San Francisco police on Wednesday were looking for two men accused of targeting ATM customers in what officers described as a "shoulder surfing" scheme.
Investigators said the two are part of a coordinated group of thieves who peer over cardholder's shoulders as they enter their PIN.
That four digit number is then sent via text message to the group.
"One of those individuals will then get in line behind the victim and the use the PIN to get cash" said an undercover San Francisco Police Officer investigating the case.
Officers said ATMs operated by Bank of America have been targeted because of a flaw in the system when users don't completely log out
"Once they are finished, the ATM will say 'Do you want another transaction? Most people don't realize that. They just walk off," said the undercover officer.
With the question still on the screen, the thief answers "Yes" and enters the PIN that was sent via text message and withdraws cash.
Police said they recovered $11,000 from one man already arrested in the scheme.
Investigators aren't sure how many victims might be out there, but they encourage ATM users to immediately report any suspicious activity to their bank.
A Bank of America spokeswoman said they are aware of "shoulder surfing" and are working with law enforcement to address the problem.
"In addition to educating customers about the importance of keeping PINs as private as possible, we have increased security measures and continue to add pin shields to ATMs in the area where we suspect this is occurring," said spokeswoman Colleen Haggerty.
Watchdogs are questioning an exclusive agreement between the City of Oakland and a non-profit group, tapped to lead a multi-million dollar project to redevelop the area around the Coliseum BART station.