World grapples with rise in cybercrime

2013-05-11 20:27
(Duncan Alfreds, News24)

(Duncan Alfreds, News24)

Multimedia   ·   User Galleries   ·   News in Pictures Send us your pictures  ·  Send us your stories

London - International law enforcement agencies say the recent $45m ATM heist is just one of many scams they're fighting in an unprecedented wave of sophisticated cyberattacks.

Old-school robberies by masked criminals are being eclipsed by stealth multimillion dollar cybercrime operations which are catching companies and investigators by surprise.

"We are seeing an unprecedented number of cyberscams that include phishing for financial data, viruses, credit card fraud and others," Marcin Skowronek, an investigator at Europol's European Cybercrime Center in The Hague said on Saturday.

"In Europe, we are generally quite well protected against some types of fraud because of the chip and pin technology we use, but there are still shops and machines around the world who still take cards without chips. And the most popular destinations for this type of fraud are the United States and the Dominican Republic."

US Investigators said Thursday a gang hit cash machines in 27 countries in two attacks - the first netting $5 million in December and then $40m in February in a 10-hour spree that involved about 36 000 transactions.

Hackers got into bank databases, eliminated withdrawal limits on prepaid debit cards and created access codes. Others loaded that data onto any plastic card - even a hotel keycard - with a magnetic stripe

Undercover work

A similar scam yielded some 50 arrests this year in Europe during a joint police operation between Romanian police and Europol, Skowronek said.

The operation took more than a year, involved some 400 police officers across Europe and required work comparing bank losses to illegal transactions and then cross-referencing suspects, said Skowronek, who said many national police forces were beefing up their undercover work in the cyberworld to catch criminals.

Investigators found illegal workshops for producing devices and software to manipulate point-of-sale terminals. Illegal electronic equipment, financial data, cloned cards and cash were seized in raids in Britain and Romania.

The group stole credit and debit card numbers and PIN codes by implanting card reading devices and malicious software on point-of-sale terminals.

The criminals then used counterfeit payment cards with stolen data for further illegal transactions in countries that included Argentina, Colombia, the Dominican Republic, Japan, Mexico, South Korea, Sri Lanka, Thailand and the United States.

Around 36 000 debit card and credit card holders in some 16 countries were affected, Skowronek said. The amount stolen was unclear.


Bank fraud, ATM scams and phishing are common in Romania, one of the most corrupt countries in the European Union, according to Transparency International which monitors and measures graft.

Under the late communist dictator Nicolae Ceausescu, who was ousted and executed in 1989, Romanians specialized in mathematics and computer coding and criminal gangs have tapped into those skills. The tradition has continued and Romanian school students are more advanced in mathematics than many of their European counterparts.

Nadine Spanu, a spokesperson for Romania's anti-crime prosecutors, said Saturday she had no statement to offer on the $45m heist or a possible Romania connection.

Skimming works when criminals place devices on ATMs that copy consumers' card details and leave them vulnerable to fraud. There have been similar cases in the United States and Britain.

60 seconds

The EU is the world's largest market for payment card transactions and it is estimated that organized crime groups derive more than $1.9bn a year from payment card fraud in the EU.

Mike Urban, director of financial crime solutions at Fiserv, a Brookfield-Wisconsin-based company that provides financial technology to banks, credit unions and corporations across the world, says banks have not caught up with the threat of electronic crime.

"Compare this to a physical bank security. If someone walks in today, they're probably not going to get very much money, the dye pack is going to explode, they will be caught on video, they're probably not going to get away with it, and they're probably going to spend a long time in jail," said Urban. "Online, in the cyberworld, we're not there yet."

One security loophole thieves have learned to exploit is the lack of real-time transactions in ATM-speak.

Known as the "Gone in 60 Seconds" scam, thieves deposit money and then make co-ordinated cash-advance withdrawals in various places - but all in less than 60 seconds so the machines essentially regard all of the withdrawals as one transaction.

In October, around 14 people were charged following an FBI-led investigation into the theft of more than $1m from Citibank using the 60-second scam.

Global attacks

The simultaneous transactions at casinos in California and Nevada tricked the system into thinking that they were one transaction.

Even on some joint accounts where both partners have cards for the same account, users can often bypass withdrawal limits if the transactions are done at the same time.

"This type of attack might be preventable if ATM networks were able to monitor transactions in real time for unusually large numbers of transactions involving individual cards or cards from the same issuing institution. Unfortunately, that type of infrastructure doesn't exist today, but perhaps it's time to consider creating and implementing it now, especially after this latest attack," said Tom Cross, director of security research at the Lancope, a company specialising in flow analysis for security and network performance based in Alpharetta, Georgia.

The police’s Pisit Paoin, chief of Thailand's Technology Crime Suppression Division, said in a telephone interview Saturday that Thai police have arrested more than 20 suspects involved in the $45m cyber heist including those from Bulgaria, Bangladesh and eastern Europe.

He said that in the latest arrest in early April, a group of Bangladeshi and Malaysian suspects were using about 50 cards to withdraw cash from machines in Bangkok for a month and took out about $336 000.

Read more on:    cybercrime

Join the conversation! encourages commentary submitted via MyNews24. Contributions of 200 words or more will be considered for publication.

We reserve editorial discretion to decide what will be published.
Read our comments policy for guidelines on contributions.
NEXT ON NEWS24X publishes all comments posted on articles provided that they adhere to our Comments Policy. Should you wish to report a comment for editorial review, please do so by clicking the 'Report Comment' button to the right of each comment.

Comment on this story
Comments have been closed for this article.

Inside News24

Traffic Alerts
There are new stories on the homepage. Click here to see them.


Create Profile

Creating your profile will enable you to submit photos and stories to get published on News24.

Please provide a username for your profile page:

This username must be unique, cannot be edited and will be used in the URL to your profile page across the entire network.


Location Settings

News24 allows you to edit the display of certain components based on a location. If you wish to personalise the page based on your preferences, please select a location for each component and click "Submit" in order for the changes to take affect.

Facebook Sign-In

Hi News addict,

Join the News24 Community to be involved in breaking the news.

Log in with Facebook to comment and personalise news, weather and listings.