Crimes involving the use of bank cards

[Hacker]

The scale of crime in the sphere of bank card turnover. In Russia, prior to the adoption of the new Criminal Code, there was no centralized record of such crimes. They were mostly qualified under Article 147 of the Criminal Code of the RSFSR (fraud), and today it is not possible to distinguish them into a separate group of crimes. Statistical data for the period since 1997 give an idea of the number and dynamics of crimes related to the turnover of bank plastic cards, and the resulting material damage.

According to the Main Information Center of the Ministry of Internal Affairs, in 1997 53 crimes were registered (in Moscow - 12) falling under Article 159 of the Criminal Code "Fraud", and the amount of damage caused amounted to almost 1.6 million denominated rubles. 36 people were brought to criminal responsibility. In the same year, 16 crimes were registered under Article 187 of the Criminal Code "Production or sale of forged credit or settlement cards and other payment documents".

In 1998, 98 fraudulent actions with plastic cards were registered (12 in Moscow), and the damage from them was estimated at 88.2 million rubles. 122 people were brought to criminal responsibility. 43 cases of manufacturing or selling counterfeit credit or settlement cards were registered that year, and four people were brought to criminal responsibility.
At the same time, 102 crimes related to plastic card fraud were registered in just 6 months of 1999 (15 in Moscow). The damage caused by these crimes amounted to 3.7 million rubles (47 people were brought to criminal responsibility). In addition, 91 cases of manufacturing or selling credit or settlement cards were registered (7 people were brought to criminal responsibility).

According to foreign sources, only 15% of all crimes committed come to the attention of law enforcement agencies. In Russia as a whole, official data on real losses of banks are not published. According to the Moscow Police Department, in 1996, the losses from crimes incurred by banks using plastic cards on the Russian market amounted to about $3.5 million, which is about 1.5 times lower than the same indicator for 1995 (about $5.5 million).

According to the weekly Kommersant, in the late 80s and early 90s, losses from card fraud in Russia reached 5% of the total volume of transactions. This indicator exceeded the threshold level of 3%, beyond which this type of activity becomes unprofitable for banks. In 1994, the established damage from card fraud amounted to 0.21% of the total volume of international card transactions of all payment systems. This was due to the creation of a financial security system by United Credit Cards (USC) and the elimination of a number of criminal groups specializing in bank card fraud.
In recent years, there have been qualitative changes in crime. The share of crimes in the sphere of bank card turnover committed by well-organized groups and criminal communities (up to 50 people) is increasing. These groups are equipped with state-of-the-art equipment, have all the necessary documents for covering up, and are made up of qualified specialists.

Carding as a multinational business. The business of manufacturing and using fake plastic cards has become transnational in recent years. The leadership here is held by South-East Asia, where most operations are carried out. There are active "branches" of criminal communities in Spain, Italy and the UK.
The leading role in this area belongs to the Hong Kong Chinese. Asian criminal groups produce high-quality duplicate cards, which have been used so far in both the Asian and European markets to purchase high-quality goods with little or no risk. Data required for making duplicates (card numbers, expiration dates, name of the holder, etc.).

In the second half of the 1990s, criminal groups from Africa took a prominent place in the field of complete forgery of bank plastic cards in Europe. Africans use forgeries primarily to obtain cash directly from banks. At the same time, they verify their identity using stolen (forged) identification documents. Complete forgeries used by Africans are made in the United States (workshops for the production of fakes were repeatedly liquidated in California).
The plastic card industry is taking measures to combat this type of fraud by increasing the number of degrees of protection of cards (images on them have been applied by lithographic printing and supplemented with elements that are difficult to fake, for example, holograms).

Crimes committed using bank cards.
Crimes committed using bank cards can be grouped into the following categories:

• abuse of genuine bank cards;
• making fake bank cards;
• sale of fake bank cards;
• abuse of product receipts (slips);
• using fake bank cards.

