Stealing From Banks One Cent at a Time

JRHelgeson writes "In a story strangely reminiscent of Superman 3, a 'hacker' allegedly stole over $50,000 from PayPal, Google Checkout as well as several unnamed online brokerage firms. When opening an online brokering account it is common practice for companies such as E-trade and Schwab to send a tiny payment — ranging from only a few cents to a couple of dollars — to verify that the user has access to the bank account listed. According to the story, the attacker wrote a script that opened thousands of accounts at dozens of these providers. He was arrested not for taking the money, but for using false names in order to get it."

Comment from said "hacker"

[Digital Vomit (891734)]

When reached for comment, the "hacker" had this to say:

"I don't want to go to jail because there are robbers and rapers and rapers who rape robbers. "

Re:Comment from said "hacker"

[s.bots (1099921)]

Looks like someone could be doin' time in a "Federal 'pound-me-in-the-ass' Prison"...

Hey Mike! Watch out for your cornhole buddy!

Re:Comment from said "hacker"

[The Clockwork Troll (655321)]

This is an interesting legal situation in that, technically, both the crime and its punishment could be called a "salami attack".

Re:Comment from said "hacker"

[0kComputer (872064)]

I have a client in there right now. He says the trick is to kick someone's ass the first day, or become someone's bitch.

Re:Comment from said "hacker"

[Ibiwan (763664)]

" And I, I walked over to the, to the bench there, and there is, Group W's where they put you if you may not be moral enough to join the army after committing your special crime, and there was all kinds of mean nasty ugly looking people on the bench there. Mother rapers. Father stabbers. Father rapers! Father rapers sitting right there on the bench next to me! And they was mean and nasty and ugly and horrible crime-type guys sitting on the bench next to me. And the meanest, ugliest, nastiest one, the meanest father raper of them all, was coming over to me and he was mean 'n' ugly 'n' nasty 'n' horrible and all kind of things and he sat down next to me and said, "Kid, whad'ya get?" I said, "I didn't get nothing, I had to pay $50 and pick up the garbage." He said, "What were you arrested for, kid?" And I said, "Littering." And they all moved away from me on the bench there, and the hairy eyeball and all kinds of mean nasty things, till I said, "And creating a nuisance." And they all came back, shook my hand, and we had a great time on the bench, talkin about crime, mother stabbing, father raping, all kinds of groovy things that we was talking about on the bench. "

Re:Comment from said "hacker"

[Chapter80 (926879)]

With every ATM deposit, one can key in a slight over-amount, when specifying the deposit. If you are depositing checks for $123.45, you could key in maybe $123.54 (transposing the last two digits).

Most always, the bank sees the foolishness in sending a letter (costing at least 42 cents) to correct a small error. So they apparently just write off the difference, and leave the ATM deposit as reported.

So I get richer, cents at a time.

Kids, don't try this at home.

This may just be the missing statement, right before "4. Profit"

Re:Comment from said "hacker"

[blair1q (305137)]

Contrary to your apocryphal belief, banks have entire departments that spend more than the collection is worth to make you balance your account if it is out of balance. This discourages bigger crimes, which would cost them more just on a statistical basis.

You may get away with the "few pennies" mistake once per institution. Three or four times? They'll freeze your funds and demand you clean up your act.

Because here's a secret you should have known: When you give the bank the money, it's not yours any more. It's theirs. You lent it to them, and they owe it to you, but you can't just take it. You are nothing more than a lender, and they are a borrower. You have all the rights of a creditor. Which, you might guess, means you can spend thousands of dollars on legal hassles trying to free up the $123.45 you deposited to steal that 9 cents.

Re:Comment from said "hacker"

[rugatero (1292060)]

What makes him a "hacker"?

He used a computer.

Heck he even wrote a script. In the eyes of your average Joe that makes him a diabolical hacking genius.

"Hacker" not "Cracker"!

[ivan256 (17499)]

In this case, he's a hacker using the Slashdot/ESR definition, instead of the typical everyday definition. People around here should be excited.

