Hackers steal $2M from Citi ATMs

Citibank ATM breach reveals PIN security problems - Jul. 2, 2008

SAN JOSE, Calif. (AP) -- Hackers broke into Citibank's network of ATMs inside 7-Eleven stores and stole customers' PIN codes, according to recent court filings that revealed a disturbing security hole in the most sensitive part of a banking record.

The scam netted the alleged identity thieves millions of dollars. But more importantly for consumers, it indicates criminals were able to access PINs - the numeric passwords that theoretically are among the most closely guarded elements of banking transactions - by attacking the back-end computers responsible for approving the cash withdrawals.

The case against three people in U.S. District Court for the Southern District of New York highlights a significant problem.

Hackers are targeting the ATM system's infrastructure, which is increasingly built on Microsoft Corp.'s (MSFT, Fortune 500) Windows operating system and allows machines to be remotely diagnosed and repaired over the Internet. And despite industry standards that call for protecting PINs with strong encryption - which means encoding them to cloak them to outsiders - some ATM operators apparently aren't properly doing that. The PINs seem to be leaking while in transit between the automated teller machines and the computers that process the transactions.

"PINs were supposed be sacrosanct - what this shows is that PINs aren't always encrypted like they're supposed to be," said Avivah Litan, a security analyst with the Gartner research firm. "The banks need much better fraud detection systems and much better authentication."

It's unclear how many Citibank customers were affected by the breach, which extended at least from October 2007 to March of this year and was first reported by technology news Web site Wired.com. The bank has nearly 5,700 Citibank-branded ATMs inside 7-Eleven Inc. stores throughout the United States, but it doesn't own or operate any of them.

That responsibility falls on two companies: Houston-based Cardtronics Inc. (CATM), which owns all the machines but only operates some, and Brookfield, Wis.-based Fiserv Inc. (FISV, Fortune 500), which operates the others.

A critical issue in the investigation is how the hackers infiltrated the system, a question that still hasn't been answered publicly.

All that's known is they broke into the ATM network through a server at a third-party processor, which means they probably didn't have to touch the ATMs at all to pull off the heist.

They could have gained administrative access to the machines - which means they had carte blanche to grab information - through a flaw in the network or by figuring out those computers' passwords. Or it's possible they installed a piece of malicious software on a banking server to capture unencrypted PINs as they passed through.

What that means for consumers is that their PINs were stolen from machines that showed no signs of tampering they could detect. In previous PIN thefts, thieves generally took steps that might draw notice - sending "phishing" e-mails, for example, or installing false-front keypads or even tiny cameras on ATMs.

Getting the PINs is a key step for identity thieves. It lets criminals encode stolen account information onto blank ATM cards and withdraw piles of cash from compromised accounts.

Click here to read entire article: Citibank ATM breach reveals PIN security problems - Jul. 2, 2008

Blogged with the Flock Browser

"Free Checking" Accounts, Not So Free

From EarthTimes.org

Banks Reap Huge Profits From Overdraft Fees on 'Free Checking' Accounts

Posted : Mon, 19 Nov 2007 18:31:49 GMT
Author : California Reinvestment Coalition

SAN FRANCISCO, Nov. 19 /PRNewswire-USNewswire/ -- Banks are robbing their customers blind with overdraft fees. It is modern day usury to allow customers to spend money they don't have and then charge them excessive fees without their consent, as banks do with overdraft fees. The California Reinvestment Coalition (CRC) released a report today that reveals how the complicated and deceptive overdraft policies at California's biggest banks allow them to reap huge profits from their mostly working class account holders.

"The free checking accounts that banks advertise are not really free. Customers are lured into debt traps by being allowed to use their debit/ATM cards even when there is no money in their account," says CRC Senior Policy Advocate Rhea Serna.
Click here to read more.

By using IPM pre-paid, stored value cards instead of bank accounts, unknown fees can be avoided.

Cross-Border Banking

From U.S. Federal Reserve Bank of New York

Customers who bank with U.S. depository institutions enjoy some of the best and strongest consumer protection laws and deposit insurance available in the world. These safeguards include laws and regulation designed to ensure that:

Interest rates charged for loans or paid on deposits are explained truthfully and clearly
Bank deposits are insured

Personal and confidential information is used and handled appropriately
Depository institutions are managed in a safe and sound manner and in full compliance with applicable federal and state laws and regulations

If U.S. banks and depository institutions fail to adhere to laws and regulations to protect depositors, you can file complaints with federal or state regulators.

