NYC Card Skimming Take-downElaborate Insider Fraud Scheme Targets AmEx Cards
According to a statement issued by the Manhattan District Attorney, the crime ring recruited waiters and waitresses in high-end restaurants to use hand-held skimming devices to steal card details from at least 50 American Express accountholders.
The take-down highlights innovation in insider fraud.
"This is an example of a growing trend," says Mike Braatz, senior vice president and general manager of bank fraud for Memento, a fraud-management software services provider. "Collusive fraud rings recruit and train specialists, and then place them in organizations where they have relatively easy access to financial information or resources."
The 18-month investigation, overseen by New York City Police and the Secret Service, involved court-ordered eavesdropping and video surveillance, physical surveillance, computer forensics and analysis of credit card, banking and phone records.
"The suspects in this credit card fraud case thought that they flew low on law enforcement's radar, but NYPD detectives working with the U.S. Secret Service and Manhattan District Attorney's office were able to trace the crew of [Wolfgang's Steakhouse] waiters who skimmed victims' information to the buyers who ordered high-end luxury items for complicit clients," New York City Police Commissioner Raymond Kelly said in the statement. "These criminals were careful, but as it turned out, not nearly careful enough."
Counterfeit cards, created with the stolen card details, were used by hired shoppers to purchase goods that were resold for profit. The crime ring provided the shoppers with fake driver's licenses using stolen identities from the AmEx cardholders. So-called "customers" also were hired to request merchandise, knowing the items would be purchased with forged cards, and then resell it, oftentimes over the Internet.
Cybercrime and identity theft expert Neal O'Farrell says the New York case is a perfect example of how crimes of opportunity can quickly become organized. "Criminals keep returning to skimming because it's still very lucrative, and some industries, like hospitality, are especially vulnerable," he says. "It's very hard to keep track of a transient workforce with a high rate of employee turnover and little background checking."
See Also: Case Study: The Road to Zero Trust
On the upside, fraud schemes that require crime rings to bring in outsiders pose great risk of exposure. "It's a very hands-on crime," O'Farrell says. "The thieves have to be present, in-person, for almost every step of the crime. This increases the risks for them and is probably why so many got caught."
The scheme proves street-level crimes are becoming more organized: "To the point that they will become smarter and much harder to catch," O'Farrell says.
Braatz says criminal sophistication is what's helping schemes like the one in New York fly under law enforcement's radar. "In this case, the innovation was the degree of specialization used in their fraud value chain," he says. "As with any value chain, specialization enables individuals to perform one role very efficiently. And in the case of fraud schemes, it also minimizes the chances that one errant person can take down the entire operation."
The most important message organizations should take away from the New York scheme is the need for business to invest in layered security approaches to internal fraud monitoring, Braatz says. "HR screening, tighter policies, internal auditing and technology for monitoring employee access to sensitive systems" should be minimal requirements. "Trust but verify, as they say." [See Insider Fraud Suit: Example for Others?]