12 ms·
$12M stolen from 1,400 convenience store ATMs across Japan in 2 hours
- shrugger 10y agoAmateur hour. If you want to rob a bunch of ATMs and get away with it, try keeping your vulnerable window longer than 2 hours... I mean, it's going to be pretty straightforward to gather a bunch of footage and see what happened those 2 hours. These guys will get busted within the next few days basically guaranteed.
- Cyph0n 10y agoIf they can coordinate a 100 person operation across 1400 ATMs nationwide in the span of two hours, I'd assume they had basic face covering to make it hard for authorities to determine their identities. At least, I hope so. After all that trouble... Besides, I think the decision to execute the transactions in a short time window is correct. Otherwise banks would easily spot a pattern in the transactions (max amount, stolen CC, South Africa) and start rejecting them. Even if legitimate transactions are denied, it's still worth it. They would have never been able to get away with $12 mil in cash.
- dogma1138 10y agoThe fact that it had to be done by 100+ guys almost guarantees they'll be caught. A small crew can disappear but 100's of people at least some of them with records and known to the police not a chance.
- Cyph0n 10y agoGood point. It will also be way more difficult to regulate the spending habits of the group, which will draw even more suspicion. And then you have a 100-player Prisoner's Dilemma, unless they organized the group in a decentralized manner.
- ethbro 10y agoWhy regulate? You could have accepted BitCoin up front, assigned ATMs, then distributed numbers at the last moment. Cash flows up, risk flows down. Seems to be the MO of most organized crime.
- ryanlol 10y ago>Good point. It will also be way more difficult to regulate the spending habits of the group, which will draw even more suspicion. These 100 guys aren't a part of "the group" though, they're just random idiots hoping to score a quick buck. The people actually running this in all likelihood aren't even in japan.
- ryanlol 10y agoThe whole point of mules is for them to get burned. Assuming this was done properly, every single one of those 100 people can get caught and the cops won't be any closer to catching the people responsible.
- rincebrain 10y agoThat only holds true once the money has percolated up the chain - if they catch anyone in the window prior to the handoff, it could be of use. Of course, if they pulled this off effectively, the drops all were probably executed soon after the 2h window, and then you've got a much colder trail to follow, even if you find one of the mules and magically have video surveillance of the region.
- ryanlol 10y agoIn all likelihood the handoff would be executed via bitcoins or a wire transfer by whoever is coordinating the operation in Japan. In all likelihood the people actually responsible for the hack are going to be eastern european or Russian, and once the money is no longer in cash it'll be gone forever.
- Retric 10y agoThe way these things are usually setup, the people using the cards have little to do with collecting the info, or making the cards. If a few are fought they don't know anything about the others, and are much harder to trace. So cops don't put a lot of effect into tracking these people.
- superuser2 10y agoThere are now 100 people holding cash. How will the organizers get it back? Dead drops? One guy talks, they have a drop site. Law enforcement knows how to do stakeouts. Wait until someone comes to pick up the cash from the drop site, tail him to wherever he goes next. Deposit it in real banks and transfer it somewhere? Okay, now you don't even need a participant to cooperate, you can just identify him and pull his bank records. Maybe they convert it to BTC. Are there mixing services doing enough volume to really be untraceable? Otherwise investigators can watch it on the other side and see whose bank account it gets converted into.
- Retric 10y agoPay cash upfront like a large drug deal between gangs.
- superuser2 10y agoLarge drug deals between gangs are vulnerable to stakeouts and busts if one of the parties involved leaks the meeting time and location.
- walshemj 10y agoI am sure the Yakusa can find 100 foot soldiers with to much difficulty.
- andyjdavis 10y agoMore likely, the Yakusa can find 100 random people who they have some sort of leverage over and who know virtually nothing about anything of importance so it doesn't especially matter if they get arrested.
- nickysielicki 10y agoA bear jumps out of a bush and starts chasing two hikers. They both start running for their lives, but then one of them stops to put on his running shoes. His friends says, "What are you doing? You can't outrun a bear!" His friend replies, "I don't have to outrun the bear; I only have to outrun you!"
- jessaustin 10y agoLet me guess, they'll narrow it down to a bunch of people wearing surgical masks, hats, glasses, cheap windbreakers, and blue jeans. Now they can just arrest half the people in Japan!
- dzhiurgis 10y agoEven if faces are clear, how realistic it can be traced back to anyone? How can you really find someone from 100x100 pixel image? I am genuinely interested.
