International law enforcement agencies say the recent $45 million dollar ATM heist is just one of many scams they are fighting in an unprecedented wave of sophisticated cyberattacks.
Old-school robberies by masked gunmen are being eclipsed by stealth multimillion-dollar cybercrime operations which are catching companies and investigators by surprise.
“We are seeing an unprecedented number of cyberscams that include phishing for financial data, viruses, credit card fraud and others,” said Marcin Skowronek, an investigator at Europol’s European Cybercrime Center in The Hague.
“In Europe, we are generally quite well protected against some types of fraud because of the chip and pin technology we use, but there are still shops and machines around the world who still take cards without chips. And the most popular destinations for this type of fraud are the United States and the Dominican Republic.”
U.S. investigators said Thursday a gang hit cash machines in 27 countries in two attacks — the first netting $5 million in December and then $40 million in February in a 10-hour spree that involved about 36,000 transactions.
Hackers got into bank databases, eliminated withdrawal limits on prepaid debit cards and created access codes. Others loaded that data onto any plastic card — even hotel key cards — with a magnetic stripe.
A similar scam yielded some 50 arrests this year in Europe during a joint police operation between Romanian police and Europol, Skowronek said.
The investigation of the operation took more than a year, involved some 400 police officers across Europe and required work comparing bank losses to illegal transactions and then cross-referencing suspects, said Skowronek, who said many national police forces were beefing up their undercover work in the cyberworld.
Investigators found illegal workshops for producing devices and software to manipulate point-of-sale terminals. Illegal electronic equipment, financial data, cloned cards and cash were seized in raids in Britain and Romania.
The group stole credit and debit card numbers and PIN codes by implanting card reading devices and malicious software on point-of-sale terminals. The criminals then used counterfeit payment cards with stolen data for further illegal transactions in countries that included Argentina, Colombia, the Dominican Republic, Japan, Mexico, South Korea, Sri Lanka, Thailand and the United States.
Some 36,000 debit card and credit card holders in some 16 countries were affected, Skowronek said. The amount stolen was unclear.
Bank fraud, ATM scams and phishing are common in Romania, one of the most corrupt countries in the European Union, according to Transparency International which monitors and measures graft.
Under the late communist dictator Nicolae Ceausescu, Romanians specialized in mathematics and computer coding and criminal gangs have tapped into those skills. The tradition has continued and Romanian school students are more advanced in mathematics than many of their European counterparts.
Mike Urban, director of financial crime solutions at Fiserv, a Brookfield-Wisconsin-based company that provides financial technology to banks, credit unions and corporations across the world, says banks have not caught up with the threat of electronic crime.
“Compare this to a physical bank security. If someone walks in today, they’re probably not going to get very much money, the dye pack is going to explode, they will be caught on video, they’re probably not going to get away with it, and they’re probably going to spend a long time in jail,” said Urban. “Online, in the cyberworld, we’re not there yet.”
About the Author