The open nature of the Internet makes it easier for you to get information on financial products and services offered by banks and financial institutions from around the country and the world. Thus it is important to remember that if you do business with institutions outside the United States:
Your transactions may not be protected by United States or state laws or regulations, and your deposits may not be insured
Instead, the laws and regulations of the foreign bank's home country may apply
Consequently, it is wise to know a foreign bank's reputation before you decide to open an account or purchase financial products or services. This includes learning where the institution is located or chartered and what kinds of consumer protection, if any, the bank's home country offers.

Most banks provide information on their Web site about where they are located and how to contact them by telephone, in person, or by postal mail. Do not hesitate to contact them if you still have questions about consumer protections after reading on-line materials.

Remittances, Free Trade and Cross-Border Banking

From AOL Money and Finance via PR Newswire.

DALLAS, Aug. 20 /PRNewswire/ -- Remittances to Mexico, free trade and cross-border banking are the focus of the Federal Reserve Bank of Dallas' latest issue of Southwest Economy. Find the July/August issue online at http://www.dallasfed.org . Lower money-transfer costs and better measurement techniques likely explain the post-2000 growth in remittances from the United States to Mexico, according to Dallas Fed assistant economists Jesus Canas and Roberto Coronado and senior economist and policy adviser Pia Orrenius.

In "Explaining the Increase in Remittances to Mexico," the authors assert that the growth in the Mexican migrant population and their income alone can't account for the increase in remittances.

"Real remittances grew 170 percent from 2000 to 2005, but in the U.S., the Mexican-born population grew only 20 percent," they write.

Instead, they find that more migrants are turning to formal channels to send remittances due to reduced fees and that the Banco de Mexico has modernized procedures for collecting and recording remittance data.

"Spurred by declining costs for both senders and receivers, migrants increasingly have been transmitting remittances through formal channels rather than informal channels, such as carrying cash back home," according to the authors.

Many Americans get only the protectionist viewpoint on free trade, says Blake Hastings in this issue's "On the Record" conversation. "They rarely hear how protectionism distorts the economy, leads to higher prices, breeds mediocrity in service and product quality, and reduces variety," says Hastings, vice president in charge of the Dallas Fed's San Antonio Branch and former executive director of the Free Trade Alliance in San Antonio.

Hastings points out that South Texas cities, including San Antonio and McAllen, are reaching out to China, Brazil, Canada and Europe for trade opportunities. "All these communities are learning that you can't just wait for trade to come to you," he says.

In "Banking Industry Evolution Along the Texas-Mexico Border," economic analyst Joaquin Lopez and senior economist and policy adviser Keith Phillips review presentations from a recent Dallas Fed conference, "Cross-Border Banking." They report that as opportunities for banking increase along the border, the divide between U.S. and Mexican financial systems will continue to fade.

Speakers at the conference included Dallas Fed international financial analyst Edward Skelton, who said that explosive growth in the securitization and mortgage market in Mexico will boost the nation's economy by encouraging higher-quality housing, increased savings and greater wealth creation. SOURCE Federal Reserve Bank of Dallas

Go Green with Your Green

From the Payroll News Wire and the American Payroll Association.

Click here to watch video or listen to audio in several formats.

"Don't have a bank account? Ask your employer to pay you with a paycard." Getting paid electronically is not only quicker and more convienient, it can also help save the environment.

Every year, more than 146 million workers in America receive a paycheck. That's more than 3.5 billion paychecks per year. For many employees, a trip to the bank on payday is a favored tradition. But that innocent trip to cash your check costs more than just wasted time. In fact, the way you're paid could be damaging the environment.

Most American companies offer a number of free and easy ways to make how you're paid more environmentally friendly. The American Payroll Association offers these tips to "go green with your green."

Direct deposit – Only 71% of workers in America take advantage of this "green" payment method. When you sign up to receive your paycheck electronically via direct deposit, your pay goes straight into your bank account. No waiting in line at the bank drive-thru, idling your car and releasing dangerous ozone-depleting emissions. Plus, your money is always there on payday, even when you're on vacation.

Paycard – Don't have a bank account? Ask your employer to pay you with a paycard. You'll get the same conveniences and "green" benefits as with direct deposit. Your pay will be deposited into an account that's accessed by a pin protected card, similar to an ATM card. You can use the card to make purchases, get cash back at retailers and withdraw money from an ATM. Plus, no more paper as you can keep track of your pay online.

