Police suspect foreigners in 12m-baht ATM theft (Updated)

24 สิงหาคม 2559

Police suspect the theft of more than 12 million baht from the Government Savings Bank (GSB) is the work of Eastern European criminals. Officials say money was stolen directly from the bank, not customer accounts.

Police suspect the theft of more than 12 million baht from the Government Savings Bank (GSB) is the work of Eastern European criminals. Officials say money was stolen directly from the bank, not customer accounts.

Please join us on our Facebook page http://www.facebook.com/bangkokpostlearning

Afternoon update:

Police now say only five people were involved and at least some of them have fled the country. Here are a few more details from our online reporters:

Foreign suspects in ATM malware heist 'fled the country'

Five people from eastern Europe were involved in the theft of more than 12 million baht from Government Savings Bank (GSB) ATMs infected with malware, and some have already left the country, a senior police officer said on Wednesday.

Police investigating the attacks on GSB ATMs in six provinces now have evidence clearly implicating the five east Europeans, said Pol Gen Panya Mamen, a senior adviser to the Royal Thai Police Office (RTPO).

The hunt had been intensified for the five suspects, even though some had reportedly already fled the country. Interpol had been alerted and given details.

Police investigators had witnesses and other evidence linking them to the heists. This included security camera footage that showed them inserting specially made electronic cards produced in Ukraine into GSB ATMs infected with the malware. The malware then triggered the ATMs to dispense what ultimately amounted to millions of baht in cash, Pol Gen Panya said.

Morning story

Manhunt for ATM robbers kicks off

POST REPORTERS

A manhunt is under way with police investigators suspecting the theft of more than 12 million baht from the state-run Government Savings Bank (GSB) is the work of Eastern European criminals and may be linked to the multiple attacks on ATMs of a major domestic bank in Taiwan in July.

After covering up the thefts for two weeks, GSB on Tuesday shut down half of its ATMs after discovering some were infected with malware that forced them to dispense millions of baht in cash in what is the country's first recorded case of its kind.

Assuring the thefts, which took place during Aug 1-8, have not affected customer accounts, GSB president Chartchai Payuhanaveechai said the gang targeted 21 ATMs in at least six provinces and made off with 12 million baht.

The six provinces are Phuket, Surat Thani, Chumphon, Prachuap Khiri Khan, Phetchaburi and Bangkok.

He said the bank has reviewed security camera footage and identified potential suspects as foreign nationals who infected the ATMs with malware that forced the machines to dispense banknotes.

"Their method involves stealing from the bank ATMs, not from customers' accounts," he said.

According to Mr Chartchai, the gang singled out ATMs manufactured by ATM giant manufacturer, NCR, for the attacks. So, the bank shut down about 3,300 "stand-alone" ATM machines from this maker indefinitely, until it has improved security measures to avoid further damage.

GSB has about 7,000 ATMs nationwide from three manufacturers.

However, another 600 NCR ATM machines in front of its bank branches are still functional, he said, adding that customers can use the ATMs of other commercial banks in the same area without having to pay intra-bank fees during the shutdown.

Mr Chartchai said the bank has asked the ATM maker to develop a software to counter the malware attacks and is negotiating with the firm to pay for the damages.

Pol Gen Panya Mamen, a senior police adviser, said these are the first reported malware attacks on ATMs in Thailand. Similar attacks have been reported in Malaysia and Taiwan where ATMs were cleaned out.

Based on security footage, he said police believe there are about 25 people involved in the series of thefts and they are divided into two to three teams.

He said the gang chose to empty the ATMs after midnight and spent some time stealing, so he urged members of the public who may have witnessed the thefts to come forward.

The technique of "jackpotting" cash-dispensing machines using malware is well known and has occurred around the world. It was demonstrated at a hackers' conference in Las Vegas in 2010 and has been reported almost regularly since.

A source said the gang had hacked into the bank's system several times and lured them into thinking it was a false alarm before they installed the malware at an ATM of GSB in Phangnga during March-April.

According to the source, the tampering was detected but it was ignored due to prior false alarms.

To steal the money, the gang inserted an electronic card into the ATMs which forced them to release as many as 40 banknotes per withdrawal. Normally, the number of banknotes released in a withdrawal is capped at 20.

You can read the full story here: http://www.bangkokpost.com/news/general/1069356/manhunt-for-atm-robbers-kicks-off