The FBI is warning financial institutions that cybercriminals are preparing to execute a hack that could siphon a virtually unlimited amount of money from ATMs around the world. The “ATM cash-out” scheme or “unlimited operation” is likely to happen in the near future, the FBI said in a confidential alert on Friday, made public by cybersecurity journalist Brian Krebs. “The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days, likely associated with an unknown card issuer breach,” the alert read, according to Krebs. These kinds of attacks have been used to steal millions of dollars from individuals and banks around the world. What is different about this case is the FBI learned about it before it happened, said Mark Rasch, a cyber lawyer and former federal prosecutor who has handled similar cases. The advanced warning means banks and consumers can take extra precautions that could prevent or mitigate the damage from an attack. Here’s what you should know and how you can protect yourself. How do ATM cash-outs work? There are two main steps to this kind of cybercrime. First, hackers must obtain users’ information. One of the most common ways to do this is a phishing attack that uses emails or phone calls that appear to come from a reputable or familiar source. If a person clicks on a link in a phishing email, it could compromise banking passwords. A phone call from someone posing as the IRS or a bank could convince someone to give up the answers to their security questions. Criminals can also buy a person’s information off the black market from other hackers. It appears the hackers already have personal data. Now, they are waiting to use it. Based on the FBI memo, it appears the hackers already have that personal data. Now, they are waiting to use it. That’s where the second phase of the scheme begins. If hackers have your debit card information, they can “clone” the card using hardware that duplicates the bank information onto another card. That “clone” can then be used at any number of ATMs. Once they do that, they get hundreds of people, likely recruited off the dark web, to go to ATMs at the same time, using the debit card clones to withdraw stacks of cash from the machines. There is one last step. Because banks set up limits on how much can be withdrawn from an ATM, the hackers also break into the system that processes the payments to trick it into not recording what is being debited from an account. That means the amount that can be withdrawn is not restricted by how much a person has in his or her account. The only limit is how much money is in the ATM, or how much money the thieves can carry. In most ATM attacks, hackers steal a small amount of money from a lot of people, or a lot of money from a few people, Rasch said. What makes this case so dangerous is that hackers are plotting to steal a lot of money from a lot of people. In this video, the BBC looks at how criminals clone your card. Where has the scheme been used before? Despite the complexity of an unlimited operation attack, it has been pulled off several times. In 2011, an international cybercrime group stole $14 million from ATMs across the world within 48 hours. In 2012 and 2013, cybercriminals in 26 countries carried out a pair of attacks, taking $45 million from ATMs. In 2016 and 2017, two smaller break-ins involved The National Bank of Blacksburg in Virginia. An employee there was targeted by a phishing email and hackers subsequently stole $2.4 million, according to lawsuit filings. These kinds of attacks are becoming more common because hackers can easily coordinate with each other on the internet, said Adam Levin, the founder of CyberScout. He likens the way hackers and cyberthieves are operating to the movie “The Italian Job,” in which an ensemble of crooks scheme to carry off a major heist (take your pick between the 1969 original and 2003 remake). “They do a job and then go their separate ways,” Levin said. “This is organized cyber crime at its best.” How to defend yourself Levin, who has written a book on how people can protect themselves from scammers, recommends the “three M’s”– minimize, monitor and manage. Minimize your risk by being alert about phishing scams, including ones that might appear to be your bank warning you of a security breach. Instead of answering the caller’s questions, hang up and call your bank back to make sure the person you were speaking to was really one of their representatives. People can protect themselves from scammers using the “three M’s”– minimize, monitor and manage. Other tips: create strong passwords, use two-factor authentication when possible and don’t use real facts on your security questions. “When security questions pop up, all that matters is your answers are consistent,” Levin said. In the case of this potential attack, your information may have already been stolen, so it’s on to step number two: monitor. Levin said people should always keep a close eye on their accounts and sign up for account monitoring services that banks often provide for free. Then, mitigate your damages. Again, banks often have programs in place to help reduce the harm to their customers, but customers often have to take the lead and ask about what their options are for getting their money back and resecuring their accounts. Customers “shouldn’t be on the hook, but that doesn’t mean it won’t be a huge hassle,” Rasch said. What banks can do When it comes to financial institutions, they need to train their employees to be mindful of attempted attacks. “This has to be an ongoing discussion, every minute of every day,” Levin said. They should keep software up to date, patch any vulnerabilities as soon as possible and test their systems often. “In cybersecurity, you can never take a victory lap,” Levin said.