The Lebanese Loop

Retro is in style, what is old is new and is cool again. Just like with fashion and cars the retro fad is coming back with credit card thieves as well. One of the most dangerous ways to steal a customer’s information is known as the Lebanese Loop.

The short of it is that a thief installs a small strip of metal, plastic or even video cassette tape that allows a credit card to be inserted into a device like an ATM but it blocks it from being returned to the customer. Despite entering their PIN no cash is dispensed since the card cannot be ejected. The victim is left to believe that the device has malfunctioned. The thief can obtain the victim’s PIN in multiple ways like placing a hidden camera or fake keypad, to shoulder surfing or even to offering to help their unwitting victim and suggesting that they enter the PIN again (while they watch and memorize it). Of course the fake Good Samaritan goes through the motions before they proclaim that the ATM has malfunctioned and that the victim should report it to the bank. When the victim leaves the card is then removed and reused by the criminal to retrieve some cash from their unknowing victim as well as their card (to be used at as many other ATMs as it can be) before they can return.

This particular scam gets its name because it was popular with criminals from Beirut, Lebanon (though it is not exclusive to there anymore). It first appeared in Houston, Texas in 2000 at a Chase Manhattan branch ATM and even had a handwritten note telling the victim to re-enter the PIN if the card was not ejected. It has since spread globally. There are of course risks to the criminal and downsides to it that have made it less effective over time. For it to work properly only the victim and the criminal can be at the ATM, no other bystanders. It also requires the criminal to be able to get the victim’s PIN, which has prompted many people to cover the pad with their offhand when they enter it in. The scam is also a one time thing as the bank or ATM operator will inevitably find the intrusive piece of matter and remove it. Also when the customer finds that the card is gone it may take only a few minutes to cancel the card, especially if they are at one of their bank’s branches so the payout may be as little as $20 and not worth the effort. There is probably a reason that this scam is more frequently done late at night around bars and pubs. Also to get a lot of money requires a lot of effort on the criminal’s part, something which modern day skimmers bypass.

With the spread of this kind of fraud various ATM manufacturers fitted their devices with countermeasures to prevent it. Sensing mechanisms were added to the devices to prevent tampering. Network activity profiling began to try to detect out of the ordinary usage. Many banks record the number of times a PIN is entered and some will deactivate a card if the PIN is entered too many times. Cameras were installed to document the crime as well since the scam requires the criminal to get on camera. Customers as well have become more savvy as many shield the keypad from strangers and many are less reluctant to accept help from a stranger.

With the advent of skimmers that can capture the information off of a magnetic strip the Lebanese Loop appeared to be finished but it has made a resurgence. With the new Chip-and-PIN EMV cards getting the PIN can be worth its weight in gold and the scam has returned with vengeance in some European countries and it is only a matter of time until it returns here to the US.