The Hamilton Spectator
Monday, January 5, 1997
pages A1,A4

How secure is your cash?

An elaborate quarter-million-dollar fraud that operated out of Waterdown raises troubling questions about security in an electronic age.

by Barbara Brown

Doug Wylie no longer takes electronic banking for granted - not when it comes to his money.

Wylie, 39, admits he used to be less than diligent about balancing his chequebook.

But that was before a gang of high-tech bandits breached the security of his debit card and drained his chequing account of every last cent, and then some.

"I'm not using a debit card at all any more and I don't feel very good about using my credit card, either."

"I'm really questioning what this technology is actually doing for us. As far as I'm concerned, we're all at risk for this kind of fraud and we're not really giving it a whole lot of thought", said Wylie, an engineer.

In the last two years, counterfeiting of credit and debit cards has become a growth industry here and internationally.

Wylie and his wife, Judith McGill, 38, a freelance writer, were just two of more than 50 people duped by a small, slick counterfeit operation, which operated briefly out of a busy gasoline retailing business in Waterdown last summer and took five banks in the region for more than $250,000.

"Skimming", the street lingo for stealing encoded bank account numbers off magnetic-stripe cards, is seen by modern criminals as far less dangerous and more lucrative than your average bank robbery.

... continued on page A4

Robbed blind

Credit and debit card users targeted by techno-thieves who `skim' from accounts

All that's required is for an unscrupulous employee or merchant to collude with criminals by allowing them to set up illegal hardware.

They then discreetly double swipe your card, once for the legitimate purchase and a second time, using an unauthorized swiper that downloads the encoded information onto a laptop computer.

It's more difficult to steal encoded data from a debit card because its security can only be compromised if the thief learns the cardholder's personal identification number (PIN).

Banks urge customers to use their hand or bodies as a shield to prevent anyone from observing them keying in their secret code in a cashier's lineup.

There are two ways a dishonest retailer can obtain a customer's PIN. They could have a hidden camera in the store or an accomplice standing behind a victim in a lineup "shoulder surging", spying as the customer keys in their secret code.

Pirate plastic card

Once obtained in this way, an individual's confidential bank number can later be transferred to a pirate plastic card.

The knockoff is sold on the street or, in the case of pirated credit cards, may be distributed by the counterfeit ring to accomplices in other countries.

On a Saturday in September, an unsuspecting McGill stopped at an automated teller machine in Waterdown to withdraw some cash.

She was disconcerted when the ATM advised that the joint account she shared with her husband was overdrawn by nearly $1,000.

How could this happen? McGill had used the machine the evening before and nothing appeared amiss. She and Wylie racked their brains for some forgotten major expenditure.

When McGill attempted to use the ARM the following Monday, the machine had a more alarming message: "This account no longer exists."

McGill went in person Tuesday morning determined to straighten out the problem with their Bank of Montreal branch. That's when the couple learned their account - now overdrawn by the full $2,000 limit of their overdraft protection - had been frozen by the bank.

Wylie felt his "guts turn inside out". It didn't take a chartered accountant to tell him something was terribly wrong.

"My immediate reaction was, 'Wait a minute, somebody's got technology here and they're using it to drain my bank account.'"

Someone had made an "empty deposit", which means feeding the ATM an empty deposit envelope and then turning around and making a fraudulent withdrawal.

Bank staff were initially skeptical. Wylie says he could see it in their eyes and hear it in their words. They suspected him or McGill of being a closet spendthrift, maybe worse.

"They gave Doug the clear impression that couples did this sort of thing all the time to extend their finances when they were having a cash-flow problem", said McGill.

At the very least, bank staff suggested, Wylie must have been careless with his PIN, giving some sly operator the chance to steal from him. At this point, Wylie was being considered liable for the loss.

"They were very gracious in the end", Wylie said of his bankers, who eventually reimbursed him for the full $1,917 defrauded from his account.

But Wylie wondered if he would have got his money back so easily if lightning hadn't struck the same house twice.

One week later, McGill was notified by Visa Canada that her credit card had been found in the possession of a suspect being questioned by a distant police force on an unrelated matter. Visa called to say her card had been cancelled.

McGill was baffled and a little unnerved. Her credit card was tucked safely in her wallet and hadn't left her possession.

After further discussions with Visa and the Royal Bank of Canada, the mystery began to unfold. The couple learned they were likely the victims of a much larger fraud.

The Hamilton RCMP's commercial crime section was focusing on one specific Waterdown gasoline retailer as the point of compromise. All victims appeared to have done business there during August and September, paying for gas with either a debit or credit card.

RCMP Constable Jim Ogden has confirmed three suspects were questioned and later released. But no charges have been laid and the investigation is not expected to conclude for a couple more months.

Wylie was relieved to be acknowledged as a legitimate victim.

Banking records revealed his debit card had been used primarily in the Scarborough and Etobicoke areas on one weekend in September, including one transaction for $18 at an automated wicket of a Famous Players cineplex.

But there had been a couple of earlier fraudulent transactions for about $80 each, one in Winnipeg and another in Metro Toronto in August.

"I'm just speculating, but I think they used the (counterfeit) card that first time just to show the potential buyer how it would work", Wylie said.

"Two weeks later there was a blitz and they drained the account of almost everything we had. Then they put a blank envelope into the ATM and got even more money."

McGill said most of the money was drained from their account on a Saturday and Sunday between midnight and 12:30am.

Using the counterfeit version of Wylie's debit card, the thief took advantage of a small window of opportunity to withdraw the maximum daily limit for two consecutive days.

James Borowik of Waterdown learned the security of his Mastercard had been compromised when his card was declined, to his embarrassment, in front of business clients. Not long after he found out his limit had been exceeded because $5,000 worth of jewelry had been purchased in the United Arab Emirates on his credit card.

"A lot of people in Waterdown are talking about this, but I don't think it's well known enough yet", said his wife.

"Our own mayor, Ted McKeekin, was there cutting a ribbon at some kind of business appreciation ceremony at the same time as these crooks were being investigated by the police."

McKeekin was a bit sheepish, but unapologetic. Ironically, his family was also victimized by the counterfeit scheme. A duplicate of his credit card was found in the possession of a man arrested by police in the United States. Fortunately for the mayor, no fraudulent transactions had yet gone through on his credit-card account.

As for the business-appreciation ceremony: "That's true. I cut about two ribbons a week and I don't ask for character references", said McKeekin.

"I get invited to these things all the time. But, having said that, I wouldn't have accepted this invitation if I'd known about the investigation."

In an October interview, the owner of the business being investigated told The Spectator that when he heard about the allegations, he immediately suspended his staff and began running the operation himself.

"Nobody really knows what's going on at this point, or who is involved or responsible. There are only allegations, nothing has been proven", he said, declining further comment.

Credit card returned

Sandy Roberts, who works at a bank, is annoyed with herself for not cancelling her credit card the minute she heard rumours about a counterfeit ring operating out of a particular retail gas outlet.

"It was raining that morning and I didn't feel like pumping the gas myself, so I pulled in and had him fill the tank. I gave him my Visa card and he disappeared into the office."

Oddly, the attendant returned her credit card saying the purchase hadn't cleared because her card had been declined by the bank.

Roberts thought that strange, but reached inside her wallet and produced a second credit card to pay for the gas.

Two weeks later, the card that had been declined was hit with a dozen fraudulent transactions. Someone pretending to be Roberts had charged $960 worth of gas at one Niagara Falls gas station in a single day.

Roberts said her bank reimbursed her for all but $50, the amount which she was automatically liable according to the terms of her credit card contract with the issuing bank.

There were other reports of Waterdown residents whose cards had been used in Saudi Arabia to by $6,000 worth of shoes and thousands of dollars in satellite TV systems in the United Arab Emirates.

The banks eventually assumed the losses, with the Canadian Imperial Bank of Commerce losing more than $100,000 through 30 cardholder accounts. the Bank of Montreal's losses amounted to $50,000 and involved about 12 credit cards. The other big three appear to have lost about $100,000 between them.

The counterfeiters operated out of the gas station for a relatively short time and no further frauds have been reported since the initial onslaught.

The RCMP's Ogden said there appeared to be no connection between this operation and several recent arrests involving larger credit card frauds and organized crime rings in the Toronto area.

Metro Toronto police arrested four men in November and charged them in a counterfeit scam that netted as much as $1 million.

One fo the men, a fourth-year engineering student from the University of Toronto, was reportedly recruited for his technological expertise.

Then last month, the RCMP cracked a nation-wide counterfeit ring, arresting 12 people, including several alleged members of the Big Circle Boys, an Asian immigrant crime syndicate, and suspected collaborators with retail businesses.

The counterfeiters are accused of manufacturing thousands of fake credit cards, Canadian and U.S. currency, and bank cheques. The RCMP's commercial crime section in Newmarket believes millions of dollars were stolen and thousands of people victimized.

Corporal Gordon Jamieson said the counterfeiters are difficult to catch red-handed because their equipment, which is lightweight and portable, can be set up at a restaurant or gas bar and then be moved a couple of hours later to another location.

Merchants colluding with the counterfeiters reportedly receive up to $50 for each credit card or debit card they double swipe.

Catherine Johnston, president of Advanced Card Technology, a consultant in the electronic card industry, said credit card fraud topped $5 billion worldwide in 1996, with the bulk of it involving counterfeit cards.

According to the Canadian Bankers Association, Visa and Mastercard retail volume was $67.7 billion in 1995-96 and their combined losses from fraud was $83.6 million.

Paul Facciol, a security expert with the banker's association, said banks and financial institutions are continually developing new security measures to foil credit card counterfeiters, who began cropping up about two years ago. But Facciol stressed fraud and counterfeit have always been with us and will account for a small percentage of total transactions no matter what currency or payment system is being used.

Interac Association

Canadians are among the world's top users of debit cards. That's because with only a handful of banks operating nationally, it was relatively easy for financial institutions here to establish the Interac Association, providing an national network of ATMs and a central clearing house for debit transactions.

There are currently about 29 million debit cards in circulation in Canada. Debt cards now outstrip cheques as a method of payment.

And while case is still the most popular, its use has declined from 58 per cent of all transactions in 1995 to about 50 per cent currently.

CIBC spokesperson Robert McLeod said banks and credit card companies do have risk-management systems to detect credit card fraud. Financial institutions go on the alert whenever they detect an unusual transaction, such as a large purchase in a foreign country.

"We have a system that would pick up an unusual transaction and we would attempt to make contact with the person to find out if it was indeed them who was making the transaction. They system also monitors individual bank accounts for unusual activity", said McLeod.

"The fact is there are literally millions of credit card transactions carried out around the world every day and the vast majority of them are legitimate."

Wylie and McGill have adopted their own security measures to ensure they are not victimized again. Wylie, for instance, no longer uses his debit card for direct-payment purchases and he's very cautious about when and where he uses his credit card.

The Waterdown couple has also changed the way they manage their personal finances. They now have one main bank account which does not permit cash withdrawals but allows them to transfer funds to smaller satellite accounts, from which they can withdraw spending money.

"I was really angry at first", said Wylie. "Then I calmed down and thought about ways we could change things to limit our exposure and risk."

Copyright © 1998 by The Hamilton Spectator. All Rights Reserved. Reprinted with permission.