<doc-sep>The FBI is warning banks that a large cyberattack is coming, and criminals are expected to exploit a vulnerability in ATMs to steal millions or billions of dollars over the next few days. According to the FBI, this attack is expected to be global in scale and could target any of a number of different banks. “The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days,” reads the FBI alert. The FBI first became aware of this possible attack when hackers started using it to target small banks around the world. The hackers uploaded malware to bank systems that allowed them to edit customer accounts at will, giving them the ability to withdraw effectively unlimited money from ATMs. Since then, the FBI has issued a warning to multiple banks around the country, although the agency never notified the public directly. The security blog Krebs on Security recently published the text of the warning publicly. "Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cyber security controls, budgets, or third-party vendor vulnerabilities,” said the FBI alert. “The FBI expects the ubiquity of this activity to continue or possibly increase in the near future." The FBI warning also comes with several tips for banks to prevent them from being targeted, including limiting the number of administrative accounts, monitoring network traffic for vulnerable applications or encrypted traffic, and only allowing trusted applications to be installed on their networks. Source: Krebs on Security This content is created and maintained by a third party, and imported onto this page to help users provide their email addresses. You may be able to find more information about this and similar content at piano.io<doc-sep>Consumers can be the front line of defense to prevent cybercriminals from committing multi-faceted heists called ATM cash-outs, where thieves simultaneously withdraw millions from scores of banks. ATM cash-out schemes are nothing new – they've occurred for a decade or longer – but have become a focus again after the Federal Bureau of Investigation issued an alert to banks last week about a new impending global threat. An operation in which India's Cosmos Bank lost about $13.5 million (944 million rupees) in a wave of synchronized withdrawals across 28 countries last weekend fits the criteria, but institutions can never truly lower their guard. Bank customers can help by notifying their bank if something has gone wrong with their own accounts, said Ryan Kalember, senior vice president for cybersecurity strategy at Proofpoint, a security firm headquartered in Sunnyvale, California. More:Banks on alert from FBI about potential 'unlimited' ATM heist worth millions Organized crime gangs attempt to pull off an ATM cash-out by defrauding a bank or financial institution on multiple levels. First, cyber criminals find an in-road into the company so they can manipulate ATM transaction monitoring programs. Next, they create fake bank cards by using data from the infiltration and, at a pre-determined time, deploy people to use the fake cards at scores of ATMs, while simultaneously lowering the institution's defenses to allow the transactions. While banks deploy sophisticated cybersecurity measures, the coordinated attacks are engineered on several levels and typically focus on a weak link in banking systems: employees. "If you can find the right person in the bank who has access to a particular system ... you just have to target that specific person, understand how they work, understand what they are likely to click on and then trick them into doing that," Kalember said. Once the cybercriminals have the opening into the bank's systems, they use malware and other hacking efforts to gain the necessary controls. When the time comes to commit the heist, "they instruct the foot soldiers who have all those cloned cards to start hitting the ATM machines, and they take down the (bank's) velocity and volume controls so they are able to withdraw a lot of money in a short amount of time," said Ron Schlecht, founder and managing partner of BTB Security, a cybersecurity consulting and monitoring firm with offices in Philadelphia, Chicago and Austin, Texas. Schlecht expects these coordinated attacks that involve cybersecurity breaches and action in the real world are "going to continue to happen," he said. But consumers can help out. For starters, close any accounts you don't need or don't access regularly. Cyber attackers target accounts with low activity levels when they have infiltrated a bank's network and may transfer the account information to the fake ATM cards. Also, regularly check your bank accounts for unusual activity, such as a transfer to a prepaid debit card. If any emails arrive from your bank that seem out of the ordinary, do not click on them. Instead, go to your bank's website and log in for messages there. Use two-factor authentication – where you confirm your identity with a one-time code, often sent via text – and if your bank doesn't offer that, "you should ask them to," Kalember said. Should you be unlikely enough to get caught up in such a heist, the FDIC protects your account, "but an attack like this can certainly be disruptive," he said. Consumers will pay more in banking fees as institutions absorb the losses and cybersecurity costs. "This type of fraud scheme does trickle down and eventually affects all of us," Schlecht said. Follow USA TODAY reporter Mike Snider on Twitter: @MikeSnider.