Lebanese loop
Encyclopedia
A Lebanese loop is a device used to commit fraud
and identity theft
by exploiting automated teller machines (ATMs). Its name comes from its regular use amongst Lebanese
financial crime perpetrators, although it has now spread to various other international criminal groups. The Lebanese loop is becoming one of the simplest and most widespread forms of ATM fraud.
In a typical scam, the perpetrator will obtain the victim's PIN
either by watching them enter it the first time (shoulder surfing
), or by approaching the victim under the pretence of offering help and suggesting they re-enter their PIN (and again, watching them do so). Once the victim has left the ATM, the perpetrator retrieves the loop and the trapped card, and uses it, along with their PIN, to withdraw cash from the victim's account.
Since the Lebanese Loop is only able to capture one card at a time and the card holder will usually react quickly to the loss of the card, the technique must be widely deployed to net a useful number of cards in a short amount of time. This may require a large workforce to accomplish the task.
Often ATM vestibules have video surveillance equipment installed in them, which can make identification of the perpetrator and method easier.
Lebanese Loop devices are relatively simple to construct, which means a lower skill level is required by the perpetrator than with a “skimming” technique.
ATM industry groups also counsel cardholders to take precautions when entering their PIN into any device.
, which is then used to withdraw cash.
At their most sophisticated, scams can involve the construction and installation of fake fascias built to fit particular ATMs or other card reading devices. These false fronts can house any of the above devices to gather data from the user and allow the perpetrators to acquire or clone cards and their associated PINs. These fakes can often be indistinguishable from unmodified devices to the untrained eye.
Fraud
In criminal law, a fraud is an intentional deception made for personal gain or to damage another individual; the related adjective is fraudulent. The specific legal definition varies by legal jurisdiction. Fraud is a crime, and also a civil law violation...
and identity theft
Identity theft
Identity theft is a form of stealing another person's identity in which someone pretends to be someone else by assuming that person's identity, typically in order to access resources or obtain credit and other benefits in that person's name...
by exploiting automated teller machines (ATMs). Its name comes from its regular use amongst Lebanese
Lebanon
Lebanon , officially the Republic of LebanonRepublic of Lebanon is the most common term used by Lebanese government agencies. The term Lebanese Republic, a literal translation of the official Arabic and French names that is not used in today's world. Arabic is the most common language spoken among...
financial crime perpetrators, although it has now spread to various other international criminal groups. The Lebanese loop is becoming one of the simplest and most widespread forms of ATM fraud.
Characteristics
The term “Lebanese loop” is applied to any number of similar devices that are used to perpetrate ATM fraud by retaining the user's card. In their simplest form, Lebanese loops consist of a strip or sleeve of metal or plastic (even something as simple as a strip of video cassette tape) that is inserted into the ATM's card slot. When the victim inserts their ATM card, the loop is long enough for the card to be fully drawn into the machine and read. The victim then enters their PIN as normal, and requests the funds. The ATM then tries to eject the card, but a "lip" folded at the end of the loop prevents the card from being ejected. The machine senses that the card has not been ejected, and draws the card back into the machine. The cash drawer does not open, and the money that has been counted is retained by the machine. In most cases, the victim's account is not debited. The victim believes the machine has malfunctioned or genuinely retained their card.In a typical scam, the perpetrator will obtain the victim's PIN
Personal identification number
A personal identification number is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. Typically, the user is required to provide a non-confidential user identifier or token and a confidential PIN to gain access to the system...
either by watching them enter it the first time (shoulder surfing
Shoulder surfing (computer security)
In computer security, shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information...
), or by approaching the victim under the pretence of offering help and suggesting they re-enter their PIN (and again, watching them do so). Once the victim has left the ATM, the perpetrator retrieves the loop and the trapped card, and uses it, along with their PIN, to withdraw cash from the victim's account.
Variants
More sophisticated variants of the Lebanese loop scam have developed. In some cases, the fraudsters attach a small camera to the ATM to record the victim entering their PIN. The video from this camera is then transmitted to the fraudsters, who may be waiting near the machine and viewing the video on a laptop computer, meaning they need not approach the victim directly. There have been cases where a fake keypad is fitted to the machine over the top of the real one, and this records the PINs entered.Evaluation of Lebanese loop fraud technique
There are distinct considerations, advantages, and disadvantages to this technique from the fraud perpetrator's perspective.Since the Lebanese Loop is only able to capture one card at a time and the card holder will usually react quickly to the loss of the card, the technique must be widely deployed to net a useful number of cards in a short amount of time. This may require a large workforce to accomplish the task.
Often ATM vestibules have video surveillance equipment installed in them, which can make identification of the perpetrator and method easier.
Lebanese Loop devices are relatively simple to construct, which means a lower skill level is required by the perpetrator than with a “skimming” technique.
Spread
The Lebanese Loop has been a problem in countries with a high number of ATMs like the UK, the United States, Germany and France. Russian criminal gangs are known to have involvement in the execution of this and other fraud techniques.Industry reaction
ATM manufacturers have resorted to several methods to counteract the Lebanese Loop, generally consisting of adding various sensing mechanisms to the card readers. Various network activity profiling processes can be applied to attempt to detect this activity.ATM industry groups also counsel cardholders to take precautions when entering their PIN into any device.
Precautions Cardholders can take against the Lebanese Loop
There are a number of methods which cardholders can use to help prevent themselves from falling victim to Lebanese loop-type scams:- Always carefully shield the keypad when entering your PIN;
- Do not use an ATM if people are hovering around it (especially if they do not move after being asked);
- Do not use ATMs that appear out of the ordinary (e.g. have unusual instructions posted);
- Do not enter your PIN more than twice (to prevent your card from being taken). If necessary, use a different machine or consult your bank directly if possible.
- Do not take advice from "helpful" strangers that happen to be standing near an ATM (e.g. they suggest that you enter your PIN multiple times).
Other forms of card fraud
Other variants of fraud may use a “skimming” technique, where an electronic device is fitted over the ATM's card slot and which reads the information encoded into the magnetic strip on the back of the victim's card as it is inserted. This variant does not require the card to be retained; the transaction runs normally, and the data recorded from the original card is copied to another blank magnetic stripe cardMagnetic stripe card
A magnetic stripe card is a type of card capable of storing data by modifying the magnetism of tiny iron-based magnetic particles on a band of magnetic material on the card...
, which is then used to withdraw cash.
At their most sophisticated, scams can involve the construction and installation of fake fascias built to fit particular ATMs or other card reading devices. These false fronts can house any of the above devices to gather data from the user and allow the perpetrators to acquire or clone cards and their associated PINs. These fakes can often be indistinguishable from unmodified devices to the untrained eye.