TOKYO -- A large-scale international credit card fraud that saw roughly 1.8 billion yen ($16.9 million) withdrawn from ATMs nationwide in just three hours leaves Japanese banks with the challenge of offering foreign visitors convenient access to the machines while tightening security over the use of foreign-issued cards.
Gone in 3 hours
The incident involved roughly 1,700 ATMs at convenience stores, train stations and other locations in Tokyo, Osaka, Aichi and 14 other prefectures. Wielding forged credit cards created using stolen information on about 3,000 accounts at a South African bank, more than 100 criminals hit those ATMs for three hours beginning at 5 a.m. May 15.
Early Sunday morning was a perfect time for such a crime, with fewer people out and about in shops, on the streets and at train stations than during weekdays around that time. Police think a network of international criminals chose the time for that reason.
One suspect arrested in the heist is accused of withdrawing 700,000 yen from an ATM at a 7-Eleven store in Tokyo. Because 100,000 yen was the maximum per withdrawal permitted from ATMs at the convenience store chain, seven withdrawals of 100,000 yen each were made. Police think this suspect also made illegal ATM withdrawals at other stores before the arrest.
The Niigata prefectural police found a memo containing four-digit personal identification numbers that were used in the ATM heist through an arrest of a man in an unrelated wire transfer fraud case. This is evidence that a group of Japanese fraudsters had cooperated with international criminal gangs.
"It appears that an international criminal syndicate illegally obtained credit card information from the South African bank and worked with a group of Japanese swindlers to withdraw money in the coordinated heist," a senior Japanese police official said.
Could have been worse
"The damage could have been much larger without Seven Bank's ATM monitoring system," a high-ranking official at Japan's Financial Services Agency said.
The banking unit of Seven & i Holdings, whose vast retail empire includes Seven-Eleven Japan, monitors its ATM network for anomalies using its in-house surveillance system. The bank's monitoring center detected a surge in unusual withdrawals through its ATMs placed inside 7-Eleven stores around Japan early in the morning of May 15.
Those withdrawals were made by taking advantage of cash advance services offered by Visa, MasterCard and other credit card companies. Seven Bank detected the suspicious activities even before MasterCard noticed and contacted the bank. The center immediately blocked transactions and alerted the police and the FSA, and the financial industry watchdog issued warnings to other financial institutions.
The forged credit cards were the old type of plastic cards that have only a magnetic strip. The fraud was detected promptly because it involved more than 100 people conducting suspicious transactions in a short time. But fraud via sporadic ATM withdrawals is virtually impossible to spot immediately: As long as the correct PIN is entered, those withdrawals are processed as normal transactions.
Balancing security, convenience
Accepting only newer types of credit cards that incorporate IC chips to boost security would prevent ATM frauds like the one carried out May 15, but that would inconvenience many foreign visitors to Japan because chip cards are not widely used in many countries. As the main point of allowing credit card cash advances is to provide convenience to foreign visitors, banks are reluctant to refuse ATM access for magnetic-strip cards.
Seven Bank has since lowered the maximum per ATM withdrawal to 50,000 yen so that any future illegal transactions will take longer to pull off and give the bank more time to detect and respond. But the bank struggles with this measure, knowing it is an inconvenience to customers.
The heist comes as major Japanese banks gear up to increase the number of ATMs that accept foreign-issued plastic cards. Bank of Tokyo-Mitsubishi UFJ, Mizuho Bank, Sumitomo Mitsui Banking Corp. and Resona Bank plan to install 1,000 or so such ATMs by the end of next fiscal year in response to the government's desire to double the number of foreign visitors to 40 million annually by the 2020 Tokyo Olympics.
The realization that the banks will need to review their security systems to prevent a repeat of the ATM heist may delay the rollout. The FSA has been interviewing individual banks and urging them to bolster security systems to speed the process of detecting and blocking unusual ATM transactions.
The funds illegally withdrawn in the May 15 heist likely will be reimbursed by the South African bank. But the incident has presented Japanese banks with a difficult challenge of striking the right balance between protecting against ATM frauds and offering customer convenience.