[telecom] In Hours, Thieves Took $45 Million in A.T.M. Scheme

I saw one story that claimed the thieves had, in fact, gotten into the banks' programming and reset it to circumvent the daily limits on withdrawals for the accounts, I don't know whether that's true or not.

- the various banks tend to set their own policies on how much money you can pull out of your account via ATM. (And some ATMs, especially "self standing" ones in stores, will have their own)

These limits will vary depending on, among other factors, how the bank "rates" you as a customer. You might be cut off after $250, or you might be able to go higher. I've done as much as $1,000 (didn't try any more).

YMMV, but the banks I've dealt with in the past don't have a "real time" method of checking bank balances: the ATM network, which is separate from the participating banks' internal systems, will sometimes dispense money based on the limits that are encoded into debit cards, with no other knowledge of the customer.

It gets worse: there is more than one ATM system, and they don't always talk to each other. They report withdrawals to the participating banks, but that process can lag the event by as much as a day.

My knowledge is, however, a few years old, so the bankers may have improved their security and record-keeping since I found these things out the hard way. I certainly hope so, but I've got 45,000,000 reasons to think not.

Note the Department of Justice press release includes a claim that the thieves got into the bank systems.

These defendants allegedly formed the New York-based cell of an international cybercrime organization that used sophisticated intrusion techniques to hack into the systems of global financial institutions, steal prepaid debit card data, and eliminate withdrawal limits.

....

The "Unlimited Operation" begins when the cybercrime organization hacks into the computer systems of a credit card processor, compromises prepaid debit card accounts, and essentially eliminates the withdrawal limits and account balances of those accounts. The elimination of withdrawal limits enables the participants to withdraw literally unlimited amounts of cash until the operation is shut down.

====

rest:

_____________________________________________________ Knowledge may be power, but communications is the key snipped-for-privacy@panix.com [to foil spammers, my address has been double rot-13 encoded]

...

What this article didn't say is that this theft was greatly aided by easily duplicated mag strip cards. Once the "sophisticated computer experts" had the compromised account numbers, it was really easy for the street thieves to create cards with this stolen account information on the mag stripe.

If we were all using smart cards, it would be much harder (impossible?) to create duplicate cards.

Maybe now the banks in the US will get serious about switching to smart cards.

-Gary

We'll never see chip based cards in widespread use in the United States. They'd have to replace the ENTIRE infrastructure that developed around mag-stripe. I once saw a cost estimate to do just that and it was billions of dollars.

And when it comes to security - the dollar wins.

Master Card, Visa, and American Express have published their transition schedule. In October 2015, most merchants will become liable for fraudulent transactions if they don't have an EMV (chip card) terminal. A few kinds of terminals, notably gas pumps, have until 2017.

R's, John

Interesting. With this background, I just phoned up Chase and Capital One, US credit card issuers, and learned from the first CS rep I encountered at each that (according to said rep) there are NO current plans to convert any of their card lines to chip-and-pin or to chip-and-signature -- both claimed that ALL merchants are -- and, for the foreseeable future, will remain -- obligated to continue to honor the old-style magstripe cards.

And the date for ATMs is October 2016 for (at least) Mastercard transactions, where liability shifts away more from Mastercard. Money talks. Once the banks are more on the hook, you'll bet they'll scramble. Planning ahead? Nah..

Chase offers chips in many of their travel affiliate cards, described here:

As far as I can tell Capital One doesn't offer chip+pin on any of their US cards.