Abuses with genuine bank cards. These abuses are possible if they fall into the wrong hands, in the presence of the criminal intent of their legitimate owner, as well as on the part of the leaders of the fake companies serving the cards.

Stolen or lost card transactions. In early 1990, the former KGB detained a group of people involved in smuggling. In the process of studying criminal activity, investigators encountered a method of theft previously unknown to domestic practice: using someone else's plastic card belonging to a foreigner, criminals with the help of an accomplice who worked in a foreign exchange store at Sheremetyevo - 2 airport stole industrial goods for a significant amount.

Excess account. This abuse consists in the receipt by the legal owner of the card of monetary amounts or values at a cost that significantly exceeds the size of the limit provided for in the contract.
Companies that use plastic cards in their work, as a rule, have limited opportunities to track their legitimate use. In this regard, recently there have been widespread cases of payments with other people's cards in countries located at a considerable distance from those where the loss or theft occurred.

False statement about theft or loss of a bank card. The crime is usually committed by the legal owner of the card. The latter submits a corresponding application to the bank. As a rule, it takes several days for the processing center to include the corresponding card number in the stop list and notify the retail outlets. During this time, its owner tries to conduct the maximum possible number of operations, and then issues claims to the bank.

Temporary withdrawal of the card from the rightful owner for payment with it and assignment of goods, or for overstating the cost of services actually rendered.
Using a card that was not received by the rightful owner, for example, because they changed their place of residence. In this case, a written notification of the issuing bank with a request to send the card to a new address is used. It is enough for attackers to find out about such an intention, fake a notification about moving and receive a card by mail.

Illegal use of the card during the period between opening an account and delivering the card to the owner for performing operations on it. This abuse is a variation of the previous one. They are committed by unscrupulous employees of banks and enterprises engaged in the production of cards.

Bank plastic cards that are stolen when sent to the client by mail from the issuer or manufacturer are of particular interest to criminals for the following reasons:

• their loss (theft) is noticed with great delay, as a result of which there is no possibility of immediate blocking of the card.;
• by the time they are stolen, they are usually not signed, so the criminal can sign them himself and then use them "legally".

Cases are already known abroad when criminals specifically got a job at the post office or in private delivery services in order to withdraw items with bank cards or redirect them to a false postal address.

Embezzlement of funds under the cover of fictitious enterprises and using corporate bank cards.
The crime scheme included the following stages. To commit theft, a company is established that was engaged in providing intermediary services in the design of cards of foreign payment systems. Then the scammers open a corporate account, giving it to the client for an individual one. At a certain moment, when the unsuspecting owner, having made sure that the card was functioning normally in our country and abroad, transferred a large amount of money to his supposedly personal account, criminals who had equal rights to dispose of funds in the account stole them.

Example.
Manufacturing of counterfeit bank cards. Distinguish between full and partial forgery of cards.
Complete fake. To date, of the known types of fraud, complete forgery of cards is the most common. In case of complete forgery, the issuer's logo and signature field are applied to the blank forged cards, and all degrees of protection are accurately reproduced (authentic details of actual cards are used).
A technique often used by criminals is to temporarily remove the card from the client's field of view and make an impression on it. In this case, an easy-to-manufacture device is used. Money paid by banks from an ATM or for transactions that were not actually made is stolen.
Forgery of bank cards today is the sphere of activity of mainly organized groups. They act in collusion with employees of organizations that make payments using credit cards. According to the Ministry of Internal Affairs of Russia, there are more than 150 different structures in Russia that supply information to fraudsters with plastic cards.

Use of "white plastic". This fraudulent scheme appeared in the late 70s and became widespread. Fake cards do not have any external details that can be used to identify them (the logo of the issuing bank and payment system, a hologram, and other degrees of protection). Data from existing cards is transferred to a blank plastic sheet.

