The Federal Bureau of Investigation (FBI) has told banks around the world to prepare for an “ATM cash-out” sting that could see millions stolen from savings accounts in a matter of hours.
A spokesman for the Australian Banking Association (ABA) confirmed to YourLifeChoices that local banks had also been made aware of the FBI warning.
“Members of the ABA take cyber security very seriously and have dedicated significant resources to the constant protection of both IT infrastructure and the private data of customers,” an ABA spokesman said.
“Banks always encourage customers to be vigilant about protecting their personal and financial data and should they have any concern they should immediately contact their bank who will be able to assist.”
YourLifeChoices has approached the Australian Federal Police for comment.
Meanwhile, CBS News quoted respected security blog Krebs on Security saying the FBI was flagging a highly co-ordinated sting using fake credit cards to withdraw money from smaller banks and financial institutions, whose cyber security was not up to scratch.
The site reports that the agency had shared a confidential alert with banks that read: “The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in coming days, likely associated with an unknown card issuer breach and commonly referred to as an ‘unlimited operation’,” reads a confidential alert the FBI shared with banks privately on Friday.
“Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cyber security controls, budgets or third-party vendor vulnerabilities,” the alert continues. “The FBI expects the ubiquity of this activity to continue or possibly increase in the near future.”
The agency said the heist would compromise financial institutions or payment card processors with malware to access bank customer card information and exploit network access, enabling large-scale theft of funds from ATMs.
Krebs on Security said that the cyber criminals would remove fraud controls at the financial institution, such as maximum ATM withdrawal amounts and any limits on the number of customer ATM transactions daily, just before launching a massive withdrawal.
The perpetrators would also alter account balances and security measures to make an unlimited amount of money available at the time of the transactions, allowing for large amounts of cash to be quickly removed from the ATM, the site said.
“The cyber criminals typically create fraudulent copies of legitimate cards by sending stolen card data to co-conspirators who imprint the data on reusable magnetic strip cards, such as gift cards purchased at retail stores,” the FBI warned. “At a pre-determined time, the co-conspirators withdraw account funds from ATMs using these cards.”
To counter future threats of cyber theft, the FBI has advised banks to:
- implement strong password requirements and two-factor authentication using a physical or digital token
- implement separation of duties or dual authentication procedures for account balance or withdrawal increases above a specified threshold
- monitor, audit and limit administrator and business critical accounts with the authority to modify the account attributes
- monitor for the presence of remote network protocols and administrative tools used to pivot back into the network and conduct post-exploitation of a network
- monitor for encrypted traffic (SSL or TLS) travelling over non-standard ports.
Do you believe your savings accounts are secure? Have your cards ever been subject to fraudulent purchases or withdrawals? If so, what was the outcome? Do you have any tips on how banks could better safeguard your savings?
Related articles:
Scammers pocket $4.3m a month
Why scammers target elderly
New scams aim at pensioners
