Forest Global Training Partners

Cyber Risks · Krebs on Security

Stolen Passwords Fuel Cardless ATM Fraud

Summary: San Francisco resident Kristina Markula learned after a November 2016 trip to Cancun that someone had used her Chase online banking username and password to add a new phone number and device to her account, move $2,900 from savings to checking, and withdraw the cash from a Chase cardless ATM in Pembroke Pines, Florida. Chase rejected her fraud claim three times before spokesman Mike Fusco told KrebsOnSecurity the rejection was incorrect and that a group of a half-