Such cards can be presented only if the owner or employees of trade and service enterprises are complicit in the crime, since the fake is visually detected immediately. Next, false slips are masked among the genuine ones. On the debit account formed as a result of the use of "white plastic", later it is almost impossible to determine whether a real or fake card was presented. Fictitious enterprises are created to perform fraudulent actions under this scheme.

Example.
A variety of crimes with "white plastic" is the forgery by criminals of the details of these cards obtained as a result of carelessness of card holders in the case of magnetic stripe cards, or the interception of these details and PIN codes in the case of microprocessor cards and their use for withdrawing money through ATMs.

Example.
Partial forgery. Its purpose is to delete the data marked there from the original card and add new ones. Partial forgery usually involves the following stages:

• getting a real card from a reputable bank by depositing the minimum required amount to a newly opened account;
• obtaining information about the owner of a solid account;
• actually forging the card based on the obtained data: smearing the signature sample or pasting a new signature field using ordinary adhesive paper; "shaving" the data embossed on the card plane or "smoothing" the PVC from which the card is made using a conventional iron or microwave oven, and after leveling the surface, applying the extracted information using a desktop press.

Most often, the invoice information printed on the card is removed by thermal, mechanical, or other means and replaced with a new one cut from another card. This simple method has become so widespread in the world that a special name was even born for it: shave & paste ("shave and paste").

Selling fake credit or payment cards. Usually, this is done by the manufacturers themselves or by persons specially selected for this type of activity.

Abuse of payment receipts (slips). They occur when making or simulating payments with cards. Such operations can only be performed with the participation of employees of companies that serve customers by card.

In this case, the following options are possible:
- slips are made using someone else's genuine or fake cards;
- payment is subject to slips received earlier when servicing the legitimate cardholder, but in an amount exceeding the required amount.

There is a case when the cashier of one of the stores, having entered into a conspiracy with a person who knew a number of users of payment cards and their details, forged slips and released goods for a certain fee for the amounts indicated in them.
Abuse of plastic cards used in ATMs to receive cash is particularly specific.

There is a well-known case when in Hungary, through ATMs located in different parts of Budapest, criminals within a few minutes, using about 1.5 thousand fake cards, withdrew 1.5 million forints from their accounts. About 150 people took part in the fraud.
In England, criminals made a fake ATM, which was externally decorated like many others. When using it, legitimate cardholders left their banking details, including account details, with the help of which the attackers then made fake cards, after which they received cash through existing ATMs.
The criminal who stole 400 million rubles. from ATMs of one Moscow bank, selecting a digital combination of an access code to a computer system for managing accounts of bank clients.
In 1995, a criminal group in the amount of 14 people was exposed of fraud, which within six months committed 269 fraudulent transactions at trade enterprises in Moscow using credit cards "Visa", "Master Card", "American Express" for a total amount of more than 80 thousand dollars USA.

These crimes are committed: in restaurants - 26.4%, in hotels - 25%, shops - 20.7%, bars - 10.6%

For fraudulent transactions, credit cards are mainly used, while payment and debit cards are relatively rare.
Nevertheless, experts predict a further significant increase in crimes involving plastic cards, as Russian criminals are already establishing international relations and creating channels for receiving stolen and lost cards from abroad for their use in Russia. Card fraud may become a serious problem this year in the regions of Russia where the plastic business is currently actively developing.

Online bank card fraud. With the development of e-commerce, the emergence of virtual online stores where you can place an order for receiving goods by mail from a personal computer, new methods of criminal attacks using bank cards (Internet carding) are also emerging. Fraudsters take advantage of the simplicity of transaction technology and imperfect information security systems on the network.
So, to pay for goods in online stores, just specify the card details. When performing any operation, information may leak, which is fraught with large losses for the owner. There are many different ways to get the card details from the owner.
Currently, about 30 methods of fraudulent actions using the Internet are already known, which can be used by scammers with almost impunity.

