After making arrests involving a credit card counterfeiting ring in Staten Island, N.Y., federal agents have discovered evidence of a disturbing form of automated teller machine fraud.
According to testimony in an indictment handed up last month in U.S. district court in Brooklyn, 26-year old David Kardi withdrew cash from automatic teller machines with fake ATM cards.
The indictment did not say how Mr. Kardi obtained the cards. But according to the indictment, he did have all the equipment needed to make the cards himself, as well as a videotape of consumers entering their access codes into an ATM.
These access codes, combined with bank account numbers taken from discarded ATM receipts, can be used to make counterfeit cards.
Mr. Kardi, and three other defendants, Joseph Zevuloni, 20, Meir Toizer, 29, and James Geritano, 21, have pleaded not guilty to federal charges of using, making, and selling counterfeit credit and debit cards.
No trial date had been set. Bank losses were not estimated in the indictment, nor were banks named that may have suffered losses.
But the case is an example of the relative ease with which criminals can break ATM security controls, bankers and law enforcement officials say.
"There's a problem with ATM design, and the industry's lack of awareness of the ability of the criminal element to recreate ATM cards," said H. Ray Ellis, a bank security specialist and consultant to financial institutions in Roanoke, Va.
While experts say ATM fraud is still relatively rare, last week it got national media attention when a group of thieves planted a cash machine in a Connecticut shopping mall, using it to obtain account numbers and access codes so they could make counterfeit cards. Tens of thousands of dollars has been reported stolen so far.
In 1989, five people, including a computer programmer working for an ATM transaction processing unit of GTE Corp., admitted to stealing 7,500 account and ATM personal identification numbers from Bank America Corp.
But this fraud, along with the Connecticut mall scam, were committed by ATM experts, authorities said. By contrast, it doesn't take an expert to do the king of ATM fraud charged in the Kardi case.
"We should be worried cause it's not difficult to do," Mr. Ellis said.
The Secret Service agents who cracked the counterfeiting ring weren't even looking for ATM fraud. Instead, acting on a tip from a trusted informant, an agent approached Mr. Kardi about buying fake credit cards.
Mr. Kardi led the agent to his apartment, and showed the agent magnetic stripe encoding machines and fake credit cards. Later, agents raided Mr. Kardi's apartment and the apartments of the other conspirators.
The raid uncovered the videotape of bank customers entering their account access codes, as well as what could be ATM receipts.
If the receipts were indeed from ATM transactions, Mr. Ellis said Mr. Kardi could have easily made and used fake ATM cards.
All he and his companions had to do was match up the personal identification numbers on the video with the ATM card numbers printed on ATM receipts. Then, they could have entered the information onto a magnetic stripe on a plastic or cardboard card sized to fit into an ATM machine.
Mr. Kardi and his companions could do this with the same equipment they used to counterfeit credit cards. Mr. Ellis added that this equipment, a magnetic stripe reader and encoder attached to a personal computer, can be easily purchased from a several manufacturers for $1,000 to $3,000.
Barry Schreiber, a professor of criminal justice at St. Cloud State University, in Minnesota, warned that ATM fraud could pick up as criminals learn how easy it is to do.
"As with any security system, once the idea occurs to one person, more breaches of security are typically seen," he said.
To keep criminals at bay, Mr. Ellis urged banks to tighten their ATM security, including halting the practice of printing ATM card numbers on ATM receipts. He also suggested that banks tell consumer not to leave transaction records near ATMs.