Hacker News Reader

Comment by delackner | Hacker News Reader

And just a few days ago people were discussing how that ATMs prefer to just give you money and overdraw an account rather than deny you cash when you go overdrawn. I guess this is the result? Systems that are only synced once an (hour? day?) provide a window to let thieves do a coordinated hit on different network partitions.

View on HN

The article says they hacked into the bank that owns those debit card numbers. It doesn't matter how often the thing talks to the bank to check the balance and withdrawal limit if you've hacked the bank computer.

> In the first robbery, hackers were able to infiltrate the system of an unnamed Indian credit-card processing company that handles Visa and MasterCard prepaid debit cards.

> The hackers – who are not named in the indictment – proceeded to raise the withdrawal limits on prepaid MasterCard debit accounts issued by the National Bank of Ras Al-Khaimah, also known as RAKBANK, which is in United Arab Emirates.

Right - but there is a difference between the "Withdrawal limit" and the "Account Balance" - Just because you have a $50mm withdrawal limit, doesn't mean you have a $50mm account balance.

This is guessing, but perhaps the withdrawal limit of a pre-paid card acts as the account balance.

Not sure why delackner is getting downvoted. Clearly these debit cards did not have $45M on them, so this certainly sounds like they managed to overdraw the accounts (by a massive factor).

I came here to post this exact point - but you beat me to it. No idea who downvoted you or why - this is a really good point.

Probably because the article specifically states that the hackers increased the withdrawl limits on the cards they used. There is no indication that a delay in data syncing was the cause of the problem.

Reply on news.ycombinator.com