Largest Coordinated ATM Rip-off Ever Nets $9+ Million in 30 Minutes

http://www.networkworld.com/community/node/38366?ts0hb&story=ts_heary

by tortilla • 17 years ago

40 38 17 years ago

networkworld.com

mark_h2• 17 years ago

Wow.. that sounds seriously impressive.

Single-page print version: http://www.networkworld.com/community/print/38366

bprater• 17 years ago

The big question I have is this: how did they insure that cashers returned the money to the core group?

If you walked out with a fistful of cash, what would motivate you to give most (some?) of it back? The promise of more money in the future?

Hexstream• 17 years ago

The promise of not getting shot in retaliation in the future?

tsetse-fly10• 17 years ago

The article does not state that there was any sort of profit sharing involved.

People involved in online fraud rarely collaborate with each other. You never know who's on the other end and your anonymity is your biggest strength. It's more of a marketplace where you buy cards, skimmers, or accounts from vendors and then go out and use them on your own.

Some guy probably sold these cards (or just the data to encode them) at a hefty price with the disclaimer that they had to be used on a certain date and time at any ATM.

cellis• 17 years ago

I don't think he sold them with a time limit. For a simple reason: the cards had to be refreshed after they had hit their withdrawal limit. This, coupled with the fact that they all happened at the same time, strongly points to realtime complicity on both sides of the transaction, anonymous or not. What compels this guy to refresh these cards? I mean from a game theory point of view it doesn't benefit him at all...assuming both parties are indeed anon.

palish• 17 years ago

The masterminds knew exactly how much each casher would be withdrawing. They might've also friends with the cashers. Also, if you were a casher, wouldn't you want the opportunity to participate in the next big scheme? But you wouldn't get that chance if you betrayed them.

sounddust3• 17 years ago

There is an audio interview with one of these "cashiers" who explains it all (you have to fast forward a bit): http://smallworldpodcast.com/mp3/smallworld051906.mp3

It's fascinating. Basically, the cashiers are working on the honor system. They get to keep a percentage (this guy gets 40%), and they send the rest to the "boss" through e-gold. The percentage you get increases as you earn their trust. I guess that this keeps most people honest, as they want to get a higher percentage the next time.

tsetse-fly10• 17 years ago

That interview is from May 2006.[1] We don't know if it's one of the cashiers and we don't know how this specific scheme played out.

Yes, you can often hire a cashier. Typically, this guy has some plastic and an encoder, but he doesn't have a steady supply of data to encode the cards. He's working with you because you have data to cards with a high limit and you can verify that they're valid. Most of the time, he's not even on the street. He'll encode them in the car and have someone else run up to the ATMs.

[1] http://web.archive.org/web/20061115154615/http://smallworldp...

sam_in_nyc6• 17 years ago

It's a "casher"

sam_in_nyc6• 17 years ago

You guessed it... the promise of more money in the future. You could walk away with just one fistful of cash, or you could return it to me, and I'd give you another re-upped card. You win, I win.

Think about the math, as well. They took $9m from ATMs.. how many people could they possibly have been using? Even with 1,000 "cashers" (highly unlikely), thats $9,000 each... far more than just 1 run to the ATM.

What they most likely did, or at least what I would do, is get a map of ATMs, find the points which yield the least weighted distance to the most ATMs (an NP problem, but very much worth it in this case), and set-up a "re-up" station there. Instruct your cashers to return their used card to these stations, along with the bundle of cash (or maybe x% of it), and you'll give them another card. Good worker ants.

However, something seems off here. $9m from 130 ATMs, that's $70,000 per ATM. With a max of at most $1,000 per transaction, thats 70 hits per ATM. In 30 minutes. So you mean to tell me each of 130 ATMs was hit for $1000 every 30 seconds?

Something is off about that. I think they're underreporting the number of ATMs or inflating the amount stolen.

tsetse-fly10• 17 years ago

No, it couldn't have been the promise of more money. This scheme was a first, it'd be impossible to know the outcome of the next card. There were 49+ cities involved, you'd need a call center to coordinate that. This organization, which would cross multiple countries, timezones, and languages, would be much more elaborate than the mafia. It's very unlikely.

Also, cashing out ATMs is very hard work. You need to use a skimmer to capture someone else's card then copy it to your blank plastic. It won't work if there's an electronic chip in it, like many countries (mostly in Europe) already have. Then you have to work within the usual transaction/account limits. You'd be lucky to get $2,000 off of one card. Basically, the next card seems like nothing when you have a fist worth $70,000.

I think the key to all of this is in the payroll card. It might not be bound to the traditional credit/debit card limits. Perhaps it's throttled at a central point and the guy who already has access to the RBS WorldPay systems was able to lift it.

psadauskas3• 17 years ago

He (or his close cohorts) probably did the same thing. You would just be an additional distraction, to make it harder to narrow down the main culprit.

alexandros• 17 years ago

It seems lax transactional guarantees bit banks in the rear. I am not sure how difficult it would be to avoid parallel use of cards at different ATMs (especially given the inter-bank nature of ATMs), but it was not done, and this weakness was taken advantage of.

chris• 17 years ago

I agree. Simply disabling an account that was used at more than one ATM within a certain timeframe, based on geographic area, would have limited the damage. Similar to how cell phone cloning is detectable.

tlb• 17 years ago

The latency to query a central database should be under 100 mS from anywhere in the country. There's no reason it couldn't be done properly today. But ATM systems were architected in the late 70s and they depend on a network of regional data centers that reconcile nightly.

tsetse-fly10• 17 years ago

I was a bit skeptical about how anyone could easily carry away that amount of cash from an ATM, but it's not so unbelievable:

    $9,000,000 / 130 ATMS = $69,230.8 or roughly 692 $100 bills.

    The US government requirement for currency paper is: "the thickness of the paper shall be 124 micrometers [...]."[1]

    124 micrometers * 692 bills = 0.085808 meters or 3.38 inches thick. Not bad at all.

[1] https://www.fbo.gov/utils/view?id=ccca3ea58d649385700a9f20c9...

xenophanes• 17 years ago

ATMs have $100 bills? Only certain ones?

bobbyi• 17 years ago

ATMs in Vegas give $100 bills.

sounddust3• 17 years ago

ATMs in the USA almost never give out $100 bills (it's never personally happened to me in my life). The highest I've seen is $20.

tsetse-fly10• 17 years ago

What's the largest amount you've withdrawn? It seems like if you withdrew your daily limit (~$500+?), you'd get something larger than a $20.

utnick• 17 years ago

casino atms give out 100s

sam_in_nyc6• 17 years ago

My question is, even with a max of $1000 per transaction, each ATM had to be hit more than twice per minute, for 30 minutes straight.

They must have choses extremely busy ATMs, or whoever got the scoop on this story got something wrong.

tsetse-fly10• 17 years ago

We don't know what the limit was or even if there was one. I'm sure that's why payroll cards were picked for this particular scheme. I think people are too caught in thinking about how their cards work. The same rules that apply to credit/debit may not apply here.

mark_h2• 17 years ago

Given their tight time-window they probably couldn't hang around until the ATM was free. I wonder how many people got to stand in line behind someone who was repeatedly withdrawing large amounts of cash?

(I suppose it was probably done at night when things were quiet; makes you think what you would have done though!)

Largest Coordinated ATM Rip-off Ever Nets $9+ Million in 30 Minutes

Related Stories