The Alliance, Nebraska, woman grew irritated as she waited behind a driver making multiple withdrawals from an ATM.
She estimated that the man withdrew cash six separate times as she waited for 10 minutes that morning at the Alliance First National Bank.
What she didn't realize until later was that the man was likely the suspect in an ongoing ATM theft scheme — a type of fraud that the FBI says costs more than $1 billion a year.
Over four days in April 2016, Randall Hillman of Alliance stole $33,241 from that ATM. He tried to steal another $36,216 during the same period.
And that was only what authorities could prove.
Hillman told authorities that he had been making the withdrawals for two months from four Alliance banks, using scores of fraudulent debit cards. Authorities said they weren't able to verify the other withdrawals, according to his plea agreement with federal prosecutors.
Experts say it's a common story of a pervasive but often-hidden crime. They say it shows how important it is for consumers to be savvy about using ATMs and gas station pumps and to take care to shield their PIN from a possible hidden camera.
While banks spend considerable resources to catch scams and estimate that they stop almost $9 out of every $10 of attempted fraud, that still leaves plenty of potential losses.
In this case, Hillman told authorities that he was working for an acquaintance in California who had given him debit cards programmed with stolen numbers. He said he was paid $2,500 a month to make withdrawals from banks in Alliance, a city of about 8,500 people in the Panhandle. Then he was directed by his acquaintance to deposit the money into certain bank accounts.
"(Hillman) is at the bottom of the scheme," said Ron Cresswell, a research specialist with the Association of Certified Fraud Examiners. "He's taking all the risk and getting little reward."
Last month, Senior U.S. District Judge Richard G. Kopf sentenced Hillman to three years' probation, ordered him to pay $36,566 in restitution and $5,700 in fines and assessments and forfeit $40,100 in cash.
Authorities wouldn't say if the acquaintance or anyone else is being prosecuted. A spokesman for the U.S. Attorney's Office in Nebraska declined to comment on the case. But Hillman's attorney said investigators weren't able to make additional arrests.
David Tente, executive director of the ATM Industry Association, said most ATM theft rings are run by thieves who move from town to town. The actual withdrawals usually occur far from where the debit card number was stolen.
Hillman had lived in California for years and had returned to Alliance to help care for an ailing parent, he told authorities. Hillman and his wife were staying with family at the time of his arrest.
Cresswell said Hillman's associate probably got the debit card numbers by using skimming devices on ATMs and gas station pumps. The devices are placed on or in a card reader and copy the card's information as someone inserts a card.
For the most part, banks are out the money stolen, not the consumers whose cards are targeted, Cresswell said.
Andrew Detjens, director of financial crimes investigations at First National Bank of Omaha, noted that First National provided investigators with evidence to convict Hillman.
He said debit and credit card security has improved considerably since 2016, when these thefts occurred. Back then, most cards relied on magnetic strips, which were easier to decode, but now most ATMs and card-reading machines require cards with the more secure embedded chips.
"We are constantly evolving to protect our customers," he said. "Our monitoring takes place around the clock, particularly for activity like this. We are doing what we need to protect consumers. I want people to feel comfortable using ATMs."
Still, security experts say, crooks are evolving, too. They have developed skimmers that can pull data from cards with chips, which is why consumers need to be careful when using their cards.
Tente said it's rare for ATM fraudsters to be apprehended. In Hillman's case, his arrest resulted from him using a debit card number belonging to a Reno, Nevada, police detective who specialized in financial crimes. The detective became suspicious when his debit card was declined. He investigated and learned that it had been used that day and the day before at ATMs belonging to First National and Wells Fargo Banks about 1,000 miles away in Alliance. His department obtained security video from Wells Fargo and forwarded it to Alliance police.
Two days later, as Alliance police investigated, two more Reno residents called to say their debit card numbers had been used at ATMs in Alliance, Lt. Ken Hart wrote in a police report.
Based on security video images of the suspect's vehicle and license plate — a blue Lexus SUV with 65-county license plates — Alliance police tracked Hillman to the home where he was staying. (The license number for Box Butte County, where Alliance is located, is 65.)
About the time police were arresting Hillman, the woman who had spent 10 minutes waiting at the First National ATM saw a police social media post about the thefts and realized that she may have witnessed the perpetrator in action. The woman, who worked in auto sales, told police that she notices things like makes and models of cars, in this case a blue Lexus SUV with a 65-county license plate.
In the home where Hillman was staying, Alliance police found 62 debit cards, a device to program debit cards and three large envelopes with "stacks and stacks of money," according to the police report.
Hillman told police that the money came from fraudulent withdrawals and that he had used all 62 cards over the course of the scam. A few days later, he brought police two more credit card coding devices that he said he had bought on Amazon.
Hillman provided Alliance police with the name of his acquaintance and said he knew the man from his days in California, where he worked in the computer business for 29 years. He said he sometimes did business with the man.
Hillman's attorney, Justin Kalemkiarian of Berry Law Firm of Omaha, said his client tried to help authorities find the others involved.
"He did provide information, but they couldn't find the other people," he said. "Which is unfortunate because he was acting at the direction of others. He got himself into a situation he shouldn't have been involved in."
Tente said his industry would like to see judges mete out tougher penalties. Some states, such as Texas, are toughening up state penalties, but no such move is underway at the federal level, he said.
"ATM thefts are basically being treated as petty theft. You can steal a candy bar from a convenience store, and you'll get the same penalty as if you stole $100,000 from an ATM," he said. "Crooks know they can steal money from ATMs, and the penalties are not that severe."
The congressionally set penalty range in Hillman's case was zero to 25 years in prison, but federal sentencing guidelines suggested a 12- to 18-month sentence.
Hillman's probation resulted from several factors, according to court records: the now-70-year-old's cooperation with authorities; his lack of a criminal history; his need to care of his wife, who had health problems; and the need to generate income to pay restitution.
Kalemkiarian said the judge's penalty was appropriate.
"It was a serious sentence and a serious penalty," he said.
"(Hillman) accepted responsibility; he told the judge he was sorry," Kalemkiarian said. "He was ordered to pay restitution; He didn't just get off with a slap on the wrist."