IRS e-file - This IRS program provides a way for many workers to file their income tax using a paper-free method. In fact, 70% of workers can have their taxes prepared and filed completely free using e-file! Use this "green" method to file your tax return and you will get your tax refund weeks faster. Additionally, you can choose to get your refund sent directly into your bank account via direct deposit, saving paper, stamps and delivery costs.

Direct deposit, paycards and IRS e-file are all easy, safe, secure and environmentally friendly. For more information on how you too can go "green" with your green, visit www.nationalpayrollweek.com.

Prepaid Cards: The State of the Industry

Hat Tip: Bobsguide.com

Boston, MA - 23 July 2007

Aite Group expects the value of branded and private label prepaid card transactions to amount to US$178 billion by 2010, up from US$113 billion in 2007.

A new Impact Report from Aite Group sizes and forecasts the evolution of the prepaid card industry in the United States. It examines the key trends impacting each major component of the industry value chain.Among key findings, the report reveals that despite rapid industry growth, gaining scale in branded prepaid card processing remains a major challenge for processors and issuers. The report also indicates that the introduction of reload services for branded and private label prepaid cards, the drive to offer private label prepaid card products to small merchants, and the deep integration of branded and private label prepaid cards into various industries' business processes are today's three major trends reshaping the industry.
"In the coming few years, the concept of prepaid will grow increasingly irrelevant as it becomes ever-more successful," predicts Gwenn Bézard, research director at Aite Group and author of the report. "Over time, the subtle distinctions between the various card products, such as debit versus prepaid versus credit, and branded versus private label, will erode as products grow in diversity and complexity and mesh together. By the middle of the next decade, the prepaid card industry will have ceased to exist as a recognizable entity."

Anti-laundering compliance costs mount

Hat Tip: Washington Post


By MADLEN READ
The Associated Press

NEW YORK -- Complying with anti-money laundering laws has been much more expensive than banks anticipated, and some still aren't meeting all requirements, a new survey says.
Banks around the world saw compliance costs jump an average of 58 percent over the past three years _ more than in the previous three years, and higher than the 43 percent increase banks predicted in 2004, said a survey commissioned by Swiss cooperative KPMG International.

Among the six regions surveyed, North American banks saw the highest percentage cost increase, with costs rising 71 percent over the last three years. The Middle East and Africa region was close behind with a rise of 70 percent. Banks' compliance costs rose 58 percent in Europe; 37 percent in Asia; 59 percent in Central and South America; and 60 percent in Russia.
Most of the money went toward buying technological systems and hiring experienced personnel to monitor transactions, said the KPMG report, which did not measure the dollar value of the costs.

"A lot of institutions were not automated to the degree regulators were expecting them to be," said Teresa Pesce, U.S. partner at KPMG's forensic practice.

North America respondents said they predict a cost increase of 28 percent in the next three years. Globally, costs are expected to increase 34 percent in the next three-year period.
Many governments require that banks take steps to prevent money laundering. Money laundering involves making certain financial transactions to hide the source, nature or destination of illegal funds. The United States has the Bank Secrecy Act, which was passed in 1970 and amended by the USA Patriot Act of Oct. 26, 2001. It has since been used increasingly to stop the flow of financing to terrorist organizations.

According to KPMG's survey, 93 percent of North American respondents said they had a formal system in place, meaning 7 percent of banks were not in compliance with the Act's testing requirements.

Noncompliance can be costly.
Last year, Fort Lauderdale-based BankAtlantic agreed to forfeit $10 million to the U.S. government to avoid criminal charges that it permitted millions of dollars in suspected drug money to be laundered through its accounts.

And in 2005, Riggs Bank, now owned by Pittsburgh-based PNC Financial Services Group Inc., agreed to pay a $16 million fine and pleaded guilty to a felony charge of failing to report suspicious transactions involving foreigners including former Chilean dictator Augusto Pinochet and members of his family.

Despite the possible ramifications, just 63 percent of the survey's North American respondents said anti-money laundering issues were a high priority for senior management.

Independent research agency RS Consulting surveyed 224 of the world's 1,000 largest banks, in 55 countries, through telephone interviews over a six-week period.

Ninety-five percent of North American banking executives surveyed said the number of suspicious activity reports had increased, and 63 percent of those same executives said the number had increased "substantially."

"The better your systems are, the better your monitoring is, the more you'll see _ that's going to drive up the number to some extent," Pesce said.