Armed with PoS machines, robbers in a new robbery trend in mass transit buses would hold unsuspecting commuters hostage; order them to surrender their ATM cards and disclose their personal identification numbers PIN; and with the PoS machine, authenticate the PIN and head to a convenient ATM terminal and empty the victims’ bank accounts. Although bank officials say this is impossible, the several narrations of personal experiences that have inundated the social media make the claims hard to ignore.
A young man in Lagos who had a taste of the unfortunate experience but pleaded anonymity narrated his ordeal thus: “I entered a bus (danfo) coming to the Island from Moshalashi Bus stop, Mushin. Unfortunately, it was a bus used for ‘one chance’ activities. All the passengers on the bus were part of the robbery plot.
“They suddenly brought out sharp objects and carpentry tools (hammers) and demanded my valuable belongings. The robbers had a Point of Sale (PoS) terminal and a laptop with them, so they were obviously prepared and had time on their hands for the operation.
“They collected my wallet, took out my debit cards and inserted one of them into the POS machine, demanding my PIN. I initially gave them an incorrect PIN, which infuriated them, so they started to hit me with their hammers on my joints (knees, ankles etc). Due to the excruciating pain, I knew I had to cooperate and not play games with them. I gave them the correct PIN, they checked my account balance and one of them went to an ATM to collect the cash, while I was being driven around in the bus.
“I don’t know how, but without logging into my online personal banking, they could see my bonus accounts on their laptop. This made them very happy and they started asking for the debit card for that account. I am not certain, but it seemed like they could see all my accounts! It is possible that the BVNs help, although they did not ask for that.
“Fortunately (and unfortunately for me) I don’t have a debit card for that other account, so I received more attacks on my joints with their hammer for this, but somehow they gave up and let me go. I lost the available cash they withdrew from the ATM, additional cash I had in my wallet and my lunch card. I called my bank to block the account that holds my bonus to avoid further loss. It was a horrible experience and I hope no one goes through this.”
However, head of Cards and E-Banking at Ecobank Nigeria, Ayotunde Kuponiyi told our correspondent that being robbed with a PoS is not possible as the PoS are tied to accounts and are easily monitored. According to him, “No sane person would obtain a PoS to use for fraudulent purposes because it can be easily traced.
“How is it possible? The PoS is being tied to an account and that account resides with a bank. It is very easy to catch those kind of people. No sane person would establish an account for such a purpose. Also, head, Corporate Services at Suntrust Bank, Raymond Onomerike, stated that robbing with PoS is “difficult because even when people are forced to use their cards on the PoS, the money goes to the merchant account.
“It is only with ATM that people can be robbed.” He explained that PoS terminals are not given to individuals but to established merchants. This is because there is nothing that the individual will do with POS. Before a bank releases their PoS, it must be a merchant, a collection center, there must an activity that people will come and pay for. You must be providing a service or selling a product. But with ATM machines where you withdraw physical cash, we advise that people don’t use it in the night when it is late but in the broad daylight, it is difficult for people to just accost you.”
A financial technology analyst who craved anonymity however differed. According to him, there are loopholes in the system which fraudsters and thieves have harnessed to rob unsuspecting individuals.
He noted that it is possible to use PoS to rob and access several accounts particularly with the advent of the Bank Verification Number (BVN) which links all the accounts of bank customers irrespective of the number of banks that the individual uses.
He explained that while banks may not give PoS to individuals, the terminals given to some individuals may get stolen and end up in the wrong hands. “They may not give PoS to individuals but then I know of a bank that has this practice which I think is wrong. They meet small shop owners and give them PoS, wanting them to make use of that PoS because it increases their revenue. When you give a petty trader a PoS and she is not really using it, she just dumps it somewhere, someone can pick it up or rob her and send a mail to the bank that can you link this PoS to a new account number, or that I have opened a new account and when they do that, the guys can make use of it.”
Asked if banks have noticed the glitch, he said “Some may have noticed it but banks not taking proactive measures may not be out of negligence.” While stating that Nigeria’s card system has the highest level security in the world he said “technology moves fast and what you intend to be good may turn out to be bad. For instance, Nigeria formerly uses magstripe cards but bad guys are smarter than guys with good intentions.
“Who could have thought that BVN can turn around and become this. The way the thieves could have used it was to probably get an Application Interface (API) from Nigeria Interbank Settlement System (NIBSS) get a way to infiltrate the system and that is the way they can get access to accounts because if they break one bank’s system, they can through one bank get other bank’s account number. They have to first go through the central system which is NIBSS. From there they can interconnect the rest.
“The call really is not to individual banks, it is for NIBSS to live up to its responsibility in ensuring that we have enough security if not the entire country will be exposed. Nobody is safe because if you can break into NIBSS you can break into anybody’s account because they are the central system of the country.” The fintech analyst stated.
When contacted, the managing director of NIBSS, Ade Shonubi assured that the BVN system is safe and cannot be penetrated by outsiders as only NIBSS has access to the system. “Banks cannot know the accounts you have in other banks.
“It is not possible to use the BVN because only one person has access to the BVN account linkage and that is NIBSS and the CBN. Banks don’t even have the linkage. Service providers can also not get the link because we bought the solution from a German company and they don’t have access to the network. We don’t use third party to run it, we run it directly.”
Shonubi noted that NIBSS is aware of one case and is already investigating it. “What we know is that commuters are asked to put their cards with their PIN. They (the thieves) don’t do any transaction. They use it to verify the PIN. It is similar to taking a person to an ATM and put a knife to his head and say put your card and PIN, let’s see if you PIN agrees with your card. They then take the PIN and the card. They then go to an ATM later, almost immediately after they rob then use the ATM to take money out of the account,” he said.
Shonubi, however, noted that if this happens, it is still traceable as the cameras at the ATMs will capture the person making the withdrawal and if a transfer was made, the transfer trail will be followed. Noting that NIBSS is already investigating the case which was reported to it. “We will like people to come out and report so that we can investigate and identify the people involved. In electronic transactions there are always footprints which can be traced,” he said.
Meanwhile some Nigerians whose opinion were sampled on the issue say they have resolved not to leave home with their ATM cards, and some others noted that it was because of the security challenges that technology poses that they have resolved to stick to traditional method of banking.
“It is because of something like this that I have refused to get an ATM card,” a trader, Mrs Adenuga told our correspondent. The banks will take my money before they give me, then I will start worrying over how to keep it safe from thieves and fraudsters. I am not ready to do that.”
A clergy, Pastor Babalola on his own part said while one cannot continue to live like a Stone Age man in modern time, “I have resolved to always be careful. I don’t have ATM card for many of my accounts and the only one I have a ATM card for, I always don’t have much money in it. But I just hope that this BVN will not cause another wahala.”
Meanwhile, Lagos State police public relations officer, ASP Mr. Olarinde Famous-Cole said such incident has not officially been reported by any victim. “The division in Lagos State is unaware of such crime. That makes it difficult for us to investigate. I am not saying Lagos State is free of crime but when such crime is not reported, police cannot investigate.
“The police and Lagos State government have put in proactive measures to curb crime relating to ‘one chance’ to keep the state safe and secure.” The command spokesman noted that the police command in Lagos state only heard of such crime on social network and media but no formal complaint. According to him, the new method adopted by armed robbers’ usage of PoS machines can only be credible when bank customers report to either police or related financial institutions.
“I cannot confirm if that story is true until there is a formal report by victims. We do hear of such cases but victims don’t report,” he said. The BVN had been introduced to combat fraud and identity theft in the financial industry by giving a unique identity to bank customers and linking all the accounts of the customers together,” Famous-Cole said.