Terminal-Based PIN Fraud in Canada Spreads to Toronto

Canadian police have made seven arrests as part of a continuing investigation into what might be a terrorist-connected scheme to skim PINs and other credit and debit card information from a point-of-sale terminal. The case, which has affected residents of Mississauga, a town near Toronto, involved a handheld terminal at a McDonald's outlet inside a Wal-Mart store, according to press accounts. Police arrested five suspects Saturday, including two who reportedly tried to flee on foot, and another two Monday. Authorities are still trying to determine how much money was stolen in the nearly four-month scam, the accounts say. The case follows similar schemes in Ottawa and Montreal in recent months in which fraudsters have used specially rigged POS terminals to capture and transmit card data, including PINs, reportedly netting about $6 million (Digital Transactions News, July 6 and June 21). In these cases, the fraudsters use the data with forged cards to drain cash from victims' accounts through ATMs. All seven arrested so far are Sri Lankan, leading police to look into whether the stolen funds were used to finance the Tamil Tigers, a Sri Lankan terrorist group, according to an account today in The Edmonton Sun that relied on police sources. The paper quoted a police official as saying the investigation was still in progress. The scam apparently was in progress from May 1 until Aug. 24, according to an account today in The Toronto Star. The five arrested Saturday tried to flee police after they were found trying to withdraw $4,000 from a bank-owned ATM in Toronto, the paper says. The paper quotes an official with the Canadian Bankers Association saying victims of the fraud will be reimbursed by their banks. The apparent spread of the fraud to more Canadian cities comes in a country in which debit card use is especially high, with a rate of 81.7 transactions per capita, compared to 63.4 in the U.S., according to the Bank for International Settlements. And, unlike the U.S. card market, in which debit cards can be secured by either a PIN or a signature, the Canadian market allows only PINs. Canadian banks reimbursed $70.4 million last year to customers who had been victimized by debit card fraud, according to Interac, the national electronic funds transfer network. The network says fraud occurred on less than 0.01% of all transactions. Interac released a study in September 2004 indicating debit card fraud the previous year had cost banks or cardholders some $44 million on 27,000 accounts (Digital Transactions News, Sept. 17, 2004). Interac processed 3.07 billion PIN-debit point of sale transactions worth $137.4 billion in 2005, according to network statistics. Overall, the network links 571,000 POS terminals for 391,000 merchants.