PC load letter?!

[jchillerup (1140775)]

What the fuck does that mean?!

I just wanted to add the damn quote already

[ReverendLoki (663861)]

Peter: "That virus you're always talking about, right? The one that could, uh, rip off the company for a bunch of money."
Michael: "Yeah, what about it?"
Peter: "Well, how does it work?"
Michael: "It's pretty brilliant. What it does is, every time there's a bank transaction where interest is competed, you know, thousands a day, the computer ends up with these fractions of acent, which it usually rounds off. What this does is, it takes those little remainders and puts it into an account."
Peter: "This sounds familiar."
Michael: "Yeah, they did it in Superman III."
Peter: "Right."
Michael: "Yeah. Underrated movie, actually. And then there were a bunch of hackers, did it in the '70s as well. One of them got busted."
Peter: "Well, so they check for this now."
Michael: "No, here's the thing. Initech's so backed up with all the software we're updating for the year 2000, they'd never notice."
Peter: "You're right. And even if they wanted to, they couldn't check all that code."
Michael: "Thumbs up their asses. Thumbs up their asses."

Re:I just wanted to add the damn quote already

[Joe the Lesser (533425)]

Peter Gibbons: I can't believe what a bunch of nerds we are. We're looking up "money laundering" in a dictionary.

Re:PC load letter?!

[jchillerup (1140775)]

Whew. Sounds like someone has a case of the Mondays.

Superman 3?

[jandrese (485)]

How is this like Superman 3? I thought the point in that movie was to shave off the remainders in interest calculations. This is just a simple case of seeing someone transfer a few cents to your account when you open it and trying to abuse the system. The problem of course is that it's extremely obvious and you'll get caught, just like this guy did.

Re:Superman 3?

[qoncept (599709)]

Are you serious? Do you think it would be dumb to compare a Dell laptop to an IBM because IBM uses Hitachi drives and a 32x CDROM instead of Seagate and 36x?

Since you can't figure it out, let me explain what aspects are similar. He was stealing next to nothing lots of times. Like the guy in Superman.

Re:Superman 3?

[Sneftel (15416)]

But IBM doesn't use 32x drives. And therefore I am utterly baffled by the meaning of your comment.

Re:Superman 3?

[owlnation (858981)]

Yes, but I'm sure someone can still claim PRYOR art.

Re:Superman 3?

[lesinator (459276)]

This kind of attack hardly an invention of the movies. The salami attack [wikipedia.org] has been around for a long time.

Re:Superman 3?

[Otter (3800)]

I believe that the reference to Superman 3 is actually a meta-reference to Office Space. (Or maybe the reference being referenced is the meta-reference -- I'm not a philosopher.) As Office Space itself noted, the method long precedes either movie.

Re:Superman 3?

[Blakey Rat (99501)]

The point isn't that Superman 3 invented it, the point is that most people first heard of it from watching Superman 3 and so when you're trying to explain to people what you're doing, you can say "you know, like Superman 3" and they know what you mean. Thus the joke in Office Space:

A:
B: "Huh?"
A: "You know, like in Superman 3."
B: "Oooh, now I get it."

It's funny, damnit. Made funnier than Superman 3 is actually a pretty awful movie. (But it's an awful movie that most everybody's seen.)

Well whaddaya know...

[LynnwoodRooster (966895)]

This kind of attack hardly an invention of the movies. The salami attack has been around for a long time.

Huh. Learned something new - thanks! I always thought Salami Attack was a bad 80s porn movie...

Re:Well whaddaya know...

[Anne_Nonymous (313852)]

>> Salami Attack was a bad 80s porn movie...

Yes, but it was better than Superman 3.

Re:Superman 3?

[Dachannien (617929)]

It's been happening in meatspace for thousands of years (though not so much anymore). People would shave bits off of coins made of precious metals and then smelt and sell the shavings to wind up with more money than they started with. Wikipedia notes that some British silver coins would routinely be milled down to half their original weight as nearly everyone took a little bit off the edge.

