Online banking fraud - how do the scammers get away with the money?

[Dahu]

A bank here in the UK had a problem at the weekend, £2.5 million was stolen from 9,000 accounts.

Tesco Bank cyber-thieves stole £2.5m from 9,000 people

My question is how do the scammers get hold of the money? I presume it was something like transferred to someone’s fake account in the first instance. Then what? Do they go into a branch and draw it out in cash? Wire it to another bank elsewhere? But if it just gets wired around the banking system can’t it be traced electronically? Surely they can’t draw out £2.5m in cash that’s only just been deposited…

I hasten to add, I don’t need an answer fast.

[Mangetout]

Foreign transfers are notoriously difficult to halt or reverse - so (according to the info I received at cyber threat insurance seminar the other day), they transfer it to an overseas account (buying time), from which it is quickly distributed out to a large number of other accounts in that country - from which it is withdrawn or used.

[LSLGuy]

Perhaps with two or three additional international steps to slow down the pursuers.

[md2000]

Since it’s (was?) possible for Somali pirates to “get away” with ransoms in the millions, I assume there are some foreign banks that don’t feel an urgent need to cooperate quickly with the western authorities. IIRC the Somali ransoms went through some middle eastern banks. Plus, some people in those countries get a cut for helping to cover up the trail. I assume the same applies to a number of eastern European countries’ banks and perhaps places like Nigeria.

[Dahu]

@md2000

Since it’s (was?) possible for Somali pirates to “get away” with ransoms in the millions, I assume there are some foreign banks that don’t feel an urgent need to cooperate quickly with the western authorities. IIRC the Somali ransoms went through some middle eastern banks. Plus, some people in those countries get a cut for helping to cover up the trail. I assume the same applies to a number of eastern European countries’ banks and perhaps places like Nigeria.

Are/were these ransoms paid via bank transfer? I have a mental image from somewhere of barrels of cash being dropped by parachute.

[Riemann]

@Dahu

Are/were these ransoms paid via bank transfer? I have a mental image from somewhere of barrels of cash being dropped by parachute.

Not a treasure chest full of pieces of eight?

South Park , Somalian Pirates We (With Lyrics FULL) HD

[md2000]

@Dahu

Are/were these ransoms paid via bank transfer? I have a mental image from somewhere of barrels of cash being dropped by parachute.

The trouble with paying with a pallet of money is that eventually maybe the western countries might figure out how to time-bomb the payment - money that fades with heat, or certain serial numbers no longer valid currency, or some such trick. But I do wonder how exactly they got away with tens of millions of dollars. I kind of imagine some CIA black-ops taking out cooperative African or middle-eastern middlemen.

[Dahu]

I found a partial answer to my OP yesterday. I say partial, because it’s behind a paywall, but the bit I can see seems to make sense -

Tesco hackers used mobiles to launder haul

Tesco hackers used mobiles to launder haul

Raiders used contactless accounts to spend stolen £2.5m in US and Brazil

The criminals behind the Tesco Bank cyber-heist went on a spending spree in shops in the US and Brazil to launder their ill-gotten gains, The Sunday Times can reveal.

The thieves used data stolen from the British lender to set up contactless payment accounts on smartphones, sources said.

In a co-ordinated raid last weekend, they bought thousands of low-priced goods from stores, swiping their mobile phones at the tills. Many of the fraudulent transactions are understood to have been made in American electricals retailer Best Buy.

The gang took £2.5m from 9,000 Tesco Bank customers before the lender detected suspicious activity and froze all online payments.

The revelations will turn up the pressure on the supermarket’s banking division, whose reputation has been damaged by the…

[md2000]

I’m trying to imagine what size of army is needed to spend $3M in less than a day, a few thousand at a time. Also note larger Best Buy items will have serial numbers.

This is the basic flaw in any such scheme. I don’t think Tiffany’s or Cartier will sell a $200,000 bauble to the great unwashed masses on a credit card or debit card. You need a large organization to spend it $1,000 at a time within a day - which adds to the risk that someone will get caught. Then it helps to have an organization whose reputation will make the foot soldiers keep their mouths shut.

We’ve had several threads recently on the joys of money laundering. It’s not trivial.

[Dewey_Finn]

@md2000

The trouble with paying with a pallet of money is that eventually maybe the western countries might figure out how to time-bomb the payment - money that fades with heat, or certain serial numbers no longer valid currency, or some such trick. But I do wonder how exactly they got away with tens of millions of dollars. I kind of imagine some CIA black-ops taking out cooperative African or middle-eastern middlemen.

I don’t see the government invalidating certain serial number ranges. But they could trace the currency back to the scammers by noting when the serial numbers are used. In fact, I would not be surprised if the intelligence agencies were already tracking currency by serial number, just as a normal process.