ATM Skimming Ring Busted7 Arrested, 13 Sought in International Card Fraud Scheme
Detectives with the Toronto Police Department have arrested seven individuals for the roles they allegedly played in an ATM skimming scheme that compromised at least 1,500 credit and debit cards and cost Canadian banking institutions more than CAN $360,000 [U.S. $361,161].
See Also: Account Takeover: The Stages of Defense
"Those are known losses," Toronto police Det. Ian Nichol said during a Feb. 28 press conference. "The actual losses are actually much greater than that."
Total financial exposure could be more than CAN $800,000 [U.S. 802,357], authorities say.
On Feb. 28, Toronto residents Svilen Marinov, Aleksandar Mihov, Assen Dotchev, Dimitre Kerelski and Daria Boussarova, as well as Boyko Simeonov of Brampton and Dimitar Raykov of Pickering were arrested. So, far, 357 charges have been brought against the ring, and authorities say they are working with the Canada Border Services Agency, the U.S. Secret Service and other Greater Toronto agencies to locate 13 more suspects, including Dimo Bakalov, also of Toronto.
The investigation, named Project Holiday by the Toronto Police Service Financial Crimes Unit, has connected the ring to ATM attacks throughout Ontario, as well as parts of the U.S., Australia and Indonesia. Compromised card data linked to the attacks has been used in Bulgaria, the U.S., Chile, South Africa, the Dominican Republic and Mexico. Authorities also say they believe the ring is connected with other international groups for similar schemes, but did not elaborate.
In December, members of the Toronto Police Financial Crimes Unit executed search warrants at two Toronto homes, where a facility reportedly used to manufacture and distribute skimming equipment was discovered. On Feb. 16, Canadian authorities in Toronto Police, Halton and Durham issued additional warrants at residences in Toronto, Brampton and Pickering.
The accused now face charges for participation in a criminal organization, possession of forgery devices and fraudulent possession of credit card data.
Similar arrests were announced in February, when Canadian authorities linked 12 suspects to a $300,000 payment card-skimming scheme that targeted ATMs and pay-at-the-pump gasoline terminals in Greater Toronto. [See 12 Charged in Toronto Skimming Scam.]
Fraud Detection: Were Flags Raised?
The role financial institutions played in helping authorities identify the fraud is unknown. But identity theft expert Neal O'Farrell says transaction analytics and internal fraud detection should have raised flags.
"What financial institutions don't seem to have mastered yet is understanding context," O'Farrell says. "[It's] not whether the right PIN was used or the card reported stolen, but when, if ever, that user has used an ATM machine or made a purchase with a credit card in Chile or South Africa, or in any manner that just doesn't fit their usual pattern. It seems like all kinds of alarms should ring when there's such an obvious pattern deviation."
Erik Rasmussen of the U.S. Secret Service says attacks on payments systems have exploded in the past two years. But banking institutions and merchants continually fail to address security gaps. "The No. 1 way criminals are getting in is through remote access to the backhouse server," says Rasmussen, who co-hosted The Faces of Fraud: An Inside Look at the Fraudsters and Their Schemes with BankInfoSecurity at RSA Conference 2012, held in San Francisco Feb. 27-March 2. [See 4 Ways to Fight Card Fraud.]
Rasmussen says financial institutions should focus on risk mitigation across numerous channels, including credit and debit. And because fraud continues to involve more international schemes, card issuers should focus more attention on information-sharing and collaboration with law enforcement.
Neil Schwartzman, a financial crimes consultant in Canada, says the arrests reflect a win for cross-border law enforcement collaboration. On the whole, however, the takedown is just a drop in the international card-fraud bucket. "Seeing 357 charges laid against 7 people means they stopped a small group of people who weren't particularly active," he says. "When one thinks about how ubiquitous these thefts are, this is a very small, first dent in a much larger set of crimes."