How to spoof an ATM transaction?

Question

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the machine.

I think perhaps someone spoofed the transaction as a rabbit trail, to make it look like the victim or another person used the card there other than the actual abductor.

Let's say someone wanted to place a transaction on a debit/ATM account for $X at a typical convenience store location at XYZ time/date without actually using the card at that time/date.

Provided they knew your PIN, how feasible is this 20 years ago, either at the machine itself, or via some other method?

I don't see how a discussion about a 20 year old story that might or might not be true is productive. Besides it was 20 years ago who cares what was possible then? — Ramhound, Dec 18 '12 at 18:33

score 6 · Answer 1 · answered Dec 18 '12 at 05:27

6

I don't think it's impossible considering where IT security was 20 years ago. It is very possible that he attacked the ATM remotely by dialing into it. It would require a certain skillset though.

answered Dec 18 '12 at 05:27

Lucas Kauffman

54,169
17
112
196

Thanks for responding... what year did security improve with these things? – Bart Ressings Dec 18 '12 at 05:39
4

http://security.blogoverflow.com/2012/08/exploiting-atms-a-quick-overview-of-recent-hacks/ – Lucas Kauffman Dec 18 '12 at 06:16
I can't help but be reminded of [Joey from Hackers](http://www4.images.coolspotters.com/photos/38433/jesse-bradford-and-hackers-gallery.jpg). – Polynomial Dec 18 '12 at 08:45
2

You hacked across state lines!? That's universally stupid, man! ;) – k1DBLITZ Dec 28 '12 at 14:54
1

I'm sorry, I do not understand you? – Lucas Kauffman Dec 28 '12 at 14:58
2

It's a line from the movie Hackers...in reference to the reference Polynomial made to Joey. – k1DBLITZ Jan 22 '13 at 20:47

score 4 · Answer 2 · answered Dec 18 '12 at 15:34

This happened before the ATM networks became totally integrated and often the date of the transaction (at the cardholders account) would occur on the inter-bank settlement date which is usually after the weekend or the next working day if it was executed after 4pm on a working day. I imagine the transaction in question happened on ATM Network A whilst the card holders bank was on ATM Network B.

Nowadays, even though "the settlement" of the ATM transaction is still done on day+1, it records the date of the actual transaction retrospectively on the cardholders account to stop this sort of thing from happening. Users of some UK based bank accounts still see this happening when looking at eBanking sites shortly after making an ATM transaction (the transactions are normally highlighted)

There used to be some attack vectors (in the UK) where if the transaction at a pair of ATMs (on different networks) was done fast enough, double the maximum daily ATM withdrawal could be made because the pre-settlement records hadn't been lodged in time. I heard that a large survey of all bank machine ATMs in the UK was carried out shortly after and there were only a dozen or so instances where ATM's were physically close enough to cause this.

score 2 · Answer 3 · answered Dec 18 '12 at 14:29

My first thought would be to question why "supposedly" was put in there. While it is certainly plausible to have hacked an ATM by many different means 20 years ago, or even today, it is pretty unlikely that someone kidnapping would have that skill set. I believe a lot of ATMs 20 years ago were modem based, so it might have been as simple as a bank employee or someone else who had access to the dial in number called up the central system, authenticated as the ATM and placed the transaction.

That said, it sounds like a fairly fishy story to me. Without physically going to the ATM they couldn't get any money and hacking in to it would leave more clues than it would add confusion. I can't see any good reason why either a criminal or someone running away would want to do this even if they had the skill set to do so.

score -1 · Answer 4 · answered Jan 10 '14 at 19:38

-1

A technique that was and still often is used is skimmming. A small devive is placed on top of the cardreader that copies the contents of the magnetic strip. A little (almost invisible) camera is used to record the pin. The contents of the card then are coppied onto a new card. With this new card and the pin a criminal can get access to your account without you even noticing. You still have your card and you never told your pin to anyone.

answered Jan 10 '14 at 19:38

user1375280

1

This is all correct, but completely irrelevant to the original question which was not about illicit card use, but transaction spoofing. – Xander Jan 11 '14 at 00:54

How to spoof an ATM transaction?

4 Answers4

Linked