Eventually, coins could be made with milled edges, which largely curbed the practice, and today, of course, most coins are made from metals that are worth very little compared to the value of the coin itself.

Re:Superman 3?

[compro01 (777531)]

Actually, IIRC, pennies and nickels are currently worth more as metal than as coins. A penny is something like 1.2 cents and a nickel is about 6 cents, at least that was the case in Sept. 2006, which is the most recent mint report I can get at the us mint site.

Re:Superman 3?

[rrkap (634128)]

Actually, it's not just the penny anymore due to high commodities prices.

Coin                Melt Value
Penny (current)     $0.005
Penny (pre 1982)    $0.024
Nickel (current)    $0.059
Dime                $0.021
Quarter             $0.053
Golden dollar coin  $0.065

So, the mint is only loosing money on nickels right now, and the pre-1982 pennies are worth melting down.

Well, yeah...

[Oxy the moron (770724)]

He was arrested not for taking the money, but for using false names in order to get it.

Of course he wasn't arrested for taking the money. Said institutions willingly deposited that money into his account(s), yes? And these institutions did so under the pretense that this was to identify the customer? So the charge makes sense. The guy didn't steal money, it was given to him... a "him" with a fake identity.

First clue

[tsstahl (812393)]

If you have to make up a name or SSN to open the account, then in fact, you are doing something wrong. Color me simple, but that's the way I see it. :\ This is clearly a case where a novel approach to crime is still, well, criminal.

Well Duh

[oahazmatt (868057)]

Largent used an automated script to open 58,000 such accounts, collecting many thousands of these small payments into a few personal bank accounts.

As much as the bank looks oddly at a sudden amount of large withdrawls, they'd certainly take the time to wonder why someone is getting three cents continuously deposited into their account. How did he figure he would not get caught?

When his bank contacted him about the thousands of small payments, Largent explained that he had read the terms of service of the sites he was targeting, and believed he was doing nothing wrong, claiming that he needed the money to pay off debts.

Oh, well that's okay, then.

Man, they'll throw the "Hacker" label on anyone these days, won't they?

Well it is true....

[cortesoft (1150075)]

Damn it feels good to be a gangsta.

Balasts

[bsDaemon (87307)]

At least his script didn't almost capsize the oil tankers... people would be super pissed off then.

Whatever you do....

[i_want_you_to_throw_ (559379)]

Don't drop the kryptonite in the shower.

It was over...

[hyperz69 (1226464)]

when he started using names like...

Haywood Jablome
Connie Lingus
Dick Trickle
Seymour Butts
Hugh Jass
Ben Dover

Should of used a better name generator.

oh wait....

[apodyopsis (1048476)]

At least he did not create a script that automatically rounded every payment up to the nearest... oh wait...

Even if he gets a fine, he can always apply to pay off the debt in small payments - say a few cents every time...

Reminds me of a debt my father picked up from a school my sister attended for less then a week. They charged him for a whole year. Not to be deterred he promptly paid them half the amount they invoiced him for. Months later and six angry letters later he paid them half of the sum they asked for. Months later.. ah well, I am sure you can see the pattern here. Fast forward 14 years and they finally wrote of the rest of his debt (I think 1GPB) as a good will gesture (and I am reliably informed he is legend in the schools finance department). I have no idea how much the administration cost to school at the end of it, but it all seemed good natured enough.

Re:oh wait....

[ZERO1ZERO (948669)]

Actually, i'm an idiot.

$50,000?

[PawNtheSandman (1238854)]

You know what I'd do with $50,000? 2 chicks at the same time.

Re:$50,000?

[gmuslera (3436)]

In a few months, filling the gas tank would be another use for that amount of money. Is good that so many online services are willing to cooperate in that hard task.

Re:$50,000?

[Andreaskem (999089)]

Why blow that much money on 2 minutes of entertainment?

How many bank accounts did he have?

[gozu (541069)]

I don't understand how he managed to do this. He can't use 50,000 bank accounts. There aren't 50,000 payment services. So why would any of them send a few cents to the same bank account more than once?

