Category: Crime & Fraud

Is more e-crime actually identity crime?

7th September 2010by Consult HyperionLeave a comment

[Dave Birch] I was kindly invited along to a breakfast briefing on e-crime by the folks at International Business Wales. They are trying to develop the financial services business in Wales by bringing together business, academia and government to create a more effective infrastructure. Obviously, financial e-crime threatens this sort of development, so I can see why they would be interested in finding ways to avoid it. Naturally, I was mainly interested in the payments-related parts aspects of the discussion, but I was generally curious about the topic as a whole. Before I reflect on the presentation, an aside on the topic of financial e-crime. There's no doubt that financial e-crime is on the rise the world over: here is one just one case chosen almost completely at random:

Criminals have stolen more than $479,000 from a Pennsylvania housing development authority after infecting its computer system with the notorious Clampi Trojan. The crime is the latest in a rash of heists from small business banking users in the US, which has led some industry bodies to suggest radical lock-down procedures for companies banking online.

According to local press reports, the Trojan was installed through a fake Web site purporting to belong to Cumberland County Redevelopment Authority's bank, M&T.

Once installed, Clampi stole passcodes which were used to transfer the money to bank accounts set up by the hackers at 11 different financial institutions. About $109,000 has been recovered since the money was taken on 22 September.
[From Finextra: $479,000 heist from small business bank account lends weight to calls for online banking 'lock-down']

This is clearly recognisable e-crime, but there are many other forms. In the UK, the probably biggest single category of business fraud is VAT carousel fraud. Is this an e-crime or not? Even though the crime is perpetrated using computers, I wouldn't call it an e-crime, since exactly the same crime could be carried out in exactly the same way without computers. What about credit card fraud? That clearly needs computers to execute at scale, but again I wouldn't really call cloning magnetic stripes "e-crime". I'd give card fraud its own category.

Police in 12 countries have arrested 178 people accused of involvement in an international credit card cloning ring that is believed to have netted crooks around EUR20 million. According to the Spanish Interior ministry, the arrests come after a two-year investigation that culminated in 84 raids in Spain, Italy, Romania, France, Germany, Ireland, Sweden, Greece, Finland, Hungary, the US and Australia.

The raids turned up 11 cloning 'laboratories' with around 120,000 card numbers and 5000 fake cards found in Spain alone.
[From Finextra: Card cloning raids net 178 arrests]

What? $20m? That's peanuts. Some guy was just indicted for a fraud fifty times bigger than that.

Former South Florida lawyer Scott Rothstein was sentenced to 50 years in prison for using his law firm to run a $1.2 billion Ponzi scheme that financed a lavish lifestyle, bankrolled his firm and bought political influence.
[From Rothstein Gets 50 Years for $1.2 Billion Fraud (Update3) – BusinessWeek]

Card fraud is so last year. But on to the report.

Continue reading “Is more e-crime actually identity crime?”

Prepaid preconceptions

24th August 2010by Consult Hyperion3 Comments

[Dave Birch] I've been involved in a few discussions about prepaid cards over the last couple of weeks. One of those discussions was about whether some prepaid products would remain viable under stricter regulatory conditions. Why would regulators want to increase the regulatory burden, and therefore cost, of products aimed at the unbanked? Well, in the US, prepaid cards are the focus on attention because of their supposed criminal use.

The "Stored Value Device Registration and Reporting Act of 2010" will close a loophole that has treated stored value cards differently than cash, money orders and traveler's checks..

Money stored in electronic devices would be considered the same as currency for regulatory purposes. Prepaid cards, cell phone chips and other electronic devices would be covered.

Stored value devices loaded with more than $10,000 would have to be registered with the Treasury Department.

The flow of money via stored value devices would be tracked. "There's no current data on how stored value devices are currently used" to smuggle funds, said Giffords.

[From Bills aims to snip cash-card money smuggling | Border]

Well, I'm sure there's lots of data on how stored-value is used, but it is of course private and the issuing banks would of course need a warrant to give it up. But I'm still curious to know whether criminal masterminds really are using prepaid cards instead of cash. My O2 Money card, for example, has a maximum balance of five hundred pounds unless you go through KYC/AML in which case it goes up to ten grand. So what criminal mastermind would want twenty O2 Money cards rather than a hundred $100 bills or twenty €500 notes? The article specifically mentions drug cartels, but when the police bust the Mr. Bigs, they don't find prepaid cards, they find cash.

