Federal regulators just alerted banks across the USA of a very dangerous new skill ATM hackers have picked up. They can trick ATMs into spitting out unlimited amounts of cash, regardless of the customer's balance. Not only that, but also schedule the illicit withdrawals for holidays and weekends, when the ATMs are extra flush.
We've heard of crazy ATM hackers before, but this really takes the cake. It's a triple threat, really. The ability to skirt around daily ATM withdrawal limits is bad enough, since the hackers isn't limited to £500 or whatever the limit is on any single account. But the fact that the hackers can now extract more than what's in a customers account combined with the scheduling method means that any given ATM theft could now be an all out heist. That's why the US Secret Service is calling this strategy Unlimited Operations.
Heists are exactly what's happening, too. "A recent Unlimited Operations attack netted over £24 million in fraud using only 12 debit card accounts," said the Federal Financial Institutions Examination Council in its alert to banks. The regulators believe that the hackers have actually been targeting bank employees with phishing scams in order to get their malware installed on the banks' computer systems. The Los Angeles Times explains how it's done:
Criminals use the malware to obtain employee login credentials and to determine how the institution accesses ATM control panels, often based online, that allow changes to be made in the amount of money customers may withdraw, geographic usage limits and how fraud reports are generated.
After hacking the control panel, criminals withdraw funds by using fraudulent cards they create with account information and personal identification numbers stolen through separate attacks, the regulators said. The PINs may be stolen by malicious software or scanning programs at merchant sales terminals or ATMs, or by hacking into computers.
It also doesn't help that corporate breaches can (and have) put millions upon millions of card numbers out in the open, giving hackers even more fraudulent cards to work with.
For those that've been hit by one of these attacks, FDIC insurance will kick in, but it's a huge pain in the ass for everyone. So in a twisted sort of way, these ATM hackers are inevitably taking people's tax dollars. That mobile payments revolution everyone keeps talking about can't come soon enough, can it? [LAT]
Image via Getty