Can anyone explain this to me? It makes no sense at all.

Re:How many bank accounts did he have?

[saddino (183491)]

It makes no sense at all.

It sounds like it made a lot of cents.

Deny after 1 transfer causes problems

[patio11 (857072)]

Look at this from Paypal's perspective: you've got millions of people trying to sign up on your system. Statistically speaking, hundreds of thousands of them are not so bright, and will do things like forget they already tried signing up, not see their bank statement and try doing it again, etc. Since the cost of re-authenticating them is less than a buck (mostly for the ACH transfer fees) and the expected lifetime value of the account is still (for Paypal = eBay) anywhere from $10 to several hundred to depending on where you got the lead, obviously you want to let them try it again.

So we've disposed with the rationale for prohibiting 2 verifications. Now we need to draw a line somewhere. Here's what goes through this engineer's brain: it isn't obvious to me that putting the line at 3 is any better than putting it at 2. The possibility of exploit is remote, the damage from exploit is minimal and containable, engineer time is expensive, there might be some legal/regulatory/compliance issues that prohibit me from solving this problem in a minute by arbitrarily setting MAX_VERIFICATION_TRANSFERS to 20, and any restriction multiplied by millions of customers causes support problems and the attendant costs.

So yeah, I think that not doing the seemingly obvious thing is defensible here. The goal of Paypal/the bnaks/etc isn't to be fraud free, it is to maximize profits. Sometimes, the profit maximizing path means tolerating security risks with minor impact and non-trivial costs to address. Did it work for Paypal in this instance? Well, yeah -- they had about a decade of no problems and then when a problem finally did crop up it cost them less than a man-month to resolve. Easy peasy.

I wonder

[elrous0 (869638)]

How many hours of community service do you get for 58,000 counts of petty theft?

How about: Banks - Stealing from clients....

[MagicBox (576175)]

...one cent at t time.


Steal a penny from the Banks - go to jail - Banks steals $10 from you - calls it a "service charge".

We need the banks (except the World Bank), but it is despicable that they are allowed to play with our money the way they do. Twice I have been locked out of my money. And it was a weekend, so the banks were closed. I asked the 24/7 help guy from India what I should do, and his advice was: Can you borrow some money from someone until Monday when the bank opens?

Re:How did he do it?

[Mark J Tilford (186)]

By closing the accounts before Paypal / Google Checkout could remove the money.

Re:How did he do it?

[CheeseTroll (696413)]

in the US, NOBODY cant take the money out of your bank account without your authorization

(Assuming you aren't being sly with the double-negative...)

Then you have some learnin' to do about how ACH transactions work. Authorization for withdrawals is required, but it is certainly not passed along with the transaction itself. The system relies heavily on trust. If someone challenges a transaction, and their bank demands proof of authorization, then yes, you'd better have it. But if the transaction is not challenged or rejected, then it stands.

Re:Submitter gets it wrong

[Wister285 (185087)]

The third and fourth paragraphs read:

"According to court documents, Californian Michael Largent used an automated script to open 58,000 such accounts, collecting many thousands of these small payments into a few personal bank accounts.

Largent also performed the same trick with Google's Checkout service, cashing more than $8,000 alone from the service. " [emphasis added]

Am I (and the submitter) missing something?

Re:Submitter gets it wrong

[MaXMC (138127)]

You read the article? WTF?

Re:He stole my idea!

[norminator (784674)]

But he only stole it a little bit, a whole bunch of times...

Re:He stole my idea!

[sootman (158191)]

Favorite line from Night Court:
Defense attorney: "You had a gun?"
Crook: (sheepishly) "Just a little one."
District attorney: "The term is sawed-off."

Re:Let's

[tha_mink (518151)]

Sign up for a gazillion Paypal accounts, use ONE bank account, and after Paypal deposits the money, withdraw the money and close the account.

Tried it. Paypal doesn't allow multiple accounts with the same bank account information.

Re:I've always wondered

[somersault (912633)]

IANOC

I am not on crack?