- onion2k 10y agoAssuming ATMs take and store a photo every time they're used, then it'll be a matter of matching the photos to photos of people already in the corpus of training data several times. That makes it quite easy.
- pavel_lishin 10y agoPresumably you leverage the camera network to follow them to some other location.
- kalleboo 10y agoThis isn't the UK
- Bromskloss 10y agoNo matter how you spread it out, couldn't they just look at the video from when each fraudulent withdrawal was made? Also, what is the vulnerable window here?
- ryanlol 10y ago>Amateur hour. Please tell me how you'd do it instead? Build robots to go to the ATMs? Only thing that matters here is the link between the people going to the ATMs and the people actually running the operation.
- nametakenobv 10y agoThis is on exactly the opposite side of the spectrum from amateur hour.
- EliRivers 10y agoThe mules get busted. The mules are amateurs.
- Someone 10y agoThe guys retrieving the money, yes, but that doesn't guarantee that the masterminds will get caught. Chances are the ones going to the ATMs are money mules (https://en.m.wikipedia.org/wiki/Money_mule https://en.m.wikipedia.org/wiki/Money_mule), probably not of the completely innocent kind, but of the "not too smart, falling for a 'want to earn $100 in an hour?'" question from a 'friend'. $100 will give them about a 10% cut, if they do one ATM. It is more likely, though, that they had each guy do >1 ATM. So, you would need, maybe, around 250 of these guys. To recruit them, find around 50 slightly smarter but still not too smart guys who get $2000 each. On top of that, you need real criminals who can make sure the lower levels do not run away with the money, either by convincingly threatening them with bodily harm, or by following them to the ATMs while staying out of view of the cameras. Yes, costs will add up, but you should be able to keep costs below 50%.
- dclowd9901 10y agoA 10% cut wouldn't be $100. It sounds like each person ran about 140(!) transactions, maxing the withdrawal on each one. That's 14 million yen per person or about 127,000 usd. 10% would be 12,700. Still possible that this happened but my guess is it was yakuza given the coordination and manpower.
- rincebrain 10y agoAs someone upthread remarked, it actually seems improbable it was yakuza - way too visible, even with no provable connection, going to make their lives problematic for awhile. Plus, we probably wouldn't be hearing about it a week after the fact, if it's part of a long-standing interaction like the yakuza, barring someone with loose lips.
- coldtea 10y agoAh, armchair critic from people who don't even know who those things are usually run... As if those 100 guys matter...
- Bootvis 10y agoThe article has the amount at USD 12,7m. That's a lot of money but quite a bit less than the title suggests.
- phjesusthatguy3 10y agoYeah, the posted headline is just plain wrong. It was 1.4 billion Japanese Yen.
- deleted 10y ago[deleted]
- erelde 10y agoThis is just getting confusing (and ridiculous), I dont' know if you're using long or short scale. Currency conversion, plus bad editing/title, plus confusion around the short/long scale.
- MicroBerto 10y agoSometimes, M = 1,000, and MM = 1,000,000 (edit: just came back realizing that this was a useless comment since they'd both be wrong here)
- tossaway1 10y agoIn this case it was apparently neither of those
- stepanhruda 10y agoWhy the hell is M 1,000? Shouldn't you use k?
- josephmx 10y agoMille is sometimes used (eg, CPM is Clicks Per Mille/Thousand)
- MikeKusold 10y ago
- imaginenore 10y agoI'm surprised there are still ATM cards without chips, and in Japan out of all places.
- trendnet 10y agoThere're still fax machines in heavy use in Japan. It's a strange place.
- yedpodtrzitko 10y agoI was also surprised that flip-phones are a thing which a lot of people buy and use.
- TeMPOraL 10y agoFax machines are still present pretty much everywhere, especially in corporations and government facilities. When I've been working in the UK 5 years ago in a large research institution, I had a fax machine next to my desk. (The only thing it did though was activating once a day and printing out some ads, mostly car dealerships or insurances, AFAIR.)
- nitrogen 10y agoIs fax spam not illegal in the UK? In the US, AFAIK, there is a potential $500 fine per unsolicited fax ad.
- TeMPOraL 10y agoI don't know. But the first time I saw it happening I went and shown it to my boss; she reacted like most people react to on-line ads. "Yeah, it does that."
- jchrisa 10y agoI used to help my dad identify senders of spam faxes so we could get a court to issue summary judgment. I think the fine can be tripled if the violation is willful. Even with faxes from a whole bunch of his clients... as many as I could trace back to the sender, and then of course collecting the judgment isn't easy. So after all that, it was barely enough to pay me. I guess that is why you don't see folks going after the spammers as much.