"Don't trivialize this by calling these gift cards," Goddard said. "These devices can hold hundreds of thousands, if not millions of dollars."
[From Bills aims to snip cash-card money smuggling | Border]

No, they can't. The maximum you can put on a typical US prepaid card with going through KYC is $500-$1,000. But a drug-running master criminal might decide to get a hundred card and put $1,000 on each of them I suppose. Let's take a look at what we find in their treasure hoards.

The arrest of more than 2,200 persons and seizure of 74 tons of illicit drugs in 18 states in a massive nationwide undercover investigation by federal, state and local authorities has revealed that Mexican drug smuggling organizations are well entrenched in the United States… the operation accounted for $154 million in cash, 1,262 pounds of methamphetamine, 2.5 tons of cocaine, 1,410 pounds of heroin, 69 tons of marijuana, 501 weapons and 527 vehicles.
[From Massive bust nets suspects, drugs in 18 states – Washington Times]

But not, apparently, prepaid cards. Similarly, these ice men clearly prefer greenbacks to Starbucks' cards.

Authorities confiscated more than $200 million in U.S. currency from methamphetamine producers in one of this city's ritziest neighborhoods, they said Friday, calling it the largest drug cash seizure in history… Mexican officials said the cash seized was mostly in U.S. $100 bills and weighed at least 4,500 pounds.
[From Mexico meth raid yields $205 million in U.S. cash – latimes.com]

That's TWO TONS OF CASH. I suggest that the Senate turns its attention to the abolition of the $100 bill rather than imposing cost and inconvenience on my kids US$ "Cash Passport" cards that they have with them on vacation in California. Some more people who don't read my blog about the benefits of electronic payments over cash were uncovered last year.

Federal agents have rounded up more than 750 suspects in a wide-ranging crackdown on Mexican drug cartels operating inside the United States… The DEA seized more than 23 tons of marijuana, cocaine, heroin and methamphetamines; plus dozens of planes, boats and cars; more than $63 million in cash; and scores of weapons in the operation.
[From Feds Bust 750 In Mexico Cartel Crackdown – CBS News]

No mention again of their Sears gift cards or Walmoney. And, as an aside, the guy who owned the house that had the $200m in cash in it? He actually had $340m, most of which he spent in Las Vegas apparently, where the casinos assumed that he was legitimate businessman — his mistress paid a million dollars in cash for an apartment, shouldn't that ring some alarm bells? — unlike those Canadian casinos where the real criminals go to launder money.

Money laundering by organized crime groups is rampant at Canadian casinos but police are essentially doing nothing to combat it… "Since 2003, FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) has sent several disclosure reports to the RCMP on suspicious transactions involving casinos throughout Canada, with amounts totalling over $40 million," the 2009 report states.
[From Money laundering thrives at casinos: Report]

Come on. Prepaid cards don't make the slightest difference to criminals, tax evaders, drug smugglers or executive expense chats. But making them more expensive and more inconvenient does make a difference to people who are excluded from the financial system.

Continue reading “Prepaid preconceptions”

Who to trust?

5th August 2010by Consult Hyperion1 Comment

[Dave Birch] I’ve been involved in some involved discussions about an involved topic: trust (again). It happens that a number of the projects that Consult Hyperion is currently working on include implementing trust infrastructures in both private and public sectors. Now, we’re not alone in thinking that this is a big deal.

Newmark called some form of distributed trust system “the killingest of killer apps” for the web over the next decade (he said he wasn’t sure that was the best way to describe it, but was trying out to see how it sounded). He talked about “reputation and trust ruling the web, just the way it does in real life,”
[From Craig Newmark on the Web’s Next Big Problem – GigaOM]

Do they rule real life? Consider the transactions that I’ve made so far today. I took a bus — no trust required, I paid with cash — and then bought a train ticket — chip and PIN, so no trust in me required — and went to a couple of meetings — we’ll come back to this in a minute — took the train home — no trust in me required since I had a ticket — and then took the bus home — no trust in me required since I had a ticket.

crime and fraud, identity, management

Continue reading “Who to trust?”

