Winnipeg police bust fraud ring that stole PIN pads
WINNIPEG – Police are asking merchants using debit card PIN pads to check units in their stores after cops busted a fraud ring that stole approximately $1 million.
The group stole and replaced PIN pads after rigging them electronically so they could steal credit and debit card information of clients. It is not clear how many Winnipeg residents had their pin numbers stolen.
“Since July of 2008 eleven Winnipeg businesses have been the target of a large criminal group based out of province,” said a police spokesperson.
“This group has targeted the point of sale terminals (pin pads) by placing hardware in the devices capable of recording the customers debit and credit card information,” police said.
The fraud ring, based in a hotel room in Winnipeg, is thought to have carried out similar scams in four other provinces.
“As a result of this payment card skimming operation in Winnipeg alone, financial institutes have suffered losses estimated at over a million dollars,” police said.
The fraud ring was run by five people from Quebec, including four young offenders.
They were caught on Monday when loss prevention officers at a local business observed the gang stealing point of sale terminals.
They were followed by the private security officers who alerted police.
The vehicle was stopped by police who discovered two stolen PIN pads. Police arrested four males in the car.
“As a result of the subsequent investigation a fifth male was arrested at a nearby hotel. Search warrants of two hotel rooms revealed a small lab in which tools, hardware, and computers were located,” police said.
“The items were used to alter the point of sale terminals that were going to be stolen then replaced and download the stolen debit and credit card numbers from point of sale terminals that have already been compromised and placed in various businesses through out Winnipeg,” said a police statement.
Thomas Wayne Hope, 25, and four youths, all from Quebec, have been charged with multiple offences.
“The Winnipeg Police are asking all businesses to please check their point of sale terminals at least once a day to verify they have not been tampered with and to check the serial number to make sure that the device belongs to them,” police said.
Businesses with additional questions or concerns regarding fraud related matters of this nature are encouraged to contact the Commercial Crime Unit at 986-6231.
No related articles.
Posted by News Editor
on Jan 15 2010. Filed under Canada.
You can follow any responses to this entry through the RSS 2.0.
You can leave a response or trackback to this entry
Eugene: Easier than you think. If you get the card stripe and pin number, just make a card and use the pin. But it requires these devices to be altered some how.
What surprises me in this story is that neither the POS nor the acquiring processor host were able to determining instantly the PIN-pad replacement. In the proper card transaction processing world each PIN-pad has a unique PIN encryption key and unique MAC key (MAC is used to protect the transaction data from distortion). That means that if the PIN-pad is replaced by another one, the keys do not match with the ones, related to this POS, securely stored on the acquiring host side, and transactions do not go through. This should make the POS and PIN-pad pair unusable and trigger immediate investigation.
The fact that the fraudsters were able to replace freely one PIN-pad with another, demonstrates that either a certain set of PIN-pads has the same keys or that they do not have any keys at all. This is disturbing.