NEW YORK, May 9, 2013 — Just wait for the movie.
Federal prosecutors in New York announced on Thursday that a group of hackers had figured out how to steal more than $45 million from ATMs in countries around the world, from the United States to the Middle East, Europe and Africa. They were apparently able to do it in only a few hours.
However, while the massive heist was global in terms of where the ATMs were located, the crimes were mostly made after the hackers had gained access to the databases of prepaid debit cards from banks in the Middle East, which apparently use less modern encryption standards. The financial institutions involved were United Arab Emirates-based Rakbank and Oman-based Bank of Muscat.
The Associated Press is reporting that seven arrests related to the case have been made in New York, and that the international group worked in groups, or cells, in cities around the world. There has not yet been speculation on possible terrorism ties.
The U.S. Attorney in Brooklyn, New York, Loretta Lynch, told the A.P. that it was "a massive 21st-century bank heist."
Court documents state that surveillance cameras helped in the capture of one of the arrested suspects, reportedly showing him stuffing money into a bag, then moving to additional ATMs in the area, which all had functional cameras.
The ATM bandits did not steal money from individual account holders, however. Instead of the more frequently heard of identity theft version of bank account access, they were able to breach the databases of the banks, create new fake accounts or use accounts they'd previously established anonymously, and then remove the withdrawal limit. For pre-paid debit cards, that limit is not supposed to be larger than the the credit balance, but the theives were able to turn off that setting and withdraw any amount, up to the total cash contents of some of the individual ATMs.
Although federal prosecutors made the announcement today, they said they robberies happened during two separate events: One in December and one in Februrary. The thieves made about 36,000 withdrawals.
Law enforcement in many other countries were also involved in the sting and made arrests, which started in March.