
$12M stolen from 1,400 convenience store ATMs across Japan in 2 hours - sjreese
http://mainichi.jp/english/articles/20160522/p2g/00m/0dm/044000c
======
ghshephard
Interesting thing about Japan, is the complete acceptance of people wearing
surgical masks in public (it's considered to be polite if you are ill). Makes
it a lot harder to identify people from video surveillance.

~~~
tamana
Interesting that Asians covering their faces is so received so differently
from Middle Easternern women covering their faces.

~~~
gotchange
Totally different beasts. Muslim women covering their whole body but their
eyes is way more difficult to identify for law enforcement since they have
only the eyes as one data point to uncover the identity while for Asian folks
who cover their mouth - not their face, huge difference -, you'd still get the
eyes - provided that they are not covered by sunglasses -, the hair - provided
that they are not wearing ridiculous hat -, body shape and probably gait as
data points to work on in their search.

All in all, it's still a better situation for the latter than the former when
it comes to law enforcement.

~~~
eru
Not quite so different. There are huge discussions about the headscarf in
Europe, which doesn't cover the whole face like a Burkha.

------
vegabook
14000 transactions at 1400 ATMs in 2 hours?! Think about the logistics. That's
120 transactions per minute. And 1600 cards. Either an army of coordinated
people, in itself highly risky as it vastly increases the likelihood of
someone grassing on the group, or fewer people all sitting at the same ATMs
drawing for 2 hours.... difficult not to get noticed. If they really pulled
this off it will be the most well organized organized crime ever.

~~~
grecy
I was thinking the same. And it mentions every single transaction was for the
maximum withdrawal amount.

The system doesn't notice when 116 transactions per minute are for the maximum
withdrawal amount?

The ATMs don't run out of cash really quickly?

~~~
brianwawok
Have you ever worked on a risk system? Hard to get right I would imagine. Very
possible news of a hurricane would lead to a bunch if max rate withdrawals.
May not want to cut everyone off then..

~~~
firethief
The false positive rate for "shut down everything" needs to be very low, but
it sounds like the threshold for "page somebody" could have been sooner.

~~~
brianwawok
It got shut down in 2 hours, not impossible someone got paged 15 minutes in...

------
underdendride
Can I speculate that this is an untraceable form of tax protection payment
from 7 Bank to Yakusa?

------
level09
Would the south african bank be held accountable for this? or can they get
away with this as the cards are fake/stolen ?

The article makes it seem as if Banks of the ATMs are the ones who lost the
money.

I'm also a bit surprised the criminals carried their operation in Japan, It
would have been easier in a more messy place e.g India / Africa ?

~~~
ryanlol
Yes, the south african bank will most likely be liable for this.

>I'm also a bit surprised the criminals carried their operation in Japan, It
would have been easier in a more messy place e.g India / Africa ?

No, you'd want a location with lots of ATMs that have large amounts of money
in them. In my experience India and Africa would both be particularly bad
places for this. LE isn't a factor here, mules may get arrested but the
perpetrators certainly don't care.

~~~
thasaleni
>No, you'd want a location with lots of ATMs that have large amounts of money
in them. In my experience India and Africa would both be particularly bad
places for this. LE isn't a factor here, mules may get arrested but the
perpetrators certainly don't care.

Contrary to popular belief (and "your experience", Africa & India , has a lot
of ATMs that have a lot of money, I am from South Africa, and I've been to
India so I know this for a fact.

~~~
ryanlol
Your experience must be severely limited then, as both of those countries have
very low ATM densities.

This isn't just my personal experience, but a very easily verifiable fact.

I also seriously doubt that level09 was referring to South Africa in his
comment, rather than the other "messier" african nations that all have far
lower ATM densities.

------
TheAlchemist
Interestingly this is not the first time it happens. 3 years ago:
[http://www.nytimes.com/2013/05/10/nyregion/eight-charged-
in-...](http://www.nytimes.com/2013/05/10/nyregion/eight-charged-
in-45-million-global-cyber-bank-thefts.html?_r=0)

~~~
raesene9
yeah this is a not uncommon style of attack there have been multiple instances
[http://krebsonsecurity.com/2013/02/crooks-net-millions-in-
co...](http://krebsonsecurity.com/2013/02/crooks-net-millions-in-coordinated-
atm-heists/) has some more.

As all credit balances on cards are just numbers in a database somewhere and
prepaid cards can be refilled and drained pretty quickly, you can see the
appeal of this style of attack.

------
allisthemoist
100 people involved? That's a lot of people who could potentially slip up.

