Quantcast
Latest Stories

Hackers stole $45M in ATM card breach


In this undated photo provided by the United States Attorney’s Office for the Southern District of New York, Elvis Rafael Rodriguez, left, and Emir Yasser Yeje, pose with bundles of cash allegedly stolen using bogus magnetic swipe cards at cash machines throughout New York. Prosecutors in New York on Thursday, May 9, 2103 said that they are members of worldwide gang of criminals who stole $45 million in hours by hacking into a database of prepaid debit cards and draining cash machines around the globe. An indictment unsealed Thursday accused U.S. cell ringleader Alberto Yusi Lajud-Pena and seven other New York suspects of withdrawing $2.8 million in cash from hacked accounts in less than a day. AP Photos/U.S. Attorney’s Office for the Southern District of New York

NEW YORK—A worldwide gang of criminals stole $45 million in a matter of hours by hacking their way into a database of prepaid debit cards and then draining cash machines around the globe, federal prosecutors said Thursday — and outmoded U.S. card technology may be partly to blame.

Seven people are under arrest in the U.S. in connection with the case, which prosecutors said involved thousands of thefts from ATMs using bogus magnetic swipe cards carrying information from Middle Eastern banks. The fraudsters moved with astounding speed to loot financial institutions around the world, working in cells including one in New York, Brooklyn U.S. Attorney Loretta Lynch said.

She called it “a massive 21st-century bank heist” carried out by brazen thieves.

One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said. Others took photos of themselves with giant wads of bills as they made their way up and down Manhattan.

Here’s how it worked:

Hackers got into bank databases, eliminated withdrawal limits on pre-paid debit cards and created access codes. Others loaded that data onto any plastic card with a magnetic stripe — an old hotel key card or an expired credit card worked fine as long as it carried the account data and correct access codes.

A network of operatives then fanned out to rapidly withdraw money in multiple cities, authorities said. The cells would take a cut of the money, then launder it through expensive purchases or ship it wholesale to the global ringleaders. Lynch didn’t say where they were located.

It appears no individuals lost money. The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Lynch said.

She called it a “virtual criminal flash mob,” and a security analyst said it was the biggest ATM fraud case she had heard of.

There were two separate attacks, one in December that reaped $5 million worldwide and one in February that snared about $40 million in 10 hours with about 36,000 transactions. The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.

The plundered ATMs were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries, and law enforcement agencies from more than a dozen nations were involved in the investigation, U.S. prosecutors said.

The accused ringleader in the U.S. cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said. More investigations continue and other arrests have been made in other countries, but prosecutors did not have details.

An indictment unsealed Thursday accused Lajud-Pena and the other seven New York suspects of withdrawing $2.8 million in cash from hacked accounts in less than a day.

Such ATM fraud schemes are not uncommon, but the $45 million stolen in this one was at least double the amount involved in previously known cases, said Avivah Litan, an analyst who covers security issues for Gartner Inc.

Middle Eastern banks and payment processors are “a bit behind” on security and screening technologies that are supposed to prevent this kind of fraud, but it happens around the world, she said.

“It’s a really easy way to turn digits into cash,” Litan said.

Some of the fault lies with the ubiquitous magnetic strips on the back of the cards. The rest of the world has largely abandoned cards with magnetic strips in favor of ones with built-in chips that are nearly impossible to copy. But because U.S. banks and merchants have stuck to cards with magnetic strips, they are still accepted around the world.

Lynch would not say who masterminded the attacks globally, who the hackers are or where they were located, citing an ongoing investigation.

The New York suspects were U.S. citizens originally from the Dominican Republic, lived in the New York City suburb orf Yonkers and were mostly in their 20s. Lynch said they all knew one another and were recruited together, as were cells in other countries. They were charged with conspiracy and money laundering. If convicted, they face 10 years in prison.

Arrests began in March.

Lajud-Pena was found dead with a suitcase full of about $100,000 in cash, and the investigation into his death is continuing separately. Dominican officials said they arrested a man in the killing who said it was a botched robbery, and two other suspects were on the lam.

The first federal study of ATM fraud was 30 years ago, when the use of computers in the financial community was growing rapidly. At the time, the Bureau of Justice Statistics found nationwide ATM bank loss from fraud ranged from $70 and $100 million a year.

By 2008, that, had risen to about $1 billion a year, said Ken Pickering, who works in security intelligence at CORE Security, a white-hat hacking firm that offers security to businesses.

He said he expects news of the latest ring to inspire other criminals.

“Once you see a large attack like this, that they made off with $45 million, that’s going to wake up the cybercrime community,” he said.

“Ripping off cash, you don’t get that back,” he said. “There are suitcases full of cash floating around now, and that’s just gone.”


Follow Us

Follow us on Facebook Follow on Twitter Follow on Twitter


Recent Stories:

Complete stories on our Digital Edition newsstand for tablets, netbooks and mobile phones; 14-issue free trial. About to step out? Get breaking alerts on your mobile.phone. Text ON INQ BREAKING to 4467, for Globe, Smart and Sun subscribers in the Philippines.

