periodically, we do block transactions," said Wells Fargo spokeswoman Lara Underhill. Underhill said the bank's security policies prevented her from providing any details about what happened in London.

"Most of the time, [your card] is going to work, but there are times when we take extra steps to protect our customers."

News reports circulated last week that the Wells Fargo problem was linked with a widespread security breach that caused several banks to reissue debit cards or block access in countries where ATM cards were used to withdraw cash.

Citibank recently confirmed reports that it had detected fraudulent ATM cash withdrawals with some of its MasterCard credit and debit cards used in the UK, Russia and Canada.

A series of consumer accounts had been compromised during data leaks by third-party U.S. retailers, the bank said. As a result, it blocked ATM transactions in those countries earlier this month, and had to issue new cards to some customers.

Avivah Litan, an analyst writing for the Gartner research group, called the combined bank actions reflective of the largest PIN theft to date.

The schemes involve hackers somehow gaining access to the encrypted PIN data that is sent along with card numbers to processors that execute PIN debit transactions. The thieves also steal terminal keys used to encrypt PINs, which are typically stored on a retailer's terminal controllers, according to her report. They then use the information to make counterfeit cards.

Fraud alerts

More common than system-wide lock downs is a hold placed on an individual's credit card when a transaction triggers a fraud alert. In these cases, the bank usually informs you, but the alert comes in a phone call to your home or work number, and you usually don't know about it because you're away on a trip.

This usually happens when you try to use your card in a place you normally don't, even Canada, as one Seattle woman recently found out when she tried to use her Bank of America-issued Visa card to buy Whistler ski-lift tickets at a 7-Eleven in Squamish, B.C.

Her card was denied. When she returned home, she found phone messages on her machine from the bank asking her to call.

Credit-card fraud costs banks and merchants millions annually, and ATM forgeries and PIN thefts are rising. Federal laws limit consumers' liability provided stolen cards and unauthorized charges are reported promptly (see www.ftc.gov for details), but travelers who want to avoid hassles will want to take some precautions.

Here's what to do

• If you're leaving the country, tell your bank where you're going and when, even it it's just across the border to Canada. Do this by calling the number on the back of your credit and ATM cards. Although it might not seem wise to tell a stranger that you'll be away, it's the smartest way to avoid hassles. You can be somewhat vague about the dates.

The bank will alert its fraud department that you will be using your cards while traveling. This works most of the time, but it's not a 100 percent guarantee.

Before you leave, get the phone number (not the 800 number on the back of the card) to call from outside the country in case there's a problem. Usually it's a number that accepts collect calls. Hopefully, you won't be routed to a call center in India. But if you don't get a satisfactory answer from the first person you talk to, ask to speak to a supervisor.

• Don't rely on any one payment method. Take back-up cards (two different credit cards, and if possible, two ATM cards tied to different banks or credit unions), extra cash and/or travelers checks. Memorize any PIN numbers you might need, and keep your backup cards in a separate and secure place.

• Bring an extra picture ID in addition to your passport. You could be asked for two forms when cashing a travelers check or for a cash advance or other banking transaction.

• Don't respond to e-mails saying that your credit or debit card may have been compromised. The practice of sending fraudulent e-mails alerting consumers to fraud that hasn't taken place is called phishing, and it's becoming more common.

Banks don't notify you by e-mail or use e-mail to ask for account numbers, social security numbers or other confidential information. They call.

Carol Pucci: 206-464-3701 or cpucci@seattletimes.com