- dschiptsov 10y agoLet me guess - these ATMs were "powered by" Windows. XP or 200x.
- nametakenobv 10y agoHow would that make a difference?
- fallenshell 10y agoVulnerabilities.
- nametakenobv 10y agoThis is about stolen credit cards. What do vulnarabilties have to do with it?
- ryanl0l 10y agoA more accurate title would probably be "120M stolen from hacked South African bank via 1,400 convenience store ATMs across Japan"
- avree 10y agoActually, a more accurate title would be "12M stolen from hacked South African bank via 1,400 ATMs across Japan"
- osteele 10y agoActually, a more accurate title would be "$13M stolen from hacked South African bank via 1,400 ATMs across Japan"
- ChrisLomont 10y agoActually..... Since this is a pedantic chain.... 13M was not stolen. 12M was stolen (and some more). Thus the more accurate title would be "12M stolen from hacked South African bank via 1,400 ATMs across Japan" since the statement in your title is demonstrably false, while the other title is (presumably, from the article) true.
- rangibaby 10y ago1.4 billion yen stolen from 1,400 ATMs across Japan. There is a 100,000 yen limit per card per day from convenience stores.
- blacksmith_tb 10y agoThat's 2X or 3X the common ATM limits in the US (which seem to vary from bank to bank, or even account to account). Is there a higher limit at non-convenience-store ATMs?
- rangibaby 10y ago
- ghshephard 10y agoInteresting thing about Japan, is the complete acceptance of people wearing surgical masks in public (it's considered to be polite if you are ill). Makes it a lot harder to identify people from video surveillance.
- nolok 10y agoThis a south/east/south-east asian thing, not specific to japanese. You will find the same in vietnam, korea, cambodia, thailand, taiwan, ...
- _kyran 10y agoYou will find it elsewhere in SEA, but the prevalence in Japan is extremely high. I've been in train carriages where 40% of its passengers are wearing them.
- TeMPOraL 10y agoAlso Hong Kong. I always thought it may be related to population density. Another thing I've noticed in Hong Kong is sanitizing gel dispensers placed pretty much everywhere - corridors in metro stations, hotels, etc. Seems reasonable with the amount of people living there per square meter of space.
- micv 10y agoI'm not sure it's population density or at least not that alone. There are parts of the West with comparably high densities, especially in large cities, and covering your face is generally frowned upon. I suspect that the cultural focus on cleanliness has a lot to do with it, but given that it's Hacker News there may be someone with a more exact idea of the origin.
- mistermann 10y agoAllergies is one major motivator.
- deleted 10y ago[deleted]
- ygmelnikova 10y ago10 if no_of_max_transactions / hour > 200 then quit 20 goto 10
- level09 10y agoWould the south african bank be held accountable for this? or can they get away with this as the cards are fake/stolen ? The article makes it seem as if Banks of the ATMs are the ones who lost the money. I'm also a bit surprised the criminals carried their operation in Japan, It would have been easier in a more messy place e.g India / Africa ?
- ryanlol 10y agoYes, the south african bank will most likely be liable for this. >I'm also a bit surprised the criminals carried their operation in Japan, It would have been easier in a more messy place e.g India / Africa ? No, you'd want a location with lots of ATMs that have large amounts of money in them. In my experience India and Africa would both be particularly bad places for this. LE isn't a factor here, mules may get arrested but the perpetrators certainly don't care.
- thasaleni 10y ago>No, you'd want a location with lots of ATMs that have large amounts of money in them. In my experience India and Africa would both be particularly bad places for this. LE isn't a factor here, mules may get arrested but the perpetrators certainly don't care. Contrary to popular belief (and "your experience", Africa & India , has a lot of ATMs that have a lot of money, I am from South Africa, and I've been to India so I know this for a fact.
- ryanlol 10y agoYour experience must be severely limited then, as both of those countries have very low ATM densities. This isn't just my personal experience, but a very easily verifiable fact. I also seriously doubt that level09 was referring to South Africa in his comment, rather than the other "messier" african nations that all have far lower ATM densities.