<doc-sep>NEW A vastly improved search engine helps you find the latest on companies, business leaders, and news more easily.<doc-sep>
The Federal Bureau of Investigation has warned banks in the U.S. of an impending cybercrime, a heist called an "ATM cash-out," in which thieves seek to swipe millions of dollars by using cloned ATM cards for fraudulent withdrawals. This globally organized effort could be instigated soon, the FBI told banks Friday, with cybercriminals attempting to amass millions of dollars within a few hours, according to the confidential alert obtained by security researcher Brian Krebs. “The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days, likely associated with an unknown card issuer breach and commonly referred to as an ‘unlimited operation,’ ” the alert said, Krebs reported on his blog. In an unlimited operation, cybercriminals deploy malware to obtain bank customer card information and network access in a way to execute massive ATM thefts, the FBI said, according to Krebs. “Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cyber security controls, budgets, or third-party vendor vulnerabilities,” the FBI's alert said. “The FBI expects the ubiquity of this activity to continue or possibly increase in the near future.” More:Stagnating salaries: Real US wages are essentially back at 1974 levels, Pew reports More:Home prices: Even midsize cities are getting pricey, leading some buyers to smaller markets More:Tinder founders sue IAC for billions claiming company 'robbed' them of stock options The FBI, which would not comment on the specific alert, said in a statement: "The FBI routinely advises private industry of various cyber threat indicators observed during the course of our investigations. This data is provided in order to help systems administrators guard against the actions of persistent cyber criminals." Organized crime gangs typically hack into a bank or payment processor to remove fraud controls, such as maximum withdrawal amounts and limits on number of daily customer ATM transactions, Krebs says. Account balances and security measures within the institution are altered to make an unlimited amount of money available at the time of the illegal transactions. To commit the crime, cyber criminals create fake bank cards by imprinting stolen credit card data on blank magnetic strip cards, the FBI said. "At a pre-determined time, the co-conspirators withdraw account funds from ATMs using these cards,” the agency said. Most ATM cash-out operations happen on weekends, usually just after the close of business Saturday, Krebs said. A heist that occurred over the weekend in India could be the operation the FBI had warned of. India's Cosmos Bank lost about $13.5 million (944 million rupees) in a wave of simultaneous withdrawals across 28 countries, Reuters reported. Another example of an apparent unlimited operation resulted in the National Bank of Blacksburg in Virginia losing a total of $2.4 million in two separate ATM cash-out operations between May 2016 and January 2017, Krebs reported. In that incident, a phishing email led to malware on a PC and the compromise of a computer at the bank that had access to Star Network, a debit card payment system run by First Data, which managed customer accounts and their use of ATMs and bank cards, Krebs said. Hackers then disabled and altered anti-theft and anti-fraud protections, including four-digit PIN numbers and daily withdrawal limits. During one breach that began on May 28, 2016, and continued through Memorial Day, hackers got more than $569,000 from hundreds of ATMs across North America. The FBI gave banks several security recommendations to combat any potential threats such as requiring strong passwords and two-factor authentication with a physical or digital token for critical employees. Consumers should remain vigilant, said Paul Benda, senior vice president of risk and cybersecurity policy at the American Bankers Association. "They should be signed up for fraud alerts on their account. They should be monitoring their accounts for activity, and they should look for any unusual activity," Benda said. "If they see anything they should report it. A bank would much rather hear about a potential fraudulent charge that turns out to be something that you don’t remember buying versus not hearing about that at all." Should a customer lose something from their account as part of a crime such as an "ATM cash-out," he said, "the bank is going to make you whole." Follow USA TODAY reporte r Mike Snider on Twitter: @MikeSnider.