According to The SF Examiner, they simply glue down the “enter,” “cancel” and “clear” buttons on the machine's keypad and wait for victims. Once victims have entered the PIN, they find it impossible to press any of those buttons and receive back their cards.
You're thinking: "Why don't they press the same button on the touchscreen?". The answer is that some people get so flustered by the unusual situation that they forget about that option and simply wonder off or enter the bank in search for help and leave the card inside the ATM.
The crook, who's been waiting nearby and watching, steps up, continues the transaction and leaves with the money.
In some cases, when the true card owner returns to the machine and retrieves the card, the thought that someone has done anything with it doesn't even cross his mind, and he finds out about the theft only when he checks his account online or receives an account balance statement.
Granted, this kind of theft is unlikely to be successful for long or to be perpetrated widely by a single thief, since the profits can't be that high, the risk of getting caught is considerable, and there is no easy way to automate the scheme.
Although, to prove that someone who's gluing the ATM's keypad actually intends to steal money is rather difficult. According to Richmond Station Police Captain Richard Corriea, they are likely to just be charged with vandalism instead of felony fraud.
The San Francisco police is warning residents of a rise in this kind of theft. As this method gets more publicity, it's probable copycats will appear.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.