Feds in NYC: Hackers Stole $45M in ATM Card Breach

A worldwide gang of criminals stole a total of $45 million in a matter of hours by hacking their way into a database of prepaid debit cards and then draining cash machines around the globe, federal prosecutors said Thursday — and outmoded U.S. card technology may be partly to blame.

Seven people are under arrest in the U.S. in connection with the case, which prosecutors said involved thousands of thefts from ATMs using bogus magnetic swipe cards carrying information from Middle Eastern banks. The fraudsters moved with astounding speed to loot financial institutions around the world, working in cells including one in New York, Brooklyn U.S. Attorney Loretta Lynch said.

She called it “a massive 21st-century bank heist” carried out by brazen thieves.

One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said. Others took photos of themselves with giant wads of bills as they made their way up and down Manhattan.

Here’s how it worked.

Hackers got into bank databases, eliminated withdrawal limits on prepaid debit cards and created access codes. Others loaded that data onto any plastic card with a magnetic stripe; an old hotel key card or an expired credit card worked fine as long as they carried the account data and correct access codes.

A network of operatives then fanned out to withdraw money rapidly in several cities, authorities said. The cells would take a cut of the money, then launder it through expensive purchases or ship it wholesale to the global ringleaders.

Lynch called it a “virtual criminal flash mob,” and a security analyst said it was the biggest ATM fraud case she had heard of.

The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said. The plundered ATMs were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries. The accused ringleader in the U.S. cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said.

Such ATM fraud schemes are not uncommon, but the $45 million stolen in this one was at least double the amount involved in previously known cases.

Lynch compared the ring to the $5.8 million in cash stolen from a Lufthansa Airlines vault at Kennedy Airport in 1978.

This article appeared in print on page 4 of the May 10th, 2013 edition of Hamodia.