Hacker News Reader

Comment by kevinconaway | Hacker News Reader

What’s interesting to me about this is it seems like the hack still required physical presence to pull it off. The criminals had to actually visit hundreds of ATMs over the span of a holiday weekend to withdraw the cash

I suspect it had to have been people in on the scam because I don’t see how you could conceivably convince strangers to withdraw cash for you at that scale without raising eyebrows

View on HN

If a guy in an Indian call center can convince people that the IRS is about to have them arrested if they don't immediately pay their back taxes with iTunes gift cards, you can certainly convince people to withdraw money from an ATM and send it somewhere.

It seems more likely that the ATM withdrawers were just normal criminals already integrated into normal criminal organizations. Everybody gets a cut, but nobody takes too big a cut because violence and repeat business. Normal criminals love ATM stuff because it's quite low-risk.

It's really easy to trick people to commit crimes. Post a bunch craigslist job postings for a non-existant bank QA job that pays $100/hr. Have them withdraw the cash from the ATM, deposit it into their bank and wire the money out to an international bank.

https://securityintelligence.com/the-most-common-schemes-for...

I wish we could learn more about that. The article said it was Russian IPs and tools, but that doesn't account for the local ATM activity.

It also seems like you'd need a lot of domain knowledge to make this happen. If you gave me an open machine in a bank I'd have no idea what to do.

The article does touch on the matter:

> The bank’s complaint against Everest notes that the financial institution doesn’t yet know for sure how the thieves involved in the 2017 breach extracted funds. In previous such schemes (known as “unlimited cashouts“), the fraudsters orchestrating the intrusion recruit armies of “money mules” — usually street criminals who are given cloned debit cards and stolen or fabricated PINs along with instructions on where and when to withdraw funds.

This may be of interest to you. It talks about how this group pulled off the physical presence aspect too:

https://www.bloomberg.com/news/articles/2018-03-26/malware-m...

> I don’t see how you could conceivably convince strangers to withdraw cash for you at that scale without raising eyebrows

The book "Kingpin" talked about how most of the people doing the withdrawing of cash were usually "mules" who were in on the scam. They'd withdraw the money, get a small cut and send the rest to a middleman.

The book itself goes into a lot more detail on how it worked:

https://www.amazon.com/Kingpin-Hacker-Billion-Dollar-Cybercr...

Earn $4,000 a week working only 5 hours! Click here to learn more.

This is a pretty common method of attack on banks, and this is far from the first time it's been done. I'm guessing the criminals expect a certain level of loss from the mules doing the withdrawals but aren't too bothered as it's not their money :)

It goes back at least to 2009 (Worldpay US) and possibly before that.

The ATM element is important as one of the hardest parts of electronic bank theft is getting the money out of the banking system in an untraceable form.

Reply on news.ycombinator.com