Swapped PIN-Pad Fraud Pops up in Ottawa, Netting $2 Million

Ottawa police are close to bringing charges against a retail clerk who police say has helped a local criminal ring siphon an estimated $2 million (Canadian) over the past three months from hundreds of bank accounts by using rigged point-of-sale terminals to steal debit card account numbers and PINs, according to press accounts Thursday. With the cooperation of employees, the thieves reportedly swap out the stores' installed terminals with devices that capture the debit card data. So far, at least 12 outlets in the Canadian capital, including gas stations, convenience stores, and fast-food restaurants, have reported PIN pad thefts to authorities, according to the press accounts. With the stolen data, the ring then creates bogus debit cards they use to draw cash from the linked accounts at ATMs. The accounts say the thieves have been able to pull $1,000 on average from each account, though they sometimes wait as long as three months before making withdrawals. Each rigged terminal has collected information on anywhere from 120 to 200 cards, according to information reported by The Ottawa Sun, which quoted a police source. The case resembles a similar scam discovered recently in Montreal, in which debit card thieves used rigged POS devices in some 42 stores to collect and transmit card data via Wi-Fi connections to a remote receiver (Digital Transactions News, June 21). In that case, which also relied at least in some instances on the cooperation of store employees and in which police had made 10 arrests, criminals were reportedly able to swipe $4 million from 18,000 cardholder accounts. The apparent spread of the high-tech fraud to other Canadian cities comes in a country in which debit card use is especially high, with a rate of 81.7 transactions per capita, compared to 63.4 in the U.S., according to the Bank for International Settlements. And, unlike the U.S. card market, in which debit cards can be secured by either a PIN or a signature, the Canadian market allows only PINs. Canadian banks reimbursed $70.4 million last year to customers who had been victimized by debit card fraud, according to Interac, the national electronic funds transfer network. The network says fraud occurred on less than 0.01% of all transactions. Interac released a study in September 2004 indicating debit card fraud the previous year had cost banks or cardholders some $44 million on 27,000 accounts (Digital Transactions News, Sept. 17, 2004). Interac processed 3.07 billion PIN-debit point of sale transactions worth $137.4 billion in 2005, according to network statistics. Overall, the network links 571,000 POS terminals for 391,000 merchants.