Article

The Fraudulent Four: The world's worst payment frauds and security failures

The payments industry never stops looking for new techniques and safeguards to stop thieves and fraudsters. Even so, we constantly hear about their exploits worldwide.

September 5, 2014

David Divitt, product marketing manager, Alaric Systems Ltd.

Fraudsters are constantly developing new schemes to catch out consumers and businesses. Banks, technology firms and the whole payments industry never stop looking for new techniques and safeguards to stop them. Even then, it’s difficult to catch every thief; we’re constantly hearing of data loss and payment fraud worldwide. Here are four of the biggest frauds and security breaches ever:

1. Global ATM scam

Earlier this year the FBI took down a wide-ranging and borderless gang of fraudsters. Two defendants were arrested in Bulgaria, as well as others in Chicago, after they committed what the United States Attorney for the Northern District of Illinois said was a clever ATM fraud scam.

ATM, debit card and PIN numbers stolen in Europe were used to take money from the accounts of U.S. accountholders.

The fraudsters worked out when midnight would fall in the time zone of the issuing bank, and then made withdrawals just before and after in a bid to get around daily withdrawal limits placed on users’ accounts. They allegedly even coordinated the withdrawals so they were timed to take place before banks could identify the ATM and debit card numbers to invalidate them.

2. Data theft in South Korea — but no fraud?

South Korea is one of Asia’s technology hotspots, but it isn’t immune to data loss. Earlier this year, around 20 million people — 40 percent of the nation’s 50 million-strong population — were actually affected by a massive breach that saw credit and debit card data disappear.

More than 100 million cards are believed to have been involved, yet remarkably, it all seems to have been down to a single person. One contractor for the credit rating firm Korea Credit Bureau was identified as having taken the huge quantity of names, credit card details and social security numbers over a period of a year.

However, no passwords or CVC numbers were lost and somehow, the nation’s Financial Supervisory Service reported, all of the data was eventually returned.

Surprisingly, the authority even said there was no cause for worry over fraud transactions. Not that this appeased the two million people who cancelled their cards.

3. Russian fraudsters commit the US' biggest credit card hacking scam

Four Russians and one Ukrainian national were arrested over suspected involvement in this case, which is the biggest instance of online fraud in U.S. history.

The credit card hacking scam involved as many as 160 million separate cards and targeted organizations ranging from French grocer Carrefour to NASDAQ.

Thieves managed to steal credit card information that they then supplied to online carding forums. The financial losses were huge: Just three of the companies targeted collectively lost more than $300 million.

U.S. authorities struggled to get their hands on the culprits for a while, but eventually got wind that two of them were travelling to Europe. One of the fraudsters had founded an electronic gaming team that travelled globally for competitions and, through a variety of nicknames, helpfully posted regular social media updates that made it much easier to catch up with them in the Netherlands in 2012.

4. Illinois micro-charging scam

High-value crimes are often the riskiest. Perhaps that’s why scammers in Illinois chose to steal tiny amounts at a time.

In 2010 the U.S. Federal Trade Commission released details of how an unknown gang of fraudsters had made fraudulent charges from 20 cents to $10 from more a million bank accounts over a period of several years. Because they usually hit each card only once, the theft was rarely, if ever, picked up by fraud detection systems.

Money mules were recruited through an online scam campaign that was supposedly hiring a “financial manager” for a global financial services firm.

People who responded were asked to set up multiple bank accounts and around 100 limited liability companies. These made fraudulent charges and laundered the money to overseas bank accounts.

The fraudsters even used a legitimate business services firm to forward their phone calls abroad.

The scheme worked for nearly four years before the Federal Trade Commission shut it down — but at the time, no suspects could be identified.

This post appeared first on Industry News (http://news.alaric.com/).

graphic courtesy of nima badiey | flickr