In Hours, Thieves Took $45 Million in A.T.M. Scheme

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by outworlder on Thursday May 09, 2013 @10:14PM (#5684148)

> "With five account numbers in hand, the hackers distributed the information to individuals in 20 countries who then encoded the information on magnetic-stripe cards. On Dec. 21, the cashing crews made 4,500 A.T.M. transactions worldwide, stealing $5 million, according to the indictment."

If true, that's hilarious. Seriously, ATM reading magnetic stripes? What century are we, again? It seems I've traveled backwards in time. Either that, or it's a new Terminator movie plot.

I haven't seen a credit or debit card without a smartcard (which requires a PIN) in Brazil in more than a decade now. Not sure if it would have stopped this particular attack, as the magstripe readers are still there because of foreign credit cards. However, there are stricter restrictions on foreign money withdrawals which are enforced regardless of the originating bank.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by username111 on Thursday May 09, 2013 @10:19PM (#5684162)

US debit cards just require magnetic strip and pin to withdraw from ATMs.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by sschueller on Friday May 10, 2013 @01:10AM (#5684741)

That's the biggest problem.

If the US would switch to chip and pin then all those countries that already use chip and pin can turn off the magnetic strip by default. Right now they need to leave it on as the US is common travel destination.

Chip and pin isn't 100% secure either but it would stop a large number of skimmers.

If you don't travel and you live in a country with chip and pin have your bank disable your magnetic stripe. Even if someone were to skim your card the bank will not authorize a transaction via magnetic stripe.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by robk on Friday May 10, 2013 @05:33AM (#5685348)

Chip and pin pushes more burden onto the consumer. I am well protected now with mag stripe - why would I want to place more of a burden on myself to keep a PIN safe when the law currently protects me for unauthorized charges?

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by cdcarter on Friday May 10, 2013 @12:41AM (#5684679)

Indeed. As a US resident I have never had a chip and pin style card. Every merchant around fully accepts magstripe only, and PIN needed for cash withdrawals.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by alwaysdoit on Friday May 10, 2013 @02:46AM (#5684962)

I've tried pretty hard to get one. None of the banks I've found would provide me with one.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by wcfields on Friday May 10, 2013 @01:26PM (#5687495)

You have to get a specialized "foreign traveler" credit card. My coworker got one from BoA since we work for a Montreal based company and travel up a few times a year.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by oz on Thursday May 09, 2013 @11:21PM (#5684397)

Here in Jamaica, it's stripe and PIN for debit cards at ATMs and POSs, and stripe and signature for credit cards at POSs.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by thisrod on Friday May 10, 2013 @12:48AM (#5684706)

The card doesn't matter: if the bank can afford to mass produce it, the cost to duplicate it will be small change in a $45 million heist.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by untog on Friday May 10, 2013 @02:11AM (#5684869)

Not quite. Chip and PIN adds an additional layer of security (PIN verification upon payment, verified against a secure chip) that is much, much more difficult to duplicate because the internals aren't known. Magnetic stripes are open to everyone.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by raverbashing on Friday May 10, 2013 @04:44AM (#5685232)

Actually, the internals are known, it would be security through obscurity otherwise (cough GSM cough)

The mag stripe is as safe as giving everybody your CC number (with CVV code)

Which chip-and-pin two things happen:

- the chip won't work without the pin number being input

- only one transaction is authorized at a time

- the chip is not duplicable (the information needed to duplicate it can't be read from the card)

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by chiph on Friday May 10, 2013 @09:06AM (#5685930)

It's not just the cost of the new cards -- all the payment terminals would have to be upgraded as well. AFAIK, unless you're in a major international city (NYC, Washington DC, SF) the terminals in the stores & restaurants don't know what to do with a chip-only card.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by noldornoldor on Thursday May 09, 2013 @10:57PM (#5684296)

some older ATMs in pacific using only magnetic stripes (e.g. New Zealand). I am from europe and my bank calls me each time when i use ATM because they have to follow security rules - cash withdrawal in low-level security ATM in exotic location)

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by veb on Friday May 10, 2013 @12:23AM (#5684611)

What? I live in NZ and I've never heard of an ATM that gives you money without a pin.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by kijin on Friday May 10, 2013 @01:17AM (#5684758)

I think he means magnetic strip + PIN, not just the magnetic strip. Still weaker than chip + PIN.

[ Parent | on HN ]

Re:In Hours, Thieves Took $45 Million in A.T.M. Scheme by Mvandenbergh on Friday May 10, 2013 @05:25PM (#5688778)

That wouldn't have prevented this attack since it depended on compromising the payment processing company.

[ Parent | on HN ]