Heather W. is a 26-year-old American accountant who's lived in Moscow for four years. In mid-December she received one of the biggest shocks of her life when her U.S. bank sent a statement saying she had withdrawn $6,500 from her account out of various automatic teller machines in Israel-a country she had never been to.
"The thieves made a circuit from ATM to ATM, each time taking out the daily maximum," she says. "I mean I was never in Israel, and can prove it."
It's a bank customer's worst nightmare. But since early last year it has happened to scores of foreigners and some Russians who had used their bank debit cards in Russia. Most found their accounts cleared out in cities they had never even visited, as far afield as Stockholm and Taipei.
Major card processing companies have been scrambling to deal with what appears to be a major fraud ring since last August, when reports first surfaced that someone had been able to obtain crucial information-including PIN codes-from cards that had been used at ATMs in Russian banks. Suspicion has focused on Union Card, a large Russian transaction processing firm that until late last year handled roughly half of all card transactions in Moscow. Most of those transactions were processed for Europay International, a major card payment system based in Brussels that manages MasterCard's Cirrus and Maestro networks.
Europay executives say they believe someone at Union managed to crack the encryption system at some ATMs and read PIN codes. The technology used at some Russian ATMs is old and not secure.
In March last year, four people from the Central Asian country of Kazakhstan were arrested in Munich, Germany, using counterfeit cards. Then in November, police in London arrested a Swedish national named Krister Elsgern with as many as 50 fake cards in his possession. By chance, an off-duty police officer waiting in line at an ATM noticed Elsgern inserting card after card into the machine-the cards were white, with no bank logos on them.
In November, Europay stated that 214 cards with its logo on them had been "compromised" and hence were reissued by its participating banks. The company says banks are normally in charge of dealing with this sort of problem. But Europay did issue an official press statement about action it decided to take against the Russian firm.
"Due to the fact that Union Card has not taken the steps necessary to satisfy Europay that they corrected the problem or identified those responsible, their license to process Europay brand transactions at over 1,600 Russian ATMs was suspended on November 15."
From the start, Union Card has been tightlipped on the entire matter. But when Europay suspended the company's license, Union officials denied that security had been breached, although they admitted that the firm was under investigation. At least two major Russian banks, Alfabank and Avtobank, have also sought to distance themselves from Union Card by taking steps to set up their own internal processing centers. One official at Alfabank insisted it had no reports of security problems.
But Heather W.'s case again offers contrary proof: She had long used one of Alfa's ATMs because they are linked to the Cirrus system and, by extension, Europay. Russia's banking sector went through real turmoil after a major financial crisis of August 1998, when several major banks failed and the Russian ruble was drastically devalued. Millions of depositors, including many foreign companies, lost their money after accounts were frozen. Most analysts agree that at a minimum, the country has a long way to go before finding economic stability.
Dealing with the situation on a macro level is little comfort for those down on the micro level, the victims. Some say they've had a hard time convincing their home banks they were not responsible for the massive withdrawals that were recorded, while others say their banks did decide to reimburse them.
Heather W. says that while her bank may reimburse her for the loss, the blow has been so disillusioning that it has added to her thoughts about leaving Russia. "I still can't really believe it, but what are you going to do?"
Bill Gasperini is a business writer based in Moscow.
