Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The scheme was simple. The group hacked the pay system, and were able to deposit fake money into real accounts. Additionally, they had stolen whatever information was needed to access these accounts via an ATM card.

There's no need to use a skimmer to capture someone's card, or anything like that. If you have the account information (likely encrypted), you can simply print it onto the magstrip of an ATM card. It's very simple. They had access to accounts, and they had control to put imaginary funds into those accounts, which could be withdrawn.

The real problem they faced was that once they executed this, it'd be noticed by the bank and/or payroll company once they realized things weren't square, that is, once they realized money was coming from thin air.

I think you're greatly exaggerating the scale of this. If I said I could give you an unlimited ATM card, and all you had to do was get on a plane to another city, would you do it? It didn't have to be multiple languages.

The point is, the hackers knew they struck gold, and they organized a mass ATM hit. If you know the hackers, and hell, they could even show you once or twice, then you'd be willing to scrap together a team to help out.

I think trading cash for another ATM isn't that bad of deal. You'd essentially get paid per card used with no end in sight. You get a card, you extract all money, you return money (keep some for yourself) and get a new card. At the end of 30 minutes, you have more money for yourself than what any 1 card would have given you.

At any rate, when you invent money out of thin air, there are plenty of ways to make it so everybody wins.



I referred to skimmers to point out that the types of cards that came before and after this scheme pale in comparison. There wasn't any skimming involved here.

I outlined how I think it happened in a couple of other posts.[1][2] It wasn't organized drug-gang style where you have people go out and come back to you with money because there's no such structure in online fraud. 99% of the time, online, accounts are sold and whatever happens after is at the buyer's discretion. In my experience, there's never a high-level of collaboration. You can't form teams just by asking people if they want to steal money with you.

[1] http://news.ycombinator.com/item?id=479205

[2] http://news.ycombinator.com/item?id=479326




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: