Publications
Partners
New York – A worldwide gang of criminals stole $45m in a matter of hours by hacking their way into a database of prepaid debit cards and then draining cash machines around the globe, federal prosecutors said — and outmoded US card technology may be partly to blame.
Seven people were under arrest on Thursday in the US in connection with the case, which prosecutors said involved thousands of thefts from ATMs using bogus magnetic swipe cards carrying information from Middle Eastern banks.
The fraudsters moved with astounding speed to loot financial institutions around the world, working in cells including one in New York, Brooklyn US Attorney Loretta Lynch said.
She called it “a massive 21st-century bank heist” carried out by brazen thieves.
One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said.
Others took photos of themselves with giant wads of bills as they made their way up and down Manhattan.
Here's how they did it:
Phase 1: Card processor network intrusion. Using malware, hackers breached the worldwide processors for Rakbank in the United Arab Emirates and the Bank of Muscat in Oman.
Phase 2: The criminals override security protocols and hunt for the prepaid debit card systems and delete limits on the accounts. It takes months to penetrate the systems, prosecutors said.
Phase 3: Access codes are created. Data is loaded onto any plastic card with a magnetic stripe — an old hotel key card or an expired credit card would do as long as it carried the account data and correct access codes.
Phase 4: Cells around the globe fan out and begin to make repeated cash machine withdrawals. In New York City alone, 750 transactions were made in two hours and 25 minutes from 140 different ATMs totaling $400,000, prosecutors said.
Phase 5: Hackers maintain unauthorized access to the banks to monitor the cashout, keeping withdrawals rolling until the breach is discovered and the systems shut down.
Phase 6: Cash is laundered and organizers are paid.
It appears no individuals lost money.
The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Lynch said.
She called it a “virtual criminal flash mob,” and a security analyst said it was the biggest ATM fraud case she had heard of.
There were two separate attacks, one in December that reaped $5 million worldwide and one in February that snared about $40m in 10 hours with about 36 000 transactions.
The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.
The plundered ATMs were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries, and law enforcement agencies from more than a dozen nations were involved in the investigation, U.S. prosecutors said.
The accused ringleader in the U.S. cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said. More investigations continue and other arrests have been made in other countries, but prosecutors did not have details.
An indictment unsealed Thursday accused Lajud-Pena and the other seven New York suspects of withdrawing $2.8m in cash from hacked accounts in less than a day.
Such ATM fraud schemes are not uncommon, but the $45 million stolen in this one was at least double the amount involved in previously known cases, said Avivah Litan, an analyst who covers security issues for Gartner Inc.
Middle Eastern banks and payment processors are “a bit behind” on security and screening technologies that are supposed to prevent this kind of fraud, but it happens around the world, she said.
“It’s a really easy way to turn digits into cash,” Litan said.
Some of the fault lies with the ubiquitous magnetic strips on the back of the cards. The rest of the world has largely abandoned cards with magnetic strips in favour of ones with built-in chips that are nearly impossible to copy. But because U.S. banks and merchants have stuck to cards with magnetic strips, they are still accepted around the world.
Lynch would not say who masterminded the attacks globally, who the hackers are or where they were located, citing an ongoing investigation.
The New York suspects were US citizens originally from the Dominican Republic, lived in the New York City suburb orf Yonkers and were mostly in their 20s. Lynch said they all knew one another and were recruited together, as were cells in other countries.
They were charged with conspiracy and money laundering. If convicted, they face 10 years in prison.
Arrests began in March.
Lajud-Pena was found dead with a suitcase full of about $100 000 in cash, and the investigation into his death is continuing separately. Dominican officials said they arrested a man in the killing who said it was a botched robbery, and two other suspects were on the lam.
The first federal study of ATM fraud was 30 years ago, when the use of computers in the financial community was growing rapidly. At the time, the Bureau of Justice Statistics found nationwide ATM bank loss from fraud ranged from $70 and $100m a year.
By 2008, that had risen to about $1bn a year, said Ken Pickering, who works in security intelligence at CORE Security, a white-hat hacking firm that offers security to businesses.
He said he expects news of the latest ring to inspire other criminals.
“Once you see a large attack like this, that they made off with $45m, that’s going to wake up the cybercrime community,” he said.