- logicallee 10y agoCan a mod change the title to use the amt listed in the first paragraph? Current title: 120M stolen from 1,400 convenience store ATMs across Japan in 2 hours First paragraph of article: >TOKYO (Kyodo) -- A total of 1.4 billion yen ($12.7 million) in cash has been stolen from some 1,400 automated teller machines in convenience stores across Japan in the space of two hours earlier this month, investigative sources said Sunday. Suggested title: $12.7 million stolen from 1,400 convenience store ATMs across Japan in 2 hours
- vegabook 10y ago14000 transactions at 1400 ATMs in 2 hours?! Think about the logistics. That's 120 transactions per minute. And 1600 cards. Either an army of coordinated people, in itself highly risky as it vastly increases the likelihood of someone grassing on the group, or fewer people all sitting at the same ATMs drawing for 2 hours.... difficult not to get noticed. If they really pulled this off it will be the most well organized organized crime ever.
- grecy 10y agoI was thinking the same. And it mentions every single transaction was for the maximum withdrawal amount. The system doesn't notice when 116 transactions per minute are for the maximum withdrawal amount? The ATMs don't run out of cash really quickly?
- brianwawok 10y agoHave you ever worked on a risk system? Hard to get right I would imagine. Very possible news of a hurricane would lead to a bunch if max rate withdrawals. May not want to cut everyone off then..
- firethief 10y agoThe false positive rate for "shut down everything" needs to be very low, but it sounds like the threshold for "page somebody" could have been sooner.
- brianwawok 10y agoIt got shut down in 2 hours, not impossible someone got paged 15 minutes in...
- deleted 10y ago[deleted]
- zhte415 10y agoJapan is a very cash-based economy. Large withdrawals are not uncommon. 116 transactions at the same ATM should raise some red flags, but there are very few people looking.
- williesleg 10y agoWhoa! Imagine if it were all computerized, you could just key in what you want.
- underdendride 10y agoCan I speculate that this is an untraceable form of tax protection payment from 7 Bank to Yakusa?
- known 10y agoHow did they get passwords?
- TheAlchemist 10y agoInterestingly this is not the first time it happens. 3 years ago: http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-45-million-global-cyber-bank-thefts.html?_r=0 http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-...
- raesene9 10y agoyeah this is a not uncommon style of attack there have been multiple instances http://krebsonsecurity.com/2013/02/crooks-net-millions-in-coordinated-atm-heists/ http://krebsonsecurity.com/2013/02/crooks-net-millions-in-co... has some more. As all credit balances on cards are just numbers in a database somewhere and prepaid cards can be refilled and drained pretty quickly, you can see the appeal of this style of attack.
- sjreese 10y agoThis is the only declassified story, I could find .. The 120M number is real and BMO is on full alert.
- chinathrow 10y agoAny source?
- mtgx 10y agoLet me guess they run Windows XP Embedded?
- a3n 10y agoYou could have a Cray in there behind the wall and it still would have happened. It's the debit card system and protocols that make this possible. They didn't hack any ATMs.
- allisthemoist 10y ago100 people involved? That's a lot of people who could potentially slip up.
- lrem 10y agoAlso, that is not exactly a life changing amount of cash, even if divided evenly only between them.
- a3n 10y agoMy guess is that they were minions ordered to do so by someone else. The someone else will get the bulk of the cash.
- saalweachter 10y agoEh, it's not too bad for 2 hours work. Assuming 100 people (which would be about 9 minutes per ATM -- 1 minute to withdraw, 8 minutes to travel to the next one), that's $127,000 for two hours of unskilled labor. If you assume that half of that gets passed upward, that's $63,500 for each of the 100 unskilled workers and $6.35 million for some smaller group (say, 5-10) who organized it. It's actually probably safer for the workers than the organizers -- if one of the workers is picked up, they probably have a huge incentive to roll over and give up the guy who recruited them, but the organizers probably won't get much out of giving up their 100 minions. And yeah, $50,000 probably isn't life-changing for you but if you're a teenager or 20-something without any prospects, it could be life changing. It's not "retire to an island" money, but it is "pay for college", "start a small business", "buy a car" and "move out of your craphole town to a place with economic opportunity" money. And for the organizers, $1M a piece may be retire-to-an-island money, assuming you mean "move to a cheap island" and not "buy your own island".
- hobarrera 10y ago> Also, that is not exactly a life changing amount of cash, even if divided evenly only between them. 320x the minimum wage in my country. I could sure live several years with that amount of cash.
- ck2 10y agoHow on earth does the system absorb a nearly $13M loss now?
- deleted 10y ago[deleted]
- mgiannopoulos 10y ago100 people, 4 hours, 13 million dollars. Set in the "mystical" and "lcd bright" Japan. Sounds like the next George Clooney movie. Ocean's 100? :)