High riskBank & Payment Scams

Cardless ATM Scam

This scam exploits cardless ATM features, where a fraudster who has phished your login or one-time code generates a withdrawal code in your banking app and takes cash from an ATM without your physical card.

Quick verdict

Risk level
High risk
Scam type
Account takeover (cardless withdrawal)
Main red flag
A caller pressures you for your banking login or one-time code to 'verify' something.
What to do first
Never share login or one-time codes. Hang up and contact your bank directly.

What this scam usually looks like

This scam exploits cardless ATM features, where a fraudster who has phished your login or one-time code generates a withdrawal code in your banking app and takes cash from an ATM without your physical card.

Example message pattern

Example pattern — not a real report
Example pattern: 'This is your bank's security team. To stop a fraudulent cardless withdrawal, read us the code we just sent you.' The code actually authorises the scammer's withdrawal.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • A caller asking for your banking login or one-time code
  • Pressure to act fast over a 'fraudulent withdrawal'
  • Unexpected one-time codes you did not request
  • Cardless withdrawal alerts you did not initiate
  • A request to 'read back' a code to verify identity

What to do

  • Never share your login, PIN, or one-time codes with anyone
  • Hang up and call your bank using the number on your card
  • Turn on alerts for withdrawals and logins
  • Report unauthorised cardless withdrawals immediately

If you already clicked or replied

  • If you shared a code or login, contact your bank at once to lock the account
  • Change your online banking password from a trusted device
  • Review and report any cardless withdrawals you did not make
  • Ask the bank about reversing unauthorised cash withdrawals

What not to do

  • Do not share one-time codes, even with 'the bank'
  • Do not act on urgent calls about withdrawals
  • Do not call back on a number the caller gives you

Similar scams

High risk Bank & Payment

Bank Impersonation Phone Scam

In this scam a caller pretends to be your bank's fraud team, claims your account is under attack, and pressures you to move money to a 'safe account', read out one-time codes, or grant remote access so they can steal your funds.
High risk Text Message

Two-Factor Code Text Scam

In this scam a fraudster triggers a genuine two-factor or one-time code to your phone, then poses as support staff or a contact to pressure you into reading it back so they can take over your account.
High risk Bank & Payment

Fake Banking App Scam

A counterfeit banking or finance app, often spread through an unofficial app store, an advert or a link, mimics a real bank to capture your login and one-time codes. Some fakes are designed to harvest credentials directly, while others install malware that intercepts your genuine banking. Once attackers have your login and codes, they may attempt to access your real account.

Frequently asked questions

How does a cardless ATM scam work?
After phishing your login or a one-time code, a fraudster generates a withdrawal code in the app and collects cash at an ATM without needing your physical card.
Why does the caller want my code?
The code they ask you to 'read back' actually authorises their withdrawal or login. Banks never ask you to share one-time codes.
I gave them a code. What now?
Contact your bank immediately to lock the account, change your password from a trusted device, and report any withdrawals you did not make.
How can I prevent this?
Never share codes or logins, enable withdrawal and login alerts, and always verify calls by phoning your bank on its official number.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.