Breathtaking ATM hack nets $45M in hours

The US District Attorney for the Eastern District of New York has indicted eight residents of Yonkers for allegedly participating in a global ATM heist that involved removing the withdrawal limits on prepaid debit cards, cloning them, and then getting confederates all over the world to hit ATMs at the same time and clean them out. The DA says that the scam netted $45M worldwide; $400K in NYC alone. One of the indicted defendants was murdered in the Dominican Republic last month.

The first heist, which occurred on December 22 and targeted debit cards issued by the UAE bank, dispatched carders in about 20 countries that rapidly withdrew funds in more than 4,500 ATM transactions. In New York City alone, prosecutors said, the defendants and their co-conspirators withdrew almost $400,000 in some 750 fraudulent transactions from more than 140 different ATM locations. It took just two hours and 25 minutes for the New York cell to complete, prosecutors said. A second operation commenced on February 19 withdrew about $40 million in 36,000 transactions worldwide. In just 10 hours, the New York group allegedly withdrew about $2.4 million in almost 3,000 ATM transactions.

The operation exploited weaknesses in the way banks and payment processors handle prepaid debit cards, which usually are loaded with a finite amount of funds. These cards are often used by employers in place of paychecks and by charitable organizations to distribute disaster assistance. Once the accounts were hacked and the limits removed from accounts, cards were cloned and sent to cell groups throughout the world to make fraudulent withdrawals. Additional details of the operation are available in a press release outlining the charges.

A similar heist in 2011 got $13M in one night.

How hackers allegedly stole “unlimited” amounts of cash from banks in just hours [Ars Technica/Dan Goodin]


  1. The burning question for me is who killed Lajud-Pena? Was it infighting? Did somebody spill the beans and he was targeted by an outside party?

    1. The best theory I’ve seen is that he was a cut-out between the foot troops and the actual ringleaders.

          1. I’d only clarify “if he’s a determined prosecutor”. I reserve the word “good” for other things.

        1. I assume the prosecutors either didn’t know he was dead or didn’t have sufficient confirmation. I imagine it’s easier to indict a dead guy than to add him later if it turns out that reports of his death were greatly exaggerated.

    1. Pretty much what I was thinking. I honestly wouldn’t willingly perform a crime to get me locked up unless I could get at least a million for myself from it. From eight people and $400k, that’s only $50k each in New York.
      It’s a nice wage for two and a half hours’ work, but it’s kinda chickenfeed once you add in their sentences, the fact they probably only got a fraction of that, and the 1-in-8 murder chance.

      1. In the second operation they did $2.4 million in 10 hours … does that make it better for you?

        1. Same math applies. 

          $2.4M/8 = $300k, which is well over my annual wage every hour for ten hours.
          But, like a bank teller who handles that much, these people will not have been getting much more than a sniff of that. And even if they were getting 100%, that’s still not worth a 1-in-8 murder chance?

      2. And yet, most criminals end up with $37, or maybe a giant banana with dreadlocks.

  2. I hate thieves.  But still… gotta admire the scope and organization.  
    And they were stealing from other thieves, which mitigates it somewhat.

  3. This seems to point out what I’ve been trying to say for ages, which is that money is precisely what Gibson tried to call cyberspace: a consensual hallucination. I’ve  always had fun asking economics majors what money was and then pointing out that they had merely defined coinage. Money is weird. It is a ghost that can kill. Among many other things. Not all of them bad.

    1. Nice.  So much of what we live, breathe and consume is pure fiction.  People say, oh it’s not, it’s real!  Of course, there are real effects – emotions and thoughts are *real*.  But the fantasies that generated them are not *real* in the sense that they are original or self-generating, like gravity or a tree.  Politics, banking, law, money, systems of behavior… all of it is samsara, maya, consensual hallucination.  Very few things are real.  Zen guys try to say, oh, everything is samsara.  I disagree. It is hard to tell what is real, what is collective hallucination.  But there is a small list of stuff that is really real, and a vast continuum of stuff extending from the really real off into the totally made up.  It’s also as you say, not all bad.  Signifiers are wonderful.  Knowing the signified, deeply, intimately, personally, is even more wonderful.

      1.  “If you’re going to go on about objective vs. subjective reality, I swear I’m going to come down there and bite you on the leg.” Badly misquoted for Diane Duane.

      2. I agree. Everything is collective hallucination. Or, reality. There is no black and white line.

        My keyboard is arguably mostly not real – it’s empty space, or a twisting of strings, or… and yet, I am using it, to write words which are not real – they’re just ones and zeroes, displayed to me by varying brightnesses. And it’s not like written language is real, it’s just a very indirect way of representing words, which are a very indirect way of representing concepts, which…

        It is very easy to disappear into your own navel once you start to argue whether something is real, whether it’s money or time or whatever.

  4. Anyone remember BoingBoing’s previous crusade against Chip & Pin cards? Countries with Chip & Pin weren’t affected.

    1. We really should have a second, uncontrollable, trans-law monetary system.  Bitcoin tried, but damn if it isn’t klunky.  There’s got to be something better.  Jars of jam?

Comments are closed.