Example.
Control over crime in the sphere of bank card turnover.
At present, the necessary prerequisites have been created to increase the effectiveness of criminal law control over abuses in the use of these settlement tools.
The Criminal Code of the Russian Federation provides for a penalty of up to 6 years ' imprisonment for manufacturing or selling counterfeit credit or settlement cards (Article 187 of the Criminal Code of the Russian Federation).
The same actions, if committed repeatedly or by an organized group, are punishable by imprisonment for up to 7 years with confiscation of property. At the same time, the use of fake plastic cards for the purpose of seizing other people's money or material values, depending on the circumstances of the case, contains fraud (Article 159 of the Criminal Code of the Russian Federation), or embezzlement (Article 160 of the Criminal Code of the Russian Federation).

Currently, there are about a billion bank plastic cards in the world. Introduction of bank cards is the most important trend in the development of non-cash payment technology in banking. This settlement tool provides all individuals and organizations using it with many advantages. For customers-convenience, reliability, practicality, time savings, no need to carry large amounts of cash.
Like any highly profitable business, and especially in the field of money turnover, bank plastic cards have long been a target for criminal attacks.
Before giving a description of crimes committed with the use of bank cards, we will consider some basic concepts related to the organization of the card market, the technology of using this payment instrument.

From the history of the formation of the "plastic" business. The first payment system - Diners Club-was created in 1950. After 17 years, two more systems appeared - Europay / MasterCard and American Express. And in 1974 VISA International was formed. In the modern international "plastic" business, the leading positions are occupied by VISA International, EuroCard / MasterCard and American Express - the largest international organizations that have united a huge number of credit institutions from different countries.

In Russia, bank cards were first used in 1980, during the XXII Olympic Games. The first bank cards were Visa cards, which could only be used by foreign citizens.
Subsequently, such payments were made in some foreign exchange stores and were also absolutely inaccessible to domestic consumers.
With the advent of the first commercial banks, payments using plastic cards began to be actively implemented in the credit and financial sector. Thus, the volume of transactions already exceeded $ 20 million in 1994, and now this figure has reached the billion-dollar mark. Plastic cards are now accepted by thousands of retail outlets in Russia, and about a third of banks provide services.

Concept and technical characteristics of payment cards.
A bank card is understood as a means for drawing up settlement and other documents that are payable at the expense of the client, i.e. an individual or legal entity that has concluded an agreement with the credit institution issuing the bank card that provides for operations involving its use.
The main feature of a payment card is that it stores a certain set and amount of information, which allows it to serve as one of the means of organizing non-cash payments.

A payment card is a plastic rectangle with a special magnetic stripe, which stores information necessary for payments for goods (works, services) or for withdrawing cash from the amounts available on the card account.
In the Russian banking market, for a long time, all types of payment cards were referred to as credit cards. Only in the documents of recent years have bank cards become fairly called payment cards.
Bank cards can be credit or debit (settlement) cards that have different characteristics and provide their owners with completely different opportunities. You can also issue mixed types of cards that combine the features of credit and debit cards. In some cases, when certain conditions are met, the debit card may turn into a credit card.

Credit card It is a means of settlement in which the issuer assumes not only the obligation to transfer the client's funds to the accounts of its counterparties, but also the risk of immediate payment for goods, works and services of its owner within the credit limit set by it. A credit card allows its owner to defer payment of any purchase by obtaining a loan from the bank. The credit limit is determined by the issuing bank for each cardholder in their loan account. This account is completely independent of the client's regular (current, savings, etc.) bank account.

Debit cards are intended for immediate payment of goods, works and services by direct debiting funds from the cardholder's current account to the lender's account within the amount available there. In this case, if there are insufficient funds, the bank will not make payments, as the limit deposited when opening an account cannot be reduced, and the bank has not assumed any obligations for lending to the client.
From the point of view of technical capabilities, plastic cards can be classified into magnetic and microprocessor (or chip) ones.