Lolly Dolly

23rd July 2010by Consult HyperionLeave a comment

[Dave Birch] I was leafing through the English newspapers on the plane the other day — the usual kinds of thing, you know, men out on charity walk attacked and hospitalised by drunken yobs, public worker gets £80,000 payoff because new chairs cause backache, 18,000 Facebook tributes to murdering nutter and so on — but it was the story of the thieving Air France stewardess that caught my eye. The light-fingered trolly dolly was arrested for stealing from sleeping first-class passengers. Her preferred pilfering plane route was Paris-Tokyo, apparently because Japanese tourists carry huge wads of cash around with them and, like any self-respecting criminal, she wanted cash.

Police have arrested French air stewardess Lucie R. (her identity is protected) in Tokyo on suspicion of stealing from First Class Air France passengers while they slept.
[From France24 – Air France stewardess stole from passengers while they slept]

Incidentally, I loved Air France’s comment on this story, which was to say that only checked baggage is their responsibility and that theft from the cabin was a matter for travel insurance. Or, in English, “tough”.

Continue reading “Lolly Dolly”

The hole in the wall

20th May 2010by Consult HyperionLeave a comment

[Dave Birch] I’ve been thinking about ATMs this morning because of the news that

the man credited with being the inventor of the world’s first hole-in-the-wall cash dispenser has died in hospital following a short illness. John Shepherd-Barron… died at Inverness’s Raigmore Hospital on Saturday, at the age of 84.
[From BBC News – Inventor of cash machine, John Shepherd-Barron, dies]

It’s astonishing, really, how quickly the ATM permeated society. Today it is taken for granted. But will it be around for long? There are some signs that the days of the ATM are waning.

SIGNS are emerging that Australia is moving towards a cashless society, with the number of consumers making ATM cash withdrawals dropping to the lowest point in more than six years.
[From Cash transactions on their way out | The Australian]

I shouldn’t think the ATM manufacturers are throwing themselves off of buildings just yet. So long as people continue to use cash, the ATM is here to stay, and despite the best efforts of e-payment fanatics such as yours truly, they’re going to be here for some time. But that wasn’t what I was thinking about, because I’m in the middle of doing some work on trends in security technology for one of our UK customers, so what I was thinking was that ATMs will remain a focus for attack: the bad guys know that there is where the money is too.

Continue reading “The hole in the wall”

Cash does have some unique properties

10th May 2010by Consult Hyperion2 Comments

[Dave Birch] The cost of cash isn’t only the cost of the notes and coins, the ATMs and armoured cars, the night safes and counting machines. It’s the lack of efficiency in the economy that goes with it. And economies that are stuck with cash are the worst off. So how much does cash cost in a developing economy? I happened across this figure while I was looking for something else in connection with a project that we are working on.

“The total cost of cash handling in Indonesia is Rp 6.13 trillion a year,” she said.
[From More consumer purchases made in cash | The Jakarta Post]

It’s hard to work out by calculating adjusted GDP and historic exchange rates, but I reckon this is about 0.5% of GDP, which is comparable to the UK. Considering that over 90% of all Indonesian retail transactions are in cash, this seems low to me, but who knows. Anyway, in discussion with someone else today, another point emerged. The real hidden cost of cash in developing countries is corruption.

A friend of mine just got shaken down by the Kenyan police in an excellent new scam. Watch out for this one next time you go to Nairobi! He got a approached by a man who wanted to talk to him: my friend ignored him and carried on walking down to the street. A few metres on he was stopped by two policemen who said that they had just seen my friend talking to someone who was a known terrorist and that they were going to arrest him and he would get five years in jail. Unless, that is, he could pay the fine for talking to known terrorists, which in Kenya is apparently $300. My friend was marched back to an ATM (the policemen were very specific that it had to be a Barclays ATM, connected to the Visa network) to get the money. If only, I thought, he had had been using the excellent M-PESA mobile money transfer! Then he could have paid the fine on the spot. That would have been much more efficient.

Continue reading “Cash does have some unique properties”

Will mobile phones mean more crime?

9th May 2010by Consult Hyperion1 Comment

[Dave Birch] There was a discussion at this year’s Digital Money Forum with David Nordell from the Terror Finance blog. He called mobile payments a terrorist’s dream, but I disagreed. People always see the worst in new technologies, projecting existing crimes on to it. But the ability of new technology to fight crime is surely just as great. Mobile phones are no different from any other technology in that respect. One the one hand mobile phones can be used to commit new crimes, but on the other hand they can be used to prevent, detect and solve crimes.

