Prosecutors in New York say a worldwide organization, including highly skilled cyberthieves and a network of people skilled at making fraudulent withdrawals from ATMs, stole $45 million from prepaid debit cards. According to the four-count indictment unsealed in U.S. District Court in Brooklyn on May 9, approximately $2.8 million of the haul was from ATMs in the New York City area.
A press release issued by the U.S. Attorney’s Office in Brooklyn described this type of activity as an “Unlimited Operation” — an operation in which a cybercrime organization hacks into the computer systems of a credit card processor, compromises prepaid debit card accounts, and essentially eliminates the withdrawal limits and account balances of those accounts, thus enabling the thieves to withdraw literally unlimited amounts of cash until the operation is shut down.
According to the U.S. Attorney’s office, the defendants and their co-conspirators accomplished the $45 million haul in two separate operations. The first attack, on December 22, 2012, targeted MasterCard debit cards issued by the National Bank of Ras Al-Khaimah PSC, also known as RAKBANK, in the United Arab Emirates. Once the balances and withdrawal limits were manipulated, the next step went to the casher cells — people who make the withdrawals from ATMs. The casher cells withdrew approximately $5 million in more than 4,500 ATM withdrawals in approximately 20 countries. The New York City share in this attack was nearly $400,000 in approximately 750 withdrawals from over 140 ATMs in about two hours and 25 minutes.
Authorities say the second operation — begun the afternoon of February 19, 2013 and lasting into the early morning of February 20 — also targeted the computer system for MasterCard prepaid debit cards. This time, the financial institution was the Bank of Muscat, located in Oman. The casher cells withdrew about $40 million in about 36,000 withdrawals from ATMs in 24 countries. The New York City share was about $2.4 million in 3,000 ATM withdrawals.
Authorities allege that the leader of the New York cell was defendant Alberto Yusi Lajud-Peña. They say he and defendants Elvis Rafael Rodriguez and Emir Yasser Yeje laundered hundreds of thousands of dollars. One such transaction involved 7,491 $20 bills (about $150,000) that were deposited at a bank branch in Miami, Florida. Authorities say the defendants also used the proceeds to buy portable luxury items such as expensive watches and cars as well as depositing cash in bank accounts.
So far, seven people have been arrested: Jael Mejia Collado, Joan Luis Minier Lara, Evan Jose Peña, Jose Familia Reyes, Elvis Rafael Rodriguez, Emir Yasser Yeje, and Chung Yu-Holguin, all residents of Yonkers, New York. The eighth indicted defendant, Alberto Yusi Lajud-Peña, is believed to have been murdered on April 27, 2013, in the Dominican Republic.