Magnetic bank card is only a reflection of the owner's bank account: its magnetic indicator contains only information about the owner's name and bank account number. Therefore, when making payments using this card, each time you need to contact the central computer to get information about the amount of money required to pay for goods (works, services) on the account.
When using a magnetic card, you should go through the personification procedure-to clarify the fact that the card is owned by its bearer.

Chip card contains a microprocessor (chip) - a small square or oval on the front side, which contains all information about the bank account of its owner: the amount of money in the account, the maximum amount that can be withdrawn from the account at a time, and operations performed during the day.
The chip card does not need to be identified and personalized, which means that it can work in off-line mode, which does not require contacting the bank or company where the cardholder's account is opened in every necessary case.
A chip card is not only more reliably protected from forgery, but also provides a wider range of opportunities for operating an account: in addition to cashing money through an ATM, its owner can transfer funds from a card account to a deposit account or other, however, within the limits of the bank that issued the card.
The owner of a payment card can be either an individual who has a personal account with the issuing bank, or a legal entity that opens a corporate account.

Corporate card is opened for legal entities and is intended for managing the account of a legal entity.
Responsibility for improper use of the corporate card to the bank is borne by the legal entity-owner, and the individual-user, in turn, reports to the accounting department of the company for all expenses incurred on the corporate card.
In the Russian market, the so-called "salary" cards have become quite widespread. An employee of the company who has issued this type of card can receive a salary not in cash, but by transferring it to a special card account.

Banks that issue bank cards provide a service called acquiring.

Acquiring - service of retail and service points (shops, hotels, restaurants, motels, travel agencies, car rental points) by banks, where plastic cards of various systems are accepted as a means of payment.

The essence of acquiring is that the bank provides retail and service companies with a service that allows them to accept plastic cards for payment. The Bank installs special equipment for controlling plastic cards at payment points, adapts cash registers to this technology, and provides various methods of card authorization. The acquiring bank takes care of collection of payment documents (checks) and transfers cash receipts to the account of the store, restaurant, hotel, that is, the company for whose goods or services customers paid with plastic money.

Procedure for providing services and arranging credit card payments.
Participants in bank card transactions are:

• the bank that issues the card;
• customer who uses the card;
• card service point where the cardholder pays for the payment;
• processing (settlement) company - an organization that supports information flows within the system for servicing a significant number of banks and retail outlets.

When providing services at a retail outlet, the customer presents the credit card to the operator (cashier), who authorizes the customer's card.
Authorization of the card consists in checking the list of lost (seized) cards, its solvency, and identification of the cardholder. To do this, the operator communicates by phone, dedicated communication channels, or telecommunication systems with the center where the client's account is kept. Settlement centers receive an authorization code for their request to payment systems, which is the response of the credit card issuing bank. This stage is the most vulnerable in criminal terms.

The cardholder additionally authorizes the transaction by entering a personal identification number (PIN) known only to him / her into the cash register.
After performing all these operations, the seller is given a command to write off the required amount of money (purchase price, work or service) from the account.
After authorization, the card is inserted into a special device (imprinter), which contains three blank product receipt (slip).
The first one was handed over to the buyer, the second one was handed over to the collector, and the third one is transferred to the accounting department of the trade enterprise with the cash report. At the same time, a slip indicating the cardholder's name, card number, date of purchase, amount spent, type of payment system, store address, etc., is signed by the buyer and rolled in a special car. Later, the slips, as well as the slip registers compiled before the collector arrives, are handed over to the bank, which credits the funds due to the trade organization for the goods sold to it.

At this stage (making slips), it is also possible to commit criminal encroachments by forging checks.
If the amount of money in the account is insufficient for payments, the cardholder will be asked to use a different form of payment. If there are no funds on the account at all, the card will be placed on the stop-list (a list of blocked numbers that are not accepted for service), its validity will be suspended, and operations will be terminated.
Lost or stolen cards are also recorded in the stop-list, which eliminates the possibility of their unauthorized or malicious use.