Tags: ATM card , Bank Heist , banks , Business , Crime , hacker , hacking , Police




Copyright © 2014, .
To subscribe to the Philippine Daily Inquirer newspaper in the Philippines, call +63 2 896-6000 for Metro Manila and Metro Cebu or email your subscription request here.
Factual errors? Contact the Philippine Daily Inquirer's day desk. Believe this article violates journalistic ethics? Contact the Inquirer's Reader's Advocate. Or write The Readers' Advocate:
c/o Philippine Daily Inquirer Chino Roces Avenue corner Yague and Mascardo Streets, Makati City, Metro Manila, Philippines Or fax nos. +63 2 8974793 to 94
Advertisement
  1. Kim Henares needs a reprimand, says Cayetano
  2. ‘No real progress in PH if dynasties not dismantled’
  3. More legal woes for Cedric Lee
  4. Massive infra spending set
  5. OFW brings MERS virus to Philippines
  6. DOJ to NBI: Arrest Cedric Lee, 4 others
  7. Cardinal Tagle to faithful: Join politics to clean it
  8. Estrada, Gigi Reyes denied access to evidence from other respondents
  9. Lacson’s wife loses diamond earring to thieves but recovers jewelry quickly with police arrest
  10. DOJ orders arrest of Cedric Lee
  1. Kim Henares needs a reprimand, says Cayetano
  2. Suspect in Vhong Navarro mauling tries to leave PH
  3. Fr. Suarez says last Mass on Easter before returning donated land to San Miguel
  4. MH370 co-pilot made mid-flight phone call – report
  5. More legal woes for Cedric Lee
  6. I’ll follow my conscience on Estrada, says JV Ejercito
  7. ‘Wife of Jesus’ theory papyrus not fake – Harvard study
  8. Gay college instructor arrested for oral sex with student
  9. ‘No real progress in PH if dynasties not dismantled’
  10. Palace: We can’t blame increase in population on Vitangcol
  1. KL confirms Malaysian Airlines Flight MH370 ended in Indian Ocean
  2. MRT passengers pass the hat for 6-year-old Ashley
  3. Pork payoffs to newscasters Erwin Tulfo, Del Prado, others bared
  4. Rookie, lady cops lauded for quick response to MOA heist
  5. Model Helena Belmonte wished ‘to slash her wrist and hope to die’
  6. Malaysia averts another air tragedy; pilot lands troubled plane safely
  7. Revilla says he was joking; Lacson stands by his story
  8. Revilla ‘consulted’ Lacson on how he evaded arrest
  9. Police rule out foul play in Helena Belmonte’s death as boyfriend is ‘traumatized’
  10. Cudia, dismissed for lying, got 99% in conduct
Advertisement

News

  • Anti-gay demo in Ethiopia cancelled
  • Obama launches measures to support solar energy in US
  • Nebraska toddler gets stuck inside claw machine
  • Philippine eagle rescued by Army turned over to DENR
  • Gunmen attack Iraq military base, kill 10 soldiers
  • Sports

  • Vietnam says it will not host Asian Games
  • Nadal passes clay landmark with 300th victory
  • Wawrinka waltzes through with Monte Carlo walkover
  • Power Pinays smash India in Asian Women’s Club volleyball opener
  • PH youth boxers off to stumbling start in AIBA World tilt
  • Lifestyle

  • Ford Mustang turns 50 atop Empire State Building
  • Pro visual artists, lensmen to judge Pagcor’s photo contest
  • ‘Labahita a la bacalao’
  • This is not just a farm
  • Clams and garlic, softshell crab risotto–not your usual seafood fare for Holy Week
  • Entertainment

  • Cannes film festival launches race for 2014 Palme d’Or
  • Jones, Godard, Cronenberg in competition at Cannes
  • Will Arnett files for divorce from Amy Poehler
  • American rapper cuts own penis, jumps off building
  • Jay Z to bring Made in America music fest to LA
  • Business

  • Total says makes ‘very promising’ oil find off Ivory Coast
  • ‘Chinese Twitter’ firm Weibo to go public in US
  • World stocks subdued, Nikkei flat on profit taking
  • Asia stocks fail to match Wall Street gains
  • Fired Yahoo exec gets $58M for 15 months of work
  • Technology

  • Netizens seethe over Aquino’s ‘sacrifice’ message
  • Filipinos #PrayForSouthKorea
  • Taylor Swift tries video blogging, crashes into fan’s bridal shower
  • DOF: Tagaytay, QC best at handling funds
  • Smart phone apps and sites perfect for the Holy Week
  • Opinion

  • Editorial cartoon, April 17, 2014
  • A humbler Church
  • Deepest darkness
  • ‘Agnihotra’ for Earth’s health
  • It’s the Holy Week, time to think of others
  • Global Nation

  • Malaysia quarantines 64 villagers over MERS virus
  • DFA: 2 Filipinos survive Korean ferry disaster
  • PH asks airline passengers to check for MERS
  • Syria most dangerous country for journalists, PH 3rd—watchdog
  • Japan says visa-free entry still a plan
  • Marketplace
    Advertisement