Recently, two death row inmates were arrested in Nakuru GK Prison after being tracked through the assistance of mobile services firm Safaricom. More than 10 mobile phones and a number of SIM cards that were used to transact more than Sh300,000 were confiscated. The inmates colluded with people outside the prison to provided them with phone numbers of wealthy people who they called and threatened with death if they did not follow orders. Police launched investigations into how the convicts had separately received Sh350,000 and Sh40,000 in their welfare accounts when the racket that was unearthed in February.
[From Daily Nation: – News |Police probing mobile money transfer racket]

Nice mobile payment application — call people up, get them to send money back via the mobile payment system — but only if you’re a really stupid criminal, since the phone company knows where you are and will tell the police. And the police will be able to track you, and they will know the details of anyone else you call. And it doesn’t matter if it’s a prepaid phone not registered to you, because knowing where you are and who you are calling is pretty useful information.

The tracking is especially useful and in the future we will come to accept that we know where stuff is, all the time. As an aside, this doesn’t mean the end of privacy, but I think it does mean new notions of privacy.

Within seconds, a Tampa map appeared with a blinking orange dot moving away from the park. “We’re thinking to ourselves, there are our cell phones going down the road,” Jennifer Jensen said. The dot left the park, headed down McKinley Drive, headed south of Fowler Avenue and stopped less than 4 miles away from where it started… Caroline switched to satellite mode, and they were suddenly looking at the outside of the Bentley Court Apartments, 11603 N 22nd St.
[From There’s an app for that, too — Tampa cops find stolen iPhones with GPS – St. Petersburg Times]

At one level, this is just a fun “there’s an app for that story”. But think about it more as a window into the “internet of things” future. When everything is connected to everything else across an infrastructure then the idea of stealing something will become outdated (although, to be fair, some idiots still rob banks with shotguns). What’s the point of getting into my car if you can’t drive it without my RFID keyfob, what’s the point of stealing my TV if it will only decode encrypted signals if it is in range of my router and what’s the point of running off with my mobile phone if it won’t allow you to make calls unless you can mimic my voice? And what’s the point of stealing any of them at all if I can log in to any computer anywhere in the world and see where they all are?

crime and fraud, identity, mobile

Continue reading “Will mobile phones mean more crime?”

Dog’s life

1st April 2010by Consult HyperionLeave a comment

[Dave Birch] There was a news story in the UK recently about the very sad death of a young woman who was lured to a remote spot by a man who met her on Facebook. The man was pretending to be a teenage boy. Facebook became the focus of the story, with the usual calls for something to be done. So is the sky falling in because of social networking?

You could just as easily argue that criminals are easier to catch because of Facebook, or any other new technology. The police can use them too, can’t they? Doesn’t social networking make it easier for the police and others to work together? Couldn’t Twitter help detectives? Can’t detectives subscribe to RSS feeds on cases of interest? (Frankly, I doubt it, but you get my point.)
[From 15Mb: yet another blog from Dave Birch » Blog Archive » The “Ford Mondeo Killer”]

People might think they’re anonymous, but they’re not. A rational policy on law and order would surely try to get more criminals to carry out their crimes online, because it’s easier to catch them in the virtual world than in the real one.

When a YouTube video came to its attention on Friday in San Francisco, the FBI had a Philadelphia man in custody the next day
[From How the FBI busted one YouTube nutjob in under a day]

It’s the same logic as with money laundering. If you raise high barriers by making people prove who they are before going online then they will either go to great lengths to avoid the rules (thereby enriching middlemen) or just avoid going online, in which case they cannot be tracked or traced at all. I wrote an article for SPEED (“Moving money and securities worldwide”) magazine’s Spring issue, noting that if criminals were to abandon suitcases full of 500 euro notes for platinum pieces in Everquest (frankly unlikely, but there you go) then surely it would be easier for law enforcement officers to masquerade as half-orc barbarians in Norrath than as criminals in the real world and therefore follow the money.

crime, identity, internet, management, social networking

Continue reading “Dog’s life”

Fit and counterfeit

24th December 2009by Consult HyperionLeave a comment

[Dave Birch] When the first Bank of England banknotes were issued in June 1694, they must have seemed pretty secure, with their fancy engraving and the handwritten signatures. It must have been a bit of a shock in August 1694 when the first counterfeits were detected. Or should I say that the first counterfeits bad enough to be detected were detected. One of the problems that plagued the Royal Mint at that time was that the machinery to make notes and coins was being stolen by corrupt employees and sold to the criminal underworld. The machines were not really producing counterfeits, because they were the same plates and dies as being used in the mint, they were producing unauthorised versions. Banknotes have evolved a bit since then, but given the regularity of the stories about North Korea “supernotes”, the counterfeiters have kept pace.

