Slashdot Log In
Crooks Nab Citibank ATM Codes, Steal Millions
Posted by
timothy
on Thu Jun 26, 2008 03:07 PM
from the ha-ha-you-can't-steal-it-if-I-lose-it-first dept.
from the ha-ha-you-can't-steal-it-if-I-lose-it-first dept.
An anonymous reader writes "Citibank is reissuing ATM cards following a December server breach in which hackers stole customer PIN codes, Wired reports. In recent months the FBI has arrested 10 people in the New York area who were allegedly involved in using the codes to steal over $2 million from Citibank checking and savings accounts, including two Ukrainian immigrants who were each caught with $800,000 in cash stashed in boxes and shopping bags in their homes. Some of the suspects are cooperating, telling the feds that they've been working for a Russian hacker. They use magstripe writers to encode the stolen account numbers onto blank cards, then hit ATMs in New York, and transfer 70% of the loot back to Russia."
Related Stories
Submission: Hackers Nab Citibank ATM Codes, Steal Millions by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Further development on the case (Score:5, Funny)
FP (Score:5, Funny)
Fixed. (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
WHOOOOOSH!
Re:Fixed. (Score:5, Funny)
Wait, wait! I need to attach a wind turbine to this thread.
OK, go.
Parent
initialisms (Score:5, Funny)
two Ukrainian immigrants who were each caught with $800,000 in cash stashed in boxes and shopping bags in their homes.
I assume the boxes and bags all had big dollar signs on the side of them.
Also, I'm extremely impressed that TFS (I didn't RTFA, of course) had no incidents of "ATM machine" or "PIN number".
Re:initialisms (Score:4, Funny)
Parent
Time to look into other means of security (Score:5, Interesting)
Maybe it's just me, but a simple 4 digit number doesn't provide all that much security in my mind. How easy is it to simply glance over someone's shoulders and read their pin? Aren't there any means of verifying user identity in a quick secure manner?
I know that some banks will send their users a text message with a confirmation code, but this seems a bit inconvenient (cell battery can die, text can take a long time to arrive, etc.). Anyone on
Re:Time to look into other means of security (Score:5, Insightful)
What difference is the PIN going to make when the way they were acquired in the first place was by breaking into a database?
This problem is already solved. It's called an RSA dongle. "Oh, but it's a pain!" So is having your checking account cleared out.
Parent
Re: (Score:3, Insightful)
Biometrics, of course. Fingerprint scanning, retinal scanning, voice recognition, or whatever. It's the only way to really verify. The problem is how expensive it would be to refit existing ATMs.
Re: (Score:3, Insightful)
Re:Time to look into other means of security (Score:5, Insightful)
I imagine it's a lot easier to type in a PIN stolen from a database than it is to, um, change your thumbprint or the pattern of the veins in your retina to one stolen from a database.
Perhaps I'm missing something.
Parent
Re: (Score:2)
You are. There are ways to deceive biometric scanners.
Re:Time to look into other means of security (Score:5, Insightful)
No - he's spot on. Of course biometric scanners can be deceived. His point is that it's much more difficult to trick a fingerprint scanner than it is to type in four numbers. There's no infallible way to secure the machines - But they could be made much more secure without a major inconvenience to the end user.
The big problem is the expense of implementation.
Parent
Re:Time to look into other means of security (Score:5, Insightful)
When there's $2+ million on the line you can bet the baddies will take the time to work out a solution.
Parent
Re:Time to look into other means of security (Score:5, Insightful)
Biometrics, of course. Fingerprint scanning, retinal scanning, voice recognition, or whatever. It's the only way to really verify. The problem is how expensive it would be to refit existing ATMs.
The trouble with biometrics is that it can't be changed. Additionally, the various ways have bad flaws:
As a general rule, I wouldn't use my fingerprint to protect anything that's worth more to a criminal than my finger is to me.
http://news.bbc.co.uk/2/hi/asia-pacific/4396831.stm [bbc.co.uk]
Parent
Re:Time to look into other means of security (Score:5, Interesting)
Parent
Depends on how you use biometrics (Score:5, Informative)
Disclaimer: I just joined the company that has dreamt up this stuff..
