A terrible user experience part 1

A true story.

The following took place in Madrid last week. The protagonist is a friend of mine and her story inspired the following cartoon.






A little summary in case you can't see the images or understand my cartoons!

1. Melissa goes to get some money out of a cash point in broad daylight on a busy street in the centre of town.
2. Two 10 year-old girls approach and one starts messing with the cash machine.
3. Melissa cancels the transaction, grabs her card and leaves.
4. Meanwhile the children continue to bang on the machine.
   
5. Melissa later discovers 300 euros were withdrawn from her account at the time of the incident.
6. She reports the whole thing to the police who not only know who the girls are, but have also heard the same story on numerous occasions(!!). They attribute the problem to a known fault with the cash machine and say they are powerless to do anything due to the children's age and on account of it not being a robbery per se!! Apparently banging on the screen or keypad in a certain way, - even after a transaction has been cancelled and the card removed, - can make the ATM spit out 300 euros. This money is then deducted from the last account to use the cash machine.
7. The bank is debating whether they will return her money or not, but will take a leisurely 1 to 2 months to decide!

Side note.
A lot of the banks in Spain have their cash machines in the entrance hall to the bank as opposed to facing out onto the street itself, (which is standard in the UK). When the bank is closed, you can only get in to get money out by swiping your bank card. Once inside, not only are you on camera, but you also lock the door behind you to stop someone else coming in.

I was always quite puzzled by the logic to this feeling somewhat claustrophobic while being locked in and quite vulnerable to attack when leaving the bank; thinking that people could be waiting just outside to relieve me of my cash.

So, maybe this a chicken and egg situation:
Have robbery techniques developed to take advantage of the vulnerability of the exposed cash points (as opposed to the "security" of enclosed ones)?
Or, have cash points traditionally been kept inside the bank to protect their customers from this type of attack?
And, most importantly, to what point does this affect the assignment of responsibility and accountability for secure, reliable and safe cash point operations?