North Korea has been producing “super notes,” counterfeit 100-dollar bills practically indistinguishable from legal tender, even since 2007 when the U.S. released North Korea from financial sanctions. North Korea has also tried to bring some of the notes into South Korea.
[From Daily NK – Super Notes Still in Production]

There’s no need to get Korean ultraforgers on board so far as the new UK national identity card goes. In fact, our indigenous forgers have been doing an excellent job, selling first-class forgeries of the UK ID card even before the UK ID card existed. Why they are bothering is not entirely clear.

Darren McTeggart tried to use the £30 card to pick up a replacement credit card from a branch of Santander – formerly Abbey – in Manchester, where the scheme was rolled out on a voluntary basis last year. Mr McTeggart, one of the first people to get the card, said: “They said it was not on their list of approved ID.
[From Man can’t prove ID with ID card – Telegraph]

I’m sure this is just a hiccough. But how are indigenous ultraforgers creating their dastardly fake ID cards? Are they breaking into the government’s factories and stealing the chips? Have they got corrupt insiders working for them? Sadly, nothing that interesting. It’s apparently so easy to forge documents like this that the police are now asking the companies who sell printers to report suspicious customers, much as banks have to do when opening new accounts.

U.K. police are trying to get wider participation from printer manufacturers and makers of specialist equipment in a voluntary program designed to cut off criminals from the tools they need to make fraudulent passports and ID cards.
[From UK Police Engage Print Industry to Stop Fake IDs – PCWorld Business Center]

Oh come on. You can’t seriously tell me that criminals can just walk into PC World and buy printers that can produce a fake ID card? I don’t believe that for a moment. Oh, wait…

The Met has shut at least 20 [fake ID] “factories” in the last 18 months and believes more than 30,000 fake identities are in circulation. Police examined 12,000 of them and established they were behind a racket worth £14 million. One £750 printer was withdrawn from sale at PC World after detectives revealed it could produce replicas of the proposed new ID card and EU driving licences.
[From Police war on fake ID factories as fraudsters net millions | News]

Whoops. I’m sure this isn’t what former Home Secretary David Blunkett had in mind when he was outlined his plans for the national ID card way back whenever.

bugs and mistakes, digital identity electronic identity cards trust mobile, identity, management, social networking

Continue reading “Fit and counterfeit”

Imperfect crime

24th December 2009by Consult HyperionLeave a comment

[Dave Birch] Some years ago at the Digital Money Forum, Richard Bartle from the University of Essex characterised the economy of virtual worlds as “people buying things that don’t exist from people who don’t own them” which was, frankly, a brilliant summary. There are also, sadly, a class of people stealing things that don’t exist from people who don’t own them and this is a crime, so it was with great interest I read that

A British man has been arrested and cautioned for stealing accounts for online game Runescape… A statement from the Police National e-crime unit said: “A 23-year-old man was arrested in Avon and Somerset… on suspicion of a number of computer misuse offences.”… Once hi-tech thieves have these credentials they plunder the accounts, strip characters of their items and sell off the rare virtual goods for Runescape gold.
[From BBC News – Runescape creator pursues ‘phishing thieves’]

This is real identity theft. If criminals somehow get into my bank account and spirit the money away, I don’t really care because it’s the bank’s problem and they will give me the money back. But if the criminals take over my Runescape character, that’s a real personal violation. As I said before

a bank can easily restore my money, but it’s much harder for Facebook to restore my reputation (apart from anything else, a reputation takes time to build). Which is the worse crime?
[From Digital Identity Forum: What identity is important?]

It’s the latter, clearly. So perhaps the “standard” use case for strong authentication should be switched from logging on for home banking to logging on to Facebook, which takes us into the world of OAuth and OpenID instead of EMV and OTP. In this world, there’s already plenty of work going on around authentication, credentials and federation that could provide key portions of the infrastructure that we know that we are going to need in the mass market.

Continue reading “Imperfect crime”