Bank of Russia lists signs of fraudulent ATM cash withdrawals
Starting from 1 September 2025, banks issuing payment cards to their customers will be obliged to make sure that individuals withdrawing money from ATMs are not manipulated by fraudsters and that the transactions are not carried out by scammers. The Bank of Russia has listed nine signs to guide credit institutions.
If a transaction meets at least one of the criteria, the bank has to notify its customer to this effect immediately and limit ATM cash withdrawals to ₽50,000 a day for 48 hours. Customers will be allowed to request larger amounts at bank offices. The notification method will be specified in the agreement between the bank and the customer. As a rule, banks send SMS messages or push notifications.
The signs of potential fraud include behaviour that is not typical of an individual withdrawing money. Banks will pay attention to an unusual time, amount, or ATM location as well as ways to withdraw cash (for example, using a QR code or a digital (virtual) card instead of a payment card). Another sign of fraud involves cases when a credit institution becomes aware that, at least six hours before the transaction, its customer’s phone call activity had changed and the number of SMS and instant messages received by him/her from unknown numbers had increased.
A bank may decide that its customer is a victim of malefactors if he/she withdraws cash within 24 hours after taking out a loan (microloan) or raising the cash withdrawal limit (including on a credit card), transferring to his/her account over ₽200,000 via the Faster Payments System from his/her account with another bank, or closing a deposit worth the same amount early.
The list of suspicious signs also includes cases when an individual changes his/her telephone number to log in to online banking and banks receive information (including from mobile operators) that the characteristics of the telephone that the customer uses to withdraw money have changed or that malware is installed on it. The criteria applicable to cash withdrawals using tokenised cards have been set out separately.