Spanish atms turn into fishing lines: nylon thread traps cards in seconds

A strand of transparent nylon, tied inside the card slot, is all it takes to empty a bank account in Madrid, Barcelona or Seville. The Bank of Spain confirms that cash still accounts for 46 % of face-to-face payments, so millions of citizens line up at 51 000 machines every week. Criminals have simply turned that routine into a trap.

The thread that swallows your card

There is no malware, no skimmer, no deep-insert shimmer. One end of the thread is knotted around the magnetic-head housing; the other hangs inside the throat of the reader. When the customer inserts the chip, the machine reads it normally, authorises the withdrawal, then tries to eject the plastic. The nylon tightens, the card stays put. To the user it looks like a mechanical failure.

Enter the “helper”. A polite stranger, often wearing a reflective vest bought online for €12, suggests re-typing the PIN “to unlock the reader”. While the victim obeys, the partner memorises the four digits. A second suggestion: “Go inside the branch, they’ll sort it out.” The moment the victim walks away, the thread is yanked, the card slides out, and the duo empties the account at the nearest non-bank ATM—daily limit gone in under four minutes.

Losses average €1 300 before the victim finishes coffee

Police files show the average plunder is €1 290 because most cards allow €1 000 plus two €100 contactless cash withdrawals before the bank’s fraud algorithm wakes up. In the first quarter of 2024 the Civil Guard recorded 1 047 such incidents, already 83 % of last year’s total. The gangs—mostly Romanian, Algerian and Colombian cells—rotate through small towns on Fridays, when salaries land and branches are closed.

Branch staff hate the scam because the nylon leaves no forensic signature. “We open the shutter and the card is simply gone,” explains a branch manager in Valladolid who asked not to be named. “The customer swears the machine ate it; the camera shows him walking away. Insurance lawyers call it negligence.”

Contactless is your cheapest insurance policy

Security engineers have a blunt rule: if you can tap, don’t insert. Contactless withdrawals, available at 62 % of Spanish ATMs, bypass the throat entirely. For those forced to use the slot, the drill is older than the internet: wiggle the bezel, shield the keypad, never leave the terminal. And if the card sticks, call the bank’s 24-hour line while your foot is still on the mat. The number is printed on every machine; dialling it costs less than the taxi you will need to reach the police station.

The banks will not redesign 51 000 readers for a crime that costs them €0.6 million a year—pocket change next to the €1.2 billion they lose to digital phishing. So the thread stays, the helpers stay, and cash-heavy Spain keeps feeding the quietest bank heist of the decade.