Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Using an ATM safely

    Check the cash machine, protect your PIN and know who to contact if something goes wrong.

    Payment card usersAbout 4 minutes of reading + 3 questions
    Start with the example Has something already gone wrong?

    What you will learn

    • Recognise unusual attachments and situations around a cash machine.
    • Protect your PIN when withdrawing cash.
    • Respond to a retained card or an unfamiliar transaction.

    Practice example

    The ATM has kept your card. Who do you trust?

    At a cash machine
    The ATM has kept your card. Who do you trust?

    The machine does not return your card. Someone nearby says they can release it and asks you to read out your PIN. There is also a sticker on the machine with a help number.

    Fictional scenario for practice.
    Show the example explanation
    Help in exchange for your PIN
    Do not disclose your PIN to a stranger. Seek help from the bank through contact details you have checked independently.
    An unfamiliar sticker
    A sticker is not enough to establish that a number belongs to the bank. Check its official app or known website.

    Check your surroundings first

    Choose a visible, well-lit location. If someone stands too close, tries to distract you or makes you feel unsafe, cancel the transaction and move away. You do not need proof of fraud to decide against using a machine.

    Look at the reader and keypad

    A skimmer is an attachment that can copy card data. A false keypad or small camera may capture a PIN. Look for unusual attachments, visible adhesive marks or parts that seem poorly fitted. These are reasons for caution, rather than conclusive evidence of fraud.

    If you notice such a detail, use another ATM and tell the bank. Do not dismantle the machine. An ordinary appearance does not guarantee that equipment has not been altered.

    Protect your PIN and finish the transaction

    • Cover the keypad with your free hand while entering your PIN.
    • Do not share your PIN with someone offering help, even when the machine behaves unexpectedly.
    • Before leaving, check that you have your card and cash. Keep a receipt if one is issued and you need it to check the transaction.
    • Review your account in the app or on a statement for withdrawals you do not recognise.

    If your card is retained or you suspect misuse

    1. Move somewhere safe first if you feel threatened.
    2. Contact the bank promptly through its official app or a number from its known website. Do not rely on an unverified sticker or help from a passer-by.
    3. Explain the problem and ask about blocking the card if you suspect misuse.
    4. Record the ATM location, time and transaction amount. Report any debit you do not recognise to the bank; do not include your PIN in evidence.

    Reporting to FIN-CSIRT can supplement incident notification, but does not replace contacting the bank to protect your card and account.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    Before inserting your card, you notice part of the reader that looks added on. What do you do?

    Why does this matter? An added attachment may be used to capture card information. Appearance alone cannot diagnose tampering, but suspicion is enough reason to avoid exposing your card pending a bank check.

    1. Continue if the screen displays the bank logo.

      An on-screen logo does not establish that the equipment has not been altered. The screen and reader are different parts of the machine: a normal display does not establish that the reader is unaltered.

    2. Use another ATM and tell the bank what you noticed.Correct answer

      You do not need to establish the cause yourself. Avoid the machine and leave inspection to the bank. Choosing another ATM avoids the possible exposure, while reporting lets the bank inspect the specific machine.

    3. Try to dismantle the reader and inspect the inside.

      Do not dismantle the machine. This may be unsafe and is unnecessary for reporting a concern. Trying to dismantle it can damage equipment or evidence; protecting your card only requires you to stop using it.

    The ATM looks normal and nobody is behind you. How do you enter your PIN?

    Why does this matter? A PIN is a secret that can be recorded without anyone standing directly behind you. Shielding entry reduces that risk, but does not establish that the whole ATM is untampered.

    1. Cover the keypad with my free hand.Correct answer

      Shielding the keypad reduces the opportunity for a person or hidden camera to record the entry. You obscure the digits you press rather than relying on a judgement about who is watching at that moment.

    2. Enter it uncovered because nobody is there.

      An empty queue does not rule out a hidden camera. A camera can record entry in an apparently empty area, so the absence of passers-by is no reason to expose the keypad.

    3. Read the digits out to someone helping me.

      Your PIN is private; do not read it out to others. Someone who hears the digits learns the same secret as if you had written it down for them; help does not require sharing the PIN.

    The ATM has kept your card and a stranger offers help if you share your PIN. What next?

    Why does this matter? A retained card creates pressure to accept quick help. Disclosing the PIN does not resolve why the card was retained; it gives another person an extra detail that could be misused.

    1. Share the PIN to retrieve the card quickly.

      Disclosing the PIN creates further opportunity to misuse the card. If someone later obtains the card, knowing its PIN may make misuse easier.

    2. Leave and wait a few days.

      Waiting may prolong exposure. Contact the bank promptly. Waiting leaves the card’s status unchecked; the bank needs to assess whether protective measures are necessary.

    3. Decline and contact the bank through its official app or known website.Correct answer

      A verified contact lets the bank advise on the card and any necessary block. Move somewhere safe first if you feel threatened. You choose the contact yourself instead of relying on a stranger or a number they supply.

    No registration. Your answers are not sent; the result is just for you.

    Remember

    If something seems unusual, stop using the machine. Your personal safety comes before completing the transaction.

    Contacting your bank safely

    References

    Sources and further reading

    For users in Serbia, the bank that issued the card and the National Bank of Serbia guidance on payment-card safety and fraud response take priority. ATM checks and PIN shielding are supplemented by Mastercard ATM safety tips and the FBI explanation of skimming (United States); US reporting routes are not part of this lesson.

    Content last reviewed