They probably copied the magstripe, but couldn't do a straight at withdraw without stripe+pin.

Far easier to track/reverse a debit transaction done as a credit card network than debit requiring PIN.