~~~
lrem
Also, that is not exactly a life changing amount of cash, even if divided
evenly only between them.

~~~
saalweachter
Eh, it's not too bad for 2 hours work. Assuming 100 people (which would be
about 9 minutes per ATM -- 1 minute to withdraw, 8 minutes to travel to the
next one), that's $127,000 for two hours of unskilled labor. If you assume
that half of that gets passed upward, that's $63,500 for each of the 100
unskilled workers and $6.35 million for some smaller group (say, 5-10) who
organized it.

It's actually probably safer for the workers than the organizers -- if one of
the workers is picked up, they probably have a huge incentive to roll over and
give up the guy who recruited them, but the organizers probably won't get much
out of giving up their 100 minions.

And yeah, $50,000 probably isn't life-changing for _you_ but if you're a
teenager or 20-something without any prospects, it _could_ be life changing.
It's not "retire to an island" money, but it is "pay for college", "start a
small business", "buy a car" and "move out of your craphole town to a place
with economic opportunity" money.

And for the organizers, $1M a piece may be retire-to-an-island money, assuming
you mean "move to a cheap island" and not "buy your own island".

------
logicallee
Can a mod change the title to use the amt listed in the first paragraph?

Current title: 120M stolen from 1,400 convenience store ATMs across Japan in 2
hours

First paragraph of article:

>TOKYO (Kyodo) -- A total of 1.4 billion yen ($12.7 million) in cash has been
stolen from some 1,400 automated teller machines in convenience stores across
Japan in the space of two hours earlier this month, investigative sources said
Sunday.

Suggested title: $12.7 million stolen from 1,400 convenience store ATMs across
Japan in 2 hours

------
sjreese
This is the only declassified story, I could find .. The 120M number is real
and BMO is on full alert.

~~~
chinathrow
Any source?

------
imaginenore
I'm surprised there are still ATM cards without chips, and in Japan out of all
places.

~~~
the_mitsuhiko
The cards were not Japanese but South African. I'm shocked though that the
machines in Japan accept non pin cards.

~~~
yedpodtrzitko
7-Eleven and Post Offices are the only places which accept cards issued
outside of Japan. I assume they have to cover all possible types of cards,
otherwise people from other countries could get stuck without money here that
way.

~~~
77pt77
Some other combinis also accept foreign cards, but yes, getting money from a
foreign credit/debit card in Japan can be difficult.

I hope this doesn't make it even harder to do so.

------
mgiannopoulos
100 people, 4 hours, 13 million dollars. Set in the "mystical" and "lcd
bright" Japan. Sounds like the next George Clooney movie. Ocean's 100? :)

------
ck2
How on earth does the system absorb a nearly $13M loss now?

------
Bootvis
The article has the amount at USD 12,7m. That's a lot of money but quite a bit
less than the title suggests.

~~~
phjesusthatguy3
Yeah, the posted headline is just plain wrong. It was 1.4 billion Japanese
Yen.

~~~
erelde
This is just getting confusing (and ridiculous), I dont' know if you're using
long or short scale.

Currency conversion, plus bad editing/title, plus confusion around the
short/long scale.

------
ryanl0l
A more accurate title would probably be "120M stolen from hacked South African
bank via 1,400 convenience store ATMs across Japan"

~~~
avree
Actually, a more accurate title would be "12M stolen from hacked South African
bank via 1,400 ATMs across Japan"

~~~
osteele
Actually, a more accurate title would be "$13M stolen from hacked South
African bank via 1,400 ATMs across Japan"

~~~
ChrisLomont
Actually..... Since this is a pedantic chain....

13M was not stolen. 12M was stolen (and some more).

Thus the more accurate title would be "12M stolen from hacked South African
bank via 1,400 ATMs across Japan" since the statement in your title is
demonstrably false, while the other title is (presumably, from the article)
true.

~~~
rangibaby
1.4 billion yen stolen from 1,400 ATMs across Japan. There is a 100,000 yen
limit per card per day from convenience stores.

~~~
blacksmith_tb
That's 2X or 3X the common ATM limits in the US (which seem to vary from bank
to bank, or even account to account). Is there a higher limit at non-
convenience-store ATMs?

~~~
rangibaby
Depending on the bank and your type of card between 500,000-2,000,000+.

------
known
How did they get passwords?

------
mtgx
Let me guess they run Windows XP Embedded?

~~~
a3n
You could have a Cray in there behind the wall and it still would have
happened. It's the debit card system and protocols that make this possible.
They didn't hack any ATMs.

------
shrugger
Amateur hour.

If you want to rob a bunch of ATMs and get away with it, try keeping your
vulnerable window longer than 2 hours...

I mean, it's going to be pretty straightforward to gather a bunch of footage
and see what happened those 2 hours. These guys will get busted within the
next few days basically guaranteed.

~~~
ryanlol
>Amateur hour.

Please tell me how you'd do it instead? Build robots to go to the ATMs?

Only thing that matters here is the link between the people going to the ATMs
and the people actually running the operation.

~~~
jboles
ATMr... it's Uber for ATMs from your smartphone

