New ATM Fraud: Cash Claw Crimes

Banks in India, Beware !!

Yet another ATM fraud  hitting the headlines across the UK during the late November 2012. The trouble now is more physical, stopping the money being dispatched from ATM and  tricking the customers which invariably result in increasing disputes between the bank and its customers. The UK’s Dedicated Cheque and Plastic Crime Unit (DCPCU) said it had seen a big jump in the rise in the number of incidents of so-called “cash claw” fraud in recent months, and is warning the public to report any incidents.


UK’s Dailymail reported in detail  with images of ‘claws’ used to steal the money from ATMs. It was reported that the devices have been used at cash points across Britain, with 2,479 reported cases in the first half of 2012. Fraud losses through cash trapping and other ATM scams across the UK came to £29.3 million last year, according to Financial Fraud Action UK, although this is said to be dropping since chip and pin was introduced in 2004.

Problem for banks in India

With close to 100,000 ATMs, millions of uneducated users and emerging ground for technology frauds, India dubiously attracts fraudsters.  So far, we have not come across any such ‘claw’ frauds stealing money from ATM. Unfortunately for the bank customers in India, a new vulnerability emerged, thanks to the instructions of National Payment Corporation of India (NPCI) on withdrawing ATM cash retraction facility by March 31, 2012. Earlier, when the cash retraction method was in force, the money would be taken back into the ATM if the customer did not remove the cash within a specified amount of time (say 30 sec), thus virtually not giving scope to any ‘claw’ fraud. Now, in the absence of such defence if any ATM machine is “clawed”, then the money would neither be retracted nor the customer could take it.

The cash retraction facility has been withdrawn reportedly, to contain the ATM fraud cases by misusing retraction facility at many bank ATMs.  While the action could address a vulnerability, it has opened up another. While cash retraction facility misuse had impact on the banks, the ‘claw’ fraud  would impact the customers as in the bank’s records the money would be debited to the customer account.

Solutions?

Customer education and public awareness seem to be effective to a limited extent, as long as the ‘education’ is not counter-productive. In the UK, the Police have warned account holders to be vigilant, but many devices are impossible to spot. 

ATM designs, perhaps, need a revisit and with display of an alert on the screen and a transparent cash dispenser draw could help prevent this kind of exploitation of flaw.

More importantly, the banks and regulators should adopt a holistic approach, at least from the security point of view, while reviewing or withdrawing an existing control, to ensure the action would not result in another vulnerability. When it comes to security, golden rules have to be remembered, ALWAYS !!

Information Security Flaw Exploited: Citibank lost over a million USD

 ‘Gone in 60 Seconds’  – and the lessons learned

During late October 2012, fourteen individuals were charged following a Federal Bureau of Investigation (FBI)-led investigation into the theft of over $1 million from Citibank using cash advance kiosks at casinos located in Southern California and Nevada. The fraudsters stole the money by exploiting a gap in the Citibank’s ATM applications—which required multiple withdrawals all within 60 seconds—giving the fraud a popular name among the legal and security circles ‘Gone in 60 Seconds’. 



The modus operandi worked as follows: the main accused recruited conspirators who were willing to open multiple Citibank checking accounts. He then supplied his co-conspirators with “seed” money, which was deposited into the recently opened accounts. After the money was deposited into the checking accounts, the conspirators would travel to nearly a dozen casinos in California,  Las Vegas and  Laughlin. When inside the casino, the conspirators, used cash advance kiosks at casinos to withdraw (all within 60 seconds) several times the amount of money deposited into the accounts, by exploiting the Citibank’s ‘security gap’ they discovered. The accused were also careful to keep both their deposits and withdrawals under $10,000 in order to avoid federal transaction reporting requirements and conceal their fraud.

What was the  ‘security gap’ which could be discovered by the fraudsters and NOT by the Citibank’s IS Auditors? 


As long as all of the withdrawals were made within one minute of the first, Citibank’s software assumed the transactions indicated erroneous duplicate processing of the first request, and hence no red flags would be raised. While the sophisticated plot  allowed the group to collect more than a $1 million over an eight-month period, thanks to a  mundane flaw in the criminals’ logic eventually led the FBI to its suspects: they all used their real names when activating the bank accounts that ended up excessively overdrawn.

What Citibank could have done to prevent this?
Presumably, the control weakness escaped the multiple layers of security at Citibank: concurrent audit during application development,  scenario based IT application controls and risk assessment by the concurrent auditors.  Also, there is a need for real time detection of suspect transactions, even for smaller amount of transactions. Interestingly, the accused kept the withdrawals under  $10,000 to avoid regulatory reporting and probably, they guessed it right that the bank would not look into transactions that would not require any regulatory reporting.

Most likely,  the fraud detection predictive data models used by Citibank  failed to notice such transactions or have assumed small amount transactions are relatively safer !! 

Lessons learned ….

Banks need to strengthen their fraud detection data models.
All transactions, not just those required for regulatory reporting, need to be monitored.
Real time audit to be built into their security frameworks. 
Needless to mention, build and continuously review appropriate application controls.