For the use of biometrics to be safe you need the following conditions:
1 - it must still be a combination of what you KNOW and what you have. The solution is to name the fingers, i.e. think of a word like "fox" and then give a character to each finger. Only you know which finger you have called "f", "o" and "x".
2 - biometrics are yours. They have no place in a central database where anyone can make a mess by replacing or erasing them, and what isn't stored cannot be abused. Thus: using biometrics to replace PIN code is fine by me, provided it stays local to the device. In other words, the prints are a device/token enabler, not the actual method of authentication and/or authorisation. Oh, and the relevant storage area should not be accessible other than by the token comparator engine - export MUST be made verifiably impossble.
3 - "detached" and fake fingerprints should be rejected. Solution: don't be a cheapskate when you build this stuff and use the best, RF based reader. Even if you make the fake prints conductive it's going to be VERY hard (we've tried).
Biometrics are good because you can't forget them. But they're yours, and yours only.
Parent
Re:Time to look into other means of security (Score:5, Funny)
Parent
Mine is more than 4 digits... maybe (Score:5, Interesting)
I have a Bank of America ATM card that has a six-digit PIN. The really interesting thing, though -- which I discovered by accident -- is that on Bank of America ATMs you can simply enter the first four digits and then as many random digits as you want and the code works.
In other words, say my PIN is 443672. I can enter 4436, 44367, or 4436987899979 and it will always work. This seems like a fairly serious security flaw, to me.
I know what you're thinking: "Sounds like you really only have a 4-digit PIN." But no! On other kinds of machines, say at the supermarket, I always have to enter in all 6 digits accurately. It's only Bank of America ATM machines where this is true.
In the past, I have thought about raising this issue with Bank of America, but I have no idea how to approach them such that I can speak to somebody clueful.
Parent
Re: (Score:3, Insightful)
Re:Time to look into other means of security (Score:5, Funny)
Maybe it's just me, but a simple 4 digit number doesn't provide all that much security in my mind. How easy is it to simply glance over someone's shoulders and read their pin?
I no longer use a debit card for that very reason - my bank account was cleaned out by a woman I took pity on. She'd been strung out on crack and had nothing left but the clothes on her back. She wanted to dry out and get into rehab. So I stupidly let her stay at my apartment for a week.
During that week she obviously watched over my sholder at the ATM, then stole a book of checks. And the keys to my car I'd only made one payment on.
The bank made good on the forged checks, but not the ATM. Their rationale was that if the person had the PIN the only way to get it was have it given to them!
I journaled about it her:
Ask Slashdot: Women [slashdot.org]
The Crackwhore and the Nerd [slashdot.org]
Party Like It's 1976 [slashdot.org]
Parent
Re:Time to look into other means of security (Score:4, Funny)
Parent
Re: (Score:3, Informative)
As someone who works for a company that makes banking software, I have to tell you - the entire banking industry isn't worried about security.
Sounds surprising right? That 4 digit little code is just like putting a lock on the front door - it stops casual passer-bys from just walking in and taking things.
What banks are actually worried about is accountability. Accountability is WAY more important than security. When you use your debit card to withdraw 20$, or pay for a meal at a fast food location, your
Tall on story, light on details (Score:2, Insightful)
It seems clear that insider fraud is responsible. PIN codes are not afaik transmitted anywhere, they are checked locally by the terminal, not sent to any server. The fact that Citibank are taking respobsibility for the fraud is unusual, if PIN codes are stolen they would normally try to blame the customer first. What probably happened is that an insider stole the PIN codes and account information being sent to new card users and provided these to accomplices who used them to create fake cards.
Re:Tall on story, light on details (Score:5, Insightful)
PINs are encrypted and sent across the network. These crooks managed to intercept the PINs at one of the servers that processed them.
If PINs were checked locally, then every ATM would need to be able to determine the correct PIN for every card inserted into it, which means that one of them could be turned into a PIN-producing machine.
Parent
Isn't PIN on the card? (Score:2)
As far as I know, I still have to take my ATM card into the bank to change the PIN on it. So something is still encoded on the card, whether it's the PIN itself or another factor used in addition to the PIN to authenticate me.
