'Virtual criminal flash mob' used bogus swipe cards loaded with data from hacked bank databases to commit thousands of thefts
A gang of criminals stole $45m in a matter of hours by hacking their way into a database of prepaid debit cards and then draining cash machines around the globe, US prosecutors have said.
Seven people were being held on Thursday in connection with the case, which prosecutors said involved thousands of thefts from machines using bogus magnetic swipe cards carrying information from Middle Eastern banks. The fraudsters moved quickly, working in cells to loot financial institutions around the world.
US attorney Loretta Lynch called it "a massive 21st-century bank heist".
One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said. Others took photographs of themselves with giant wads of notes as they made their way up and down Manhattan.
Here's how it worked:
Hackers got into bank databases, eliminated withdrawal limits on prepaid debit cards and created access codes. Others loaded that data on to any plastic card with a magnetic stripe – old hotel key card or expired credit card worked fine as long as they carried the account data and correct access codes.
A network of operatives then fanned out to rapidly withdraw money in multiple cities, authorities said. The cells would take a cut of the money, then launder it through expensive purchases or ship it wholesale to the global ringleaders.
It appears no individuals lost money. The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Lynch said.
She called it a "virtual criminal flash mob", and a security analyst said it was the biggest cash machine fraud case she had heard of.
There were two separate attacks, one in December that reaped $5m (£3.2m) worldwide and one in February that snared about $40m in 10 hours with about 36,000 transactions. The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.
The plundered machines were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries, and law enforcement agencies from more than a dozen countries were involved in the investigation.
The accused ringleader in the US cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said.
An indictment accused him and the other seven New York suspects of withdrawing $2.8m in cash from hacked accounts in less than a day.
Such cash machine fraud schemes are not uncommon.
Some of the fault lies with the ubiquitous magnetic strips on the back of the cards. Much of the world has abandoned them in favour of chip and pin cards. But because US banks and merchants have stuck to cards with magnetic strips, they are still accepted around the world.
Lynch would not say who masterminded the attacks globally, who the hackers are or where they were located, citing an ongoing investigation.
Lajud-Pena was found dead with a suitcase full of about $100,000 in cash. Dominican officials said they arrested a man in the killing who said it was a botched robbery.