Cash deposit machines are the new target of scammers who have been ripping off automated teller machine users with card readers and pinhole cameras - but the crooks in the first such case uncovered here appear to have picked the wrong banks.
They installed the devices - which read card details and record users' personal identification numbers - at deposit machines at branches of Dah Sing Bank and Bank of East Asia.
But according to police, the crooks have made a miscalculation, because the two banks' deposit machines, unlike many others in the city, do not require a PIN to deposit money. If depositors at these banks want to check their account balance, they have to do so at a regular ATM.
The Monetary Authority has warned users to be alert to the new scam, which comes as bank customers continue to lose money and remain vulnerable to scams by using ATMs that have been tampered with.
The two new cases came to light when the devices were found at the Tsim Sha Tsui branch of Dah Sing Bank on December 31 and the Tsuen Wan branch of Bank of East Asia on January 1.
Police said a few people had used the deposit machines after the devices were installed, but none reported losing money.
"There's no requirement to put in a PIN, so we really don't know why they targeted the two machines," a police source said.
"I think they got the wrong machines," he said, because other banks' deposit machines offer a balance-checking service for which a PIN is required.
It was the first time such devices were found on deposit machines. The Commercial Crime Bureau is investigating whether this is likely to become a trend.
The illegal skimming equipment is believed to have been installed on at least 10 ATMs since September. From October to December last year, 18 people have reported losing money, with 14 in December alone.
The victims used ATMs at the Yau Ma Tei branch of Nanyang Commercial Bank in September, the Tsim Sha Tsui branch of Bank of Communications in October or the Tsuen Wan branch of Fubon Bank in December.
The city's investigators have sought the help of the mainland authorities as all the illegal withdrawals - using fake cards and the stolen data - were made across the border.
Police say nearly 300 cardholders could have had their personal data stolen because they used the machines that had been tampered with.
Three of the machines had been tampered with twice, and one - at the Yuen Long branch of Chong Hing Bank - was hit three times, the police source said.
No one has been arrested.
Police have stepped up patrols and plainclothes officers have been deployed in certain areas to prevent further such cases from occurring.
"Investigations indicated that the money was withdrawn from the victims' bank accounts through ATMs in Shenzhen or Dongguan ," the police source said.
He said that the police would also exchange information with Macau authorities after two mainlanders were nabbed for installing a skimming device at an ATM in Macau over the weekend.
Police believe one mainland syndicate is behind the scam because the seized equipment appeared similar and the people who installed the equipment, captured on surveillance camera footage, look alike.
The Monetary Authority said the 18 victims have since been compensated, except for two claims received recently, involving about HK$15,000 in total.
"The HKMA has also reminded banks to continue to review and, if necessary, enhance their ATM precautionary measures before the full implementation of the chip-based ATM technology," the authority said.
The chip-based technology project, in which cards are being replaced with ones bearing an embedded microchip for greater security, is expected to be completed in 2015.