That’s right. No longer do you need to have your debit card in hand to withdraw cash from an ATM. You just need your smartphone.
Major U.S. banks started testing cardless ATMs in 2017. Search for nearby ATMs on your bank’s website or app, and you’ll probably find that most of them offer cardless cash withdrawal. Here’s what you need to know before you try it.
First, your debit card must be stored in the wallet app in your mobile phone. When you approach the ATM, you hold your phone over the contactless symbol on the machine, and access the applicable card in your wallet. From there, it’s a matter of entering your regular PIN number and selecting how much cash you’d like to take out.
Another type of no-card-required ATM works like this: You log into your bank’s app to request a one-time access code. You then use that code and your PIN number to withdraw cash from the ATM.
Internationally, some ATMs have even more futuristic cardless features. In Brazil, you can scan your palm (it detects the pattern of your veins!) in order to get cash, the New York Times reported; in some other countries, you can use your fingerprint instead of a card.
While cardless ATMs are considered to be safer than using your physical card, the security of this method is still a bit of a mixed bag. If you’re worried about ATM skimmers or theft, you may be relieved to not have to risk it with your physical card. (You do, however, need to keep tabs on your phone if you’re going out wallet-free.)
One early horror story about cardless ATMs was noted by the New York Times: a thief got a Chase customer’s online banking login, downloaded the bank’s mobile app on their own phone, and used it at a cardless ATM. That customer had almost $3,000 total stolen.
And new phishing scams have cropped up to target these advanced ATMs. In one scam previously noted by Lifehacker, scammers text bank customers saying their account has been locked. When you click the included link to enter your account information and “unlock your account,” the scammers get your info. Banks may send you alerts, but never ones that ask for your account number or social security number to verify your identity.
In a more subtle crime, scammers who access your account can add their phone number to your account, then use their own phone to access your cash at the ATM.
Healthy financial security habits we usually recommend, like frequently checking your bank accounts and freezing your credit, may not be enough to catch the immediate issues rising from cardless ATM fraud.
To keep your information and precious liquid assets safe, use two-step authentication, if available, to log into your bank account online. If you get a text message with a code you didn’t request, ignore it.
Using biometric authentication—your fingerprint or your face—to access your mobile wallet is a good rule of thumb (pun absolutely intended).
And finally, sign up for security alerts for your bank and credit card accounts. The most common is a fraud alert, where your bank texts you if it notices an unusual transaction. But you can also set notifications for a variety of trigger actions, like any time a debit or credit card charge is made, or if there’s an ATM deduction over a certain amount you set. You may be trying to prune your phone notifications, but when it comes to your financial institutions, more information is better than having a problem slip between the cracks.
