The “poor security features” in ATMs across India have made the country a “sitting duck” for Bulgarian gangs involved in cloning cards, the Delhi Police said after foiling an attempt to fix a skimming device at an ATM in Khan Market on Sunday. At last count, the police recovered 260 cloned cards from the gang whose two members have been arrested – one from the Khan Market ATM and the other from a five-star hotel in east Delhi.“The gang was found carrying 25,000 euros. Almost all this money was withdrawn fraudulently from their latest visit to India,” Shobhit Saxena, additional deputy commissioner of police (New Delhi district) said, adding that this gang had made three such visits to the country in the last one year. The process of skimming and cloning is an easy process if not for the “advanced security measures” in ATMs in the European countries. The gang started visiting countries like India, Indonesia and Turkey where ATMs still accept cards with magnetic strips even though such cards are fast being replaced with those with chips, Saxena said.Explaining the modus operandi, Saxena said the gang begins by procuring a skimming device and a pinhole camera. “The skimming device resembles a debit card. The gang would fix this slim device in the space where cards are inserted into an ATM. When a customer inserts a card into the ATM, the skimming device reads the necessary data,” Saxena said.The gang then steals the PIN by fixing a tiny pinhole camera above the ATM’s keypad, Saxena said. By the end of the day, the gang would have the data of hundreds of ATM cards.The gang would then purchase gift cards, resembling ATM cards, in bulk from various shopping platforms. Using a card reader, an online application and a laptop, the gang would copy the original stolen data on to the gift cards and jot the PINs behind each card.Carrying out the fraud up to this stage was not a problem in the European countries, the officer said. The problem there was using these cloned gift cards for withdrawing money.“The ATMs in European countries accept only chip-based cards. So, these cloned cards couldn’t be used in those countries. The gang chose countries like India, Turkey and Indonesia to make the withdrawals,” Saxena said.They used tourist visas to frequently visit these countries and allegedly make withdrawals. Once they got the money in Indian rupees, they would visit a foreign exchange centre and get them converted into euros, the officer said.“Sometimes, the gang would also perform the entire fraud in India, but it was not their preferred choice as most card holders in India did not have more than a few thousand rupees in their accounts,” Saxena said.It was one such attempt to dupe Indians that landed the gang in the police net. Officials of a bank noticed a strange device at an ATM in Khan Market and found that it was a skimming device. “They checked the CCTV footage saw that a foreigner was making frequent visits to the ATM. They waited for the suspect to enter the booth before closing the shutters and calling the police,” Saxena said.The suspect turned out to be 36-year-old Bulgarian, Tsvetelin Angelov. At his instance, the gang’s alleged mastermind, 43-year-old Ruslan Petrov Metodiev, was caught from a five-star hotel in the city. Police said the gang used the stolen money to enjoy vacations in Indonesia, Thailand and India. Apart from Bulgarian gangs, the Delhi Police has over the last two months arrested at least seven Romanians for skimming data from ATMs and cloning cards.