“Ripping off cash, you don’t get that back,” he said. “There are suitcases full of cash floating around now, and that’s just gone.”
Seven people were under arrest on Thursday in the US in connection with the case, which prosecutors said involved thousands of thefts from ATMs using bogus magnetic swipe cards carrying information from Middle Eastern banks.
The fraudsters moved with astounding speed to loot financial institutions around the world, working in cells including one in New York, Brooklyn US Attorney Loretta Lynch said.
She called it “a massive 21st-century bank heist” carried out by brazen thieves.
One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said.
Others took photos of themselves with giant wads of bills as they made their way up and down Manhattan.
Here's how they did it:
Phase 1: Card processor network intrusion. Using malware, hackers breached the worldwide processors for Rakbank in the United Arab Emirates and the Bank of Muscat in Oman.
Phase 2: The criminals override security protocols and hunt for the prepaid debit card systems and delete limits on the accounts. It takes months to penetrate the systems, prosecutors said.
Phase 3: Access codes are created. Data is loaded onto any plastic card with a magnetic stripe — an old hotel key card or an expired credit card would do as long as it carried the account data and correct access codes.
Phase 4: Cells around the globe fan out and begin to make repeated cash machine withdrawals. In New York City alone, 750 transactions were made in two hours and 25 minutes from 140 different ATMs totaling $400,000, prosecutors said.
Phase 5: Hackers maintain unauthorized access to the banks to monitor the cashout, keeping withdrawals rolling until the breach is discovered and the systems shut down.
Phase 6: Cash is laundered and organizers are paid.
It appears no individuals lost money.
The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Lynch said.
She called it a “virtual criminal flash mob,” and a security analyst said it was the biggest ATM fraud case she had heard of.
There were two separate attacks, one in December that reaped $5 million worldwide and one in February that snared about $40m in 10 hours with about 36 000 transactions.
The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.
The plundered ATMs were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries, and law enforcement agencies from more than a dozen nations were involved in the investigation, U.S. prosecutors said.
The accused ringleader in the U.S. cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said. More investigations continue and other arrests have been made in other countries, but prosecutors did not have details.
An indictment unsealed Thursday accused Lajud-Pena and the other seven New York suspects of withdrawing $2.8m in cash from hacked accounts in less than a day.
Such ATM fraud schemes are not uncommon, but the $45 million stolen in this one was at least double the amount involved in previously known cases, said Avivah Litan, an analyst who covers security issues for Gartner Inc.
Middle Eastern banks and payment processors are “a bit behind” on security and screening technologies that are supposed to prevent this kind of fraud, but it happens around the world, she said.
“It’s a really easy way to turn digits into cash,” Litan said.
Some of the fault lies with the ubiquitous magnetic strips on the back of the cards. The rest of the world has largely abandoned cards with magnetic strips in favour of ones with built-in chips that are nearly impossible to copy. But because U.S. banks and merchants have stuck to cards with magnetic strips, they are still accepted around the world.
Lynch would not say who masterminded the attacks globally, who the hackers are or where they were located, citing an ongoing investigation.
The New York suspects were US citizens originally from the Dominican Republic, lived in the New York City suburb orf Yonkers and were mostly in their 20s. Lynch said they all knew one another and were recruited together, as were cells in other countries.
They were charged with conspiracy and money laundering. If convicted, they face 10 years in prison.
Arrests began in March.
Lajud-Pena was found dead with a suitcase full of about $100 000 in cash, and the investigation into his death is continuing separately. Dominican officials said they arrested a man in the killing who said it was a botched robbery, and two other suspects were on the lam.
The first federal study of ATM fraud was 30 years ago, when the use of computers in the financial community was growing rapidly. At the time, the Bureau of Justice Statistics found nationwide ATM bank loss from fraud ranged from $70 and $100m a year.
By 2008, that had risen to about $1bn a year, said Ken Pickering, who works in security intelligence at CORE Security, a white-hat hacking firm that offers security to businesses.
He said he expects news of the latest ring to inspire other criminals.
“Once you see a large attack like this, that they made off with $45m, that’s going to wake up the cybercrime community,” he said.
“Ripping off cash, you don’t get that back,” he said. “There are suitcases full of cash floating around now, and that’s just gone.”
