ATM card swapping fraud in Pakistan works like this: a criminal watches you type your PIN at an ATM, distracts you for a few seconds, and hands you back a different card from the same bank. You walk away thinking nothing is wrong — while the criminal walks away with your real card and your PIN.
It is a low-tech trick, and that is exactly why it works. No hacking, no fake machine, no phone call. Just a quick swap at a busy ATM, usually aimed at people who are less comfortable using machines — especially elderly customers and pensioners.
How the scam works
The trick usually follows the same steps:
- The criminal watches your PIN. Someone stands close behind you in the queue, or pretends to be waiting their turn, and watches the keypad as you enter your PIN. This is called “shoulder surfing”. A second person may be involved to create a distraction.
- A distraction at the machine. The criminal may strike up a conversation, ask for help, point out something on the ground, or pretend your transaction has a problem. The moment your attention shifts, the swap happens.
- The card is exchanged. While you are distracted, your card is replaced with a lookalike card from the same bank. Because the two cards look almost identical, most victims do not notice the switch.
- Your money is withdrawn. With your real card and your PIN, the criminal can withdraw cash, transfer funds or make purchases — often before you even realise the card in your pocket is not yours.
A related trick is “card trapping”, where a device fitted into the card slot stops the machine returning your card. When you give up and leave, the criminal removes the device and takes your card — having already watched you enter your PIN.
A real case: the Quetta gang arrested in October 2026
In October 2026, Quetta police arrested three men near Kuchlak who were accused of running an ATM card-swapping operation across several cities. Police recovered 45 ATM cards belonging to different banks, Rs 500,000 in cash, three mobile phones and a vehicle from their possession.
According to police, the suspects targeted elderly citizens, pensioners and people unfamiliar with ATM machines — particularly at the beginning of the month, when salaries and pensions are credited to accounts. Police said the group had allegedly been involved in ATM fraud for around 12 years and was linked to more than 30 inquiries at the National Cyber Crime Investigation Agency (NCCIA).
News reports said several victims reported substantial losses after their cards were switched. Police traced the suspects’ vehicle through CCTV footage and the Safe City surveillance system.
This was not an isolated case. Earlier in 2026, the NCCIA’s Cyber Crime Circle in Islamabad dismantled another organised gang involved in ATM card swapping at ATM booths, recovering a number of ATM and debit cards. The pattern is the same in both cases: watch the PIN, swap the card, drain the account.
Why pensioners and first-time users are targeted
- Routine withdrawals. Pensioners and salaried workers often withdraw cash on fixed days each month, so criminals know when to wait at ATMs.
- Less familiarity with machines. Someone using an ATM for the first time, or struggling with the screen, is more likely to accept “help” from a stranger — and less likely to notice a swapped card.
- Politeness under pressure. A friendly stranger offering help feels hard to refuse, especially for older customers. The criminals count on that.
- Slow discovery. Victims who check their balance rarely may not notice unauthorised withdrawals until days later, giving criminals time to empty the account.
Red flags at the ATM
- Someone standing unusually close behind you or watching the keypad.
- A stranger offering to help you use the machine, especially if you did not ask.
- Anyone trying to distract you mid-transaction — dropping something, asking a question, pointing elsewhere.
- Your card feeling different, or looking slightly different, when it comes back to you.
- The machine behaving oddly, or your card not coming back out at all.
- A stranger hanging around the ATM with no obvious reason to be there.
What to do if your card is swapped or kept by a machine
- Block the card immediately. Call your bank’s helpline or block the card in your bank’s mobile app. Do not wait until you get home.
- Check your account for any transactions you did not make, and report them to your bank straight away.
- Report it to the police and to the NCCIA helpline on 1799. If the bank does not resolve your complaint, you can escalate it through the State Bank of Pakistan’s complaint portal.
- Do not try to remove a trapping device yourself. Step away from the machine and contact the bank or police instead.
How to protect yourself
- Cover the keypad every time. Shield the keypad with your other hand or your body while entering your PIN, so no one behind you can see it. The State Bank of Pakistan’s cardholder guidelines give exactly this advice.
- Never hand your card to a stranger, and never accept help from someone you do not know at an ATM. If you are struggling, cancel the transaction and go inside the branch instead.
- Check the card you get back. Before leaving the machine, look at the card — make sure it is yours, with your name on it.
- Use ATMs in busy, well-lit places, preferably inside a bank branch during working hours.
- Never share your PIN with anyone. No bank employee, helpline caller or “helpful” stranger ever needs your PIN.
- Keep your PIN secret and change it regularly. Do not use a PIN that is easy to guess, such as your birth year or a repeated number.
- Turn on transaction alerts so every use of your card sends you an SMS immediately. An alert you do not recognise is your earliest warning.
- Take your card and cash before leaving, and put them away before walking off. Do not count cash in front of strangers.
- Warn elderly family members, especially parents and grandparents who draw pensions. A two-minute conversation about this trick could save their savings.
Similar tricks use the same idea — a stranger’s “help” at the wrong moment. Fake bank helpline calls try to get your OTP over the phone (fake bank helpline fraud), SIM swap fraud lets criminals take over your number (a SIM swap attack), fake NADRA officers demand a “verification fee” (fake NADRA officer scam), and fake prize calls pressure you into paying a fee (fake prize call scam). In every case, the defence is the same: never share your PIN or OTP, never accept unsolicited help, and verify through your bank’s official helpline.