Assuming I still have to take my card in to change the PIN (I can't seem to find a place to do it online), this could serve as a 2nd line against a server hack. Hopefully.
Server was breached in December.... (Score:5, Insightful)
Re: (Score:3, Interesting)
The best comment I have to that is, "Think back to Fight Club."
The cost of the lawsuits versus the cost of the recall just isn't enough, so a few soccer moms can burn. I do have to say, though, I'm way more comfy with a bank saying, "Ehh, we'll lose the money in customer's accounts," provided the bank is the one that takes the loss.
If you're a Citibank customer (Score:5, Informative)
Parent
I was hoping... (Score:5, Funny)
...that with the U.S. Dollar in the shitter, the Russians would start picking on someone else.
Re: (Score:2)
Re: (Score:3, Funny)
My late uncle, a wealthy American senator, had a large bank account in the United States. I currently can not remove the funds due to a legal dispute but an outside source such as yourself may be able to help me. I will let you have the majority of his 23 million dollar bankroll if you simply transfer the funds into your Russian account until I can leave the country. All I need from you is $5000 transfered into my account for verification of your account and processing and legal fees...
Citibank (Score:3, Insightful)
Re: (Score:3, Insightful)
Ok, I'm Canadian so I could be very wrong, but it certainly seems that Citibank is regularly the target of hackers/phishers/scammers. I often get emails from Citibank asking me to update my account information (obviously, I don't have an account...) but other banks seem to be subject to similar attacks far less often. Were I American, methinks I'd be picking just about any bank other than Citibank...
It's just because they're huge, they get targeted more often. It's the same problem with Chase Bank.
But yes, using a smaller bank would help, even if it is possibly less convenient.
My favorite part... (Score:5, Insightful)
From the article: "...What's more, neither Citibank nor the third-party transaction processor involved in the breach has warned consumers to watch for fraudulent withdrawals, raising questions about the disclosure policies in the financial industry. Citibank spokesman Robert Julavits says the bank "has complied with all applicable notification requirements."
But according to the Payment Card Industry's own rules and the disclosure laws of NY, in the event of a breach the company must follow these rules:
* Notification: Most expedient time possible, without unreasonable delay
* Civil or criminal penalty for failure to promptly disclose
So in other words they were more than happy to keep this secret to themselves.
Another step (Score:2)
to no more online digital financial transactions.
Considering how they did this, there is no security ID method that is actually secure.
Glad to know our partners are secure... (Score:3, Interesting)
On the more serious side: They insist on using REAL customer data for testing, their test systems are not in sync with production, their test practices are VERY bad....
It comes as no surprise that they've had a break-in.
I'm a Citibank customer (Score:4, Interesting)
In the alert they claim that a third party ATM network was breached but they didn't say which company's ATMs where hit. I even called and tried to find out but they wouldn't/couldn't tell me. The customer support person just kept saying "Sir, Your card was breached" as if the problem was with my ATM card. Here in NY there are tons of independent ATMs around which charge anywhere from $1-$3 for withdrawal (Maybe they could use some of those fees for security). If I knew which one f'ed up I would spend my withdrawal fees elsewhere.
Citi also botched sending me a new card twice so now they've disabled my old card and have yet to send me a new one. I guess I don't have to worry about those pesky fees for a while.
The bigger question: Three Months!? (Score:3, Insightful)
From the article:
Three months had passed since Citibank notified the FBI that a hacker managed to steal customer-account numbers and PIN codes, in an attack on a server that processes transactions from Citi-branded ATMs at 7-Eleven convenience stores. In late February and early March, the FBI and the U.S. Secret Service arrested two Ukrainian immigrants and two alleged co-conspirators for allegedly using the stolen PINs to steal $2 million in cash from unsuspecting Citibank customers.
Okay that answers the question on how they got the PINs. They didn't need the physical cards, they just hacked and got the bank account numbers with PINs. I'm going to guess that they let this go on to catch the bad guys, but THREE MONTHS? And obviously they weren't telling customers there had been a breach and that they should change their pin number.
Maybe that's one solution...at least for those of us who know better. A way to be able to go in and change your pin number on a regular basis. But it doesn't matter if you have 4-digit pin or a 16-digit PIN if the bank is going to keep the Acct. number together with the PIN.
I believe lawyers felt a shift in the Force.
The Solution (Score:4, Insightful)
The EMV-card.
On this type of card, the magnetic strip is replaced by a microcontroller with various cryptographic features (aka smart card) that are supposed to secure transactions and make the card a PITA to clone.
http://en.wikipedia.org/wiki/EMV [wikipedia.org]
It is a quite recent innovation. It was only standardized oh ... 9 years ago, and its backers - VISA and Mastercard - are relatively unknown companies.
This is probably why many banks are wary about issuing EMV cards yet ... or that they are cheapskates. I'm not sure which.
My parents (presumably) got hit by these guys (Score:4, Informative)
Further, Citibank's fraud detection must be absolutely horrible. If this was the same security breach, Citi didn't know about it even in March. Further, one large random charge in a foreign country on a card that hasn't been used in 5 years should raise some warning flags. In stark contrast, about two weeks ago Wells Fargo discovered fraud on my card. Turns out someone had my number and was testing its validity with online purchases. The sad sad sad thing is that the transaction that they found odd was a $1 purchase of a weight lifting dietary supplement. I guess even Wells Fargo knows I'm a geek.
Re: (Score:2)
The best gift cards in the US are green and have pictures of dead presidents on them.
Re: (Score:3, Funny)
You keep the ones with the dead presidents. I'll keep the others. I'll only insist on having the same number, to be fair. Deal?
Re:Thats why... (Score:5, Insightful)
It's why I moved all my purchasing from debit to credit.
The dispute resolution for M/C is a lot easier:
"I didn't buy this."
"Okay, reversed."
vs. the bank:
"I didn't make that withdrawal."
"Well, we'll have to review the security tapes, check your whereabouts, and in 12-16 months, we'll credit your account."
Also, I get 1% cash back on the M/C. And no, I don't carry a balance.
Parent
Re:Thats why... (Score:5, Informative)
You're confusing two issues: An ATM Withdrawal and a Purchase.
Any Debit Card with a Visa or MC logo carries fraud protection. They both require that funds be put back into your account within 5 business days, and many banks do it same-day, mine included. This includes provisions for overdrafts that happened because of the fraudulent deduction.
In fact, on the Visa website, you'll see that the Debit Card page and the CC page both point to the same "Zero Liability" page.
Of course, as I said, you confused 2 issues: Purchases and PIN-Based ATM withdrawals.
If you take a cash advance from your CC at an ATM using your PIN, it won't be so simple as "okay, reversed." It's their policy that its your duty to keep your PIN secure and secret. And that applies equally to both Credit and Debit cards.
Don't get me wrong -- I do the same thing you do. Every online purchase, and many offline, I use my Credit Card and pay it off when the statement comes. But I do it for the added benefits: Points, extra warranty on everything I buy, etc.
And because I don't always check my bank balances every day. My bank has refunded fraudulent debit card purchases for me twice, and the money was back in my account within an hour or so, but I worry about the time that I don't check it for a couple days and the money isn't there when I need it. Sure, the bank will fix it promptly, but that doesn't help if I have a cart full of groceries.
Not to mention, the worst thing that could happen if your CC is fraudmeistered is that you can't charge anything until it's fixed. There's a lot more headache involved if your checking acct was just drained.
But I wouldn't worry about fraud response from banks. Visa and Mastercard are literally making BILLIONS off Americans using the debit cards in place of cash. They don't want to scare you off.
Parent
Re: (Score:3, Insightful)
Yes, that's how I read it, anyway. My understanding is that Visa doesn't make much money from PIN transactions, so they don't guarantee them. Goes back to the "Your PIN is your Responsibility" schtick.
Of course, I see more and more stores that actually give me an incentive to pay using a PIN-based transaction. The Jewel supermarkets around here give you 1% off your bill. I imagine that's because they're paying more than 1% to Visa when you sign. I can't imagine any other reason that they'd give you that muc
Re:Clever... (Score:5, Interesting)
Parent
Re: (Score:3, Informative)