HSBC ATM Skimmer Arrested Romanian Charged with $1.5 Million Scam
New York law enforcement authorities have announced the takedown of an ATM skimming scheme that compromised more than 40 ATMs at HSBC bank branches in Manhattan, Long Island, and Westchester, N.Y.

See Also: Tackling Cloud Infrastructure Security: Merits of the New Model

According to a statement issued by the U.S. Attorney's Office and the U.S. Secret Service, the scheme, under investigation since May, involved compromised ATM card readers, the recording of PIN entries and the creation of counterfeit cards.

Laurentiu Bulat, a Romanian citizen living illegally in the U.S. on an expired visa, was arrested on Jan. 5 and charged with leading the scheme. He faces one count of conspiracy to commit bank fraud and one count of bank fraud. If convicted, Bulat could be sentenced to 60 years in prison.

HSBC bank video surveillance caught Bulat installing skimming devices on two ATMs at a Manhattan branch. Later that morning, Secret Service agents confirmed the tampering and set up surveillance. When Bulat returned to the machines later in the day, he was arrested. Authorities believe he had returned to remove the skimming devices.

Crime rings often target specific bank and credit union branches, because the ATM makes and models are often the same. As a result, skimming devices can easily be fitted and installed on any ATM owned and operated within a particular institution's network. [See ATM Skimming: Insights on New Attacks.]

In October, an HSBC branch in Rye, N.Y. was a hot target for skimming. Over a single weekend, fraudsters targeted the bank's ATMs and ATM vestibules, which offer access to ATMs after-hours. The October hits came on the heels of a half-million dollar ATM skimming scheme in Seattle, which involved, in part, targeting ATMs at BECU, Watermark Credit Union, First Tech Credit Union and Chase. [See New ATM Skimming Arrests.]

It's a trend the good guys are picking up on as well, says Aite research director Julie McNelley. "I think we're seeing the convergence of better detection techniques and a continued upward trend-line, relative to the frequency of attacks," she says. "The organized crime rings behind much of the skimming continue to target ATMs and POS devices, and will continue to do so as long as our cards rely on mag-stripe technology."

Banking institutions and merchants have improved monitoring, through physical inspection and surveillance video, as well as fraud-detection techniques and systems. "Those cameras have been active at ATMs for a long time, but it's a relatively new development that someone is actually monitoring the activity that the camera is recording," McNelley says.

More organization and communication between financial institutions and law enforcement also has helped balance the battle in the fight against skimming crimes.

In the Bulat arrest, the N.Y. Police Department and U.S. Immigration and Customs Enforcement assisted with the takedown. "Our investigations in this case specifically, and in ATM skimming cases generally, remain very much ongoing," said Preet Bharara, U.S. Attorney for the Southern District of New York.

But Neal O'Farrell, who heads up the Identity Theft Council, a grassroots organization that offers assistance to victims of identity theft, says the bust is likely more attributed to luck than vigilance. In the ATM skimming battle, crime rings will always have the advantage.

"The crooks know that time, and the numbers, are on their side," O'Farrell says. "There are close to half a million ATMs in the United States. Add to that the thousands of store card readers and checkouts. Who has time to watch all those? No machine can. If video surveillance is used, it still needs human surveillance - someone has to be either watching in real-time or checking the tapes. ... In the HSBC case, the bank would probably attribute the arrest to good vigilance. I would say it's probably just a stroke of luck."

Even if banking institutions and law enforcement do catch and thwart all of the attacks, then new problems are created, such as how to deal with all of the arrests. The courts and the justice system overall would not be able to keep up, O'Farrell says. "This will only end when card readers are less vulnerable," he says. "Skimming will always be easy pickings, as long as the technology remains so simple to exploit. Make the crime harder, and most of the criminals will move."


About the Author

Tracy Kitten

Tracy Kitten

Executive Editor, BankInfoSecurity & CUInfoSecurity

A veteran journalist with more than 18 years' experience, Kitten has covered the financial sector for the last 11 years. Before joining Information Security Media Group in 2010, where she now serves as the Executive Editor of BankInfoSecurity and CUInfoSecurity, she covered the financial self-service industry as the senior editor of ATMmarketplace, part of Networld Media. Kitten has been a regular speaker at domestic and international conferences, and was the keynote at ATMIA's U.S. and Canadian conferences in 2009. She has been quoted by CNN.com, ABC News, Bankrate.com and MSN Money.




Around the Network