Tech-Savvy Scheme Loots Millions from Montreal Debit Accounts

Canadian police arrested 10 people Tuesday they say used rigged card terminals to intercept PINs as cardholders entered them at the point of sale as part of a scheme in which they stole $4 million (Canadian) from 18,000 customer bank accounts. More arrests are expected, according to the authorities. In what press accounts Wednesday are calling one of the most technologically sophisticated cases of debit card fraud yet discovered, the suspects swapped their own card readers for those installed in some 42 retail locations in the Montreal area, then used Wi-Fi connections to send PINs and card numbers to a remote receiver. With that information, they were able to forge cards and loot the associated accounts through ATM withdrawals. Montreal police, who announced the arrests today, say the suspects are part of a criminal ring that bribed retail store clerks to install the ring's card readers, which had been modified to transmit the debit card data, the press accounts say. The stores were largely convenience stores and gas stations, according to the accounts. Police began investigating in March when the Mouvement des caisses Desjardins, a Montreal financial institution, filed a complaint alleging that a call-center employee working with one its subcontractors had been discovered selling customer information, including dates of birth, to outside parties. The bank limits ATM withdrawals to $300, but raises the limit if the cardholder enters his date of birth, the press accounts say. The institution had already lost $1.8 million when it filed its complaint with police. Today's accounts say it has restored those funds to its affected customers. The alleged criminal ring also made its withdrawals near and just after midnight to maximize the cash they could take out against daily limits, according to police. The call-center employee was among those arrested in Tuesday's raids, which involved some 100 police officers. Captain Michel Forget of the Surete du Quebec said the sophisticated crime relied on technologies police had not encountered before in Quebec, according to Wednesday's accounts. The technological sophistication is “definitely a cause for concern,” Forget told the Montreal Gazette. “Debit card fraud is on the rise, but because of all our hard work fraudsters are being forced to become more technologically advanced,” says Jeffrey Bos, senior manager of fraud-management policy at Interac, Canada's national electronic funds transfer network. Canadian banks reimbursed $70.4 million last year to customers who had been victimized by debit card fraud, according to Interac. The network says fraud occurred on less than 0.01% of all transactions. Interac released a study in September 2004 indicating debit card fraud the previous year had cost banks or cardholders some $44 million (Canadian) on 27,000 accounts (Digital Transactions News, Sept. 17, 2004). Interac processed 3.07 billion PIN-debit point of sale transactions worth $137.4 billion in 2005, according to network statistics (signature-secured debit does not exist in Canada). Overall, the network links 571,000 POS terminals for 391,000 merchants. Quebec accounts for 23% of network transactions and 21% of merchants. This latest case of debit card fraud occurs against a backdrop of high PIN-debit activity. Canadians are the most active users of debit cards in the world, with 81.7 transactions per capita, according to the Bank for International Settlements, compared to 63.4 in the U.S.