Cardless ATM Scam

This scam exploits cardless ATM features, where a fraudster who has phished your login or one-time code generates a withdrawal code in your banking app and takes cash from an ATM without your physical card.

Quick verdict

Risk level
High risk
Scam type
Account takeover (cardless withdrawal)
Main red flag
A caller pressures you for your banking login or one-time code to 'verify' something.
What to do first
Never share login or one-time codes. Hang up and contact your bank directly.

What to know first

This scam exploits cardless ATM features, where a fraudster who has phished your login or one-time code generates a withdrawal code in your banking app and takes cash from an ATM without your physical card.

Bank and payment scams weaponise your trust in your bank and your fear of losing money. They fake fraud alerts, blocked payments, or refunds, then steer you into moving money to a "safe account", sharing a one-time code, or approving a transfer, actions a genuine bank will never ask of you.

The core pattern to watch for is clear: A caller pressures you for your banking login or one-time code to 'verify' something. Never share login or one-time codes. Hang up and contact your bank directly.

Related tricks worth knowing: the Bank Impersonation Phone Scam and the Two-Factor Code Text Scam. For the wider picture, browse the Bank & Payment Scams guides or run the message through our scam checker.

Scam statistics

#1
copycat bank fraud alerts were the most-reported text scam in the US in 2022
£459.7M
lost to authorised push payment (APP) fraud in the UK in 2023
Source: UK Finance

Tell-tale red flags

  • A caller asking for your banking login or one-time code
  • Pressure to act fast over a 'fraudulent withdrawal'
  • Unexpected one-time codes you did not request
  • Cardless withdrawal alerts you did not initiate
  • A request to 'read back' a code to verify identity

Staying safe

  • Never share your login, PIN, or one-time codes with anyone
  • Hang up and call your bank using the number on your card
  • Turn on alerts for withdrawals and logins
  • Report unauthorised cardless withdrawals immediately

How it usually reads

Example pattern, not a real report
Example pattern: 'This is your bank's security team. To stop a fraudulent cardless withdrawal, read us the code we just sent you.' The code actually authorises the scammer's withdrawal.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

What to notice: A caller pressures you for your banking login or one-time code to 'verify' something.

Steps if you already acted

  • If you shared a code or login, contact your bank at once to lock the account
  • Change your online banking password from a trusted device
  • Review and report any cardless withdrawals you did not make
  • Ask the bank about reversing unauthorised cash withdrawals

Common mistakes

  • Do not share one-time codes, even with 'the bank'
  • Do not act on urgent calls about withdrawals
  • Do not call back on a number the caller gives you

Scams like this one

Your questions answered

How does a cardless ATM scam work?
After phishing your login or a one-time code, a fraudster generates a withdrawal code in the app and collects cash at an ATM without needing your physical card.
Why does the caller want my code?
The code they ask you to 'read back' actually authorises their withdrawal or login. Banks never ask you to share one-time codes.
I gave them a code. What now?
Contact your bank immediately to lock the account, change your password from a trusted device, and report any withdrawals you did not make.
How can I prevent this?
Never share codes or logins, enable withdrawal and login alerts, and always verify calls by phoning your bank on its official number.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.