Bank Muscat hit by $39m ATM cash-out heist
Duplicated cards fingered
Agentless Backup is Not a Myth
Cybercrooks have pulled off a $39m ATM heist against a bank in Oman using pre-paid travel cards.
Bank Muscat put out a statement through the Muscat Securities Market admitting the loss:
12 Bank Muscat prepaid Travel Cards were compromised on February 20, 2013. The gross value of transactions on these cards, which were compromised outside of Oman, was RO 15 million. No customers have suffered any financial loss and no other credit or debit cards issued by Bank Muscat have been affected. The Bank is working with all stakeholders to further investigate and to establish any losses arising from these transactions. We will inform the market of any material developments.
Bank card experts told the The Times of Oman that fraudsters must have bought the travel cards and duplicated them several times before using them from multiple locations outside the country.
It's possible that the sultanate's biggest bank may have been hacked. The cards were used in 10 to 15 locations on a single day, the paper added.
Impairment charges likely to arise as a result of the theft (assuming funds are not recovered) represent 10.5 per cent of Bank Muscat’s estimated 2013 earnings, United Securities said in a note, Reuters reports.
Security blogger Brian Krebs noted that the heist, which involved re-loadable prepaid debit cards tied to accounts in the Arab bank, is similar to two December 2012 cash-out operations that collectively netted $11m. And before that, there was a $13m fraud against Fidelity National Information Services early in 2012 and a $9m sting against RBS Worldpay in December 2008 involving counterfeit payroll debit cards, Krebs added.
Hackers used compromised access to RBS Worldpay systems to increase the withdrawal limits on the counterfeit debit cards under their control as well as other trickery involving siphoning stolen funds into accounts linked to the dodgy cards.
"These events have been caused by intrusions into the processing systems used to process the prepaid cards, and the transaction limits are overridden on a group of cards, the hackers clone these cards and engage 'Smurfs' to make repetitive ATM withdrawals on these card accounts on a Friday night right after the ATMs have been loaded with cash for the weekend," explained Terrence P Maher, general counsel to the Network Branded Prepaid Card Association.
"Risk mitigation starts with strict adherence to the Payment Card Industry Data Security Standards, to prevent such intrusions. As a back-up, the banks need to have insurance coverage for cyber-intrusion, to protect them against large losses," he added. ®
Bootnote
Thanks to Reg reader Adam for highlighting the e-heist.
COMMENTS
What? No Velocity check?
Way back in the early 90's I was involved in a card system. One of the first things we did then was implement a check to stop multiple repeated transactions, and to check the card velocity.
Velocity is simple. Note where the card is first used as a lat/long (this assumes that all banks know where their card machines are), when the card is next used compute the distance, and the time it took to travel and hence compute the velocity. If the velocity is too great, block the card and get the customer to call in. To be honest, we did have another way of finding the location, but surely this is just so fundamental that the banks must have this.
20 years later, it seems Bank of Muscat have not learnt this lesson.
Re: What? No Velocity check?
For someone in the industry, I don't think you understand how the scam works.
The banks in question authorise the transactions before they are actually verified as having funds. There are plenty of terminals that are "offline" or just delay before actually collecting the payment. If you time it right, you can perform the same £10 hundreds of times across the globe and by the time actual authorisation is given by the originating bank, there's already a million pounds in cash gone from various places.
Ever bought anything on a plane? Same system.
They don't have live connections to ensure funds are available. Yes, it's incredibly stupid, but that's why the scam (and many others with similar tactics) works. By the way, this is pretty much all how the "pay-by-wave" systems work and rely on the card to remember that it has spent £15. Clone the card beforehand and you can have as many £15 as you like before the bank has to give a yes/no.
Why is another reason why pay-by-wave is an incredibly stupid, even if "convenient", idea.
not news any more
If 3 masked robbers with guns stole $xxx million euros/dollars/etc in a daylight heist from any bank in the world the news feeds would go crazy with useless facts about every heist in history and so-called journalists going on about other journalist's opinions about why it happened and how awful it all is. Organized crime doing it thru a stupidly overlooked crack in computer security procedures......no news.
Conspiracy angle, the bank needed to unload some cash quickly to a local prince and hired the bad boys to create a crime so no suspicion is raised when the money moves. No taxes due either.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
