Crime Syndicate gets RFID Savvy

A gang of Sri Lankan credit card fraudsters ran amok in the city three months ago and may have heralded in a new type of cyber crime. The Deccan Chronicle and The Hindu reported that the gang of four men were caught with 116 international credit cards, rs. 6.5 lakhs ($14,000) and 31 stolen passports.
They had allegedly stolen credit card information from unsuspecting people in the UK and had managed to manufacture fake cards that would work on Indian ATMS.

What the stories didn't report was why the men had to travel half-way across the world to withdraw cash. It was a question that would fuel several days of research and a flurry of e-mails across cyberspace. A few days beforehand I had read an article in Wired by Annalee Newitz about hackers who managed to sneak their way past poorly encrypted radio frequency identification chips (RFID) to gain access to credit card information, access into restricted areas and to copy passports. I thought there could be a link between the thieve's copied cards and their trips to India. While Newitz's story focused on the ways to hack past RFID security, the gang of Sri Lankan thieves seemed to have come across an even more effective solution. Why hack when you can bypass the problem completely?

All new credit cards in the UK come embedded come with RFID chips that contain different pieces of user information, in order to access the account and withdraw cash the ATMs has to verify both the magnetic strip and the RFID tag. Without this double verification the ATM will confiscate the card, and possibly even notify the police. ATM's in India, however, only verify magnetic strips and have yet to catch up with advances in western technology.

Under the direction of a computer savvy crime boss, the thieves collected credit card numbers from an unscrupulus gas station attendant in London and uploaded the electronic information to the magnetic strips on the back of phone cards. Then they caught a flight to India.

Since the Indian ATMs only had single point verification the gang was able to exploit the technology gap all across Tamil Nadu and netted a neat sum. They would have gotten away with it, too. The police didn't have a clue it was happening, and it was only when an unusually attentive security guard posted outside an ATM noticed a man withdrawing cash from multiple cards in succession that he was able to tip off the cops.

I arrived at the police station early the next day after the cops had had time to interrogate the prisoners. I interviewed the Assistant Commissioner of Police who proudly proclaimed that this was the cyber crimes unit first arrest in its three years history, and he was eager to fill me in on the details. He said that while the prisoners were initially reluctant to spill information on their boss, it was only after a long night of interrogation they proffered up the name of a man in central London.

I spoke with him for almost an hour until it was clear to me that the Cyber Crime Unit was entirely unfamiliar with recent developments in credit card security. The commissioner had never heard of RFID chips, and he asked me to fill him in on everything I knew. I directed him to Wired's website and suggested he read Newitz's article.

The next frontier in cyber crime just may be thieves exploiting the gap between new and old technologies in different parts of the world. While security in the West ramps up at an alarming rate, much of India (and the rest of the third world), has no ability to keep up. Law enforcement is generally unaware of what is happening globally so that criminals in the Western world don't even need to be on the top of their game to beat the system. All they need is a plane ticket. Had these fraudsters just been a little less greedy they would have traveled back to the UK rich men.

**Aug 9 UPDATE: Several people have written in that UK cards don't use RFID, but a different kind of double verification system. Not having been to the UK in almost 25 years, I am going to have to assume they are correct. The mechanics of the crime, however, remain the same. There is a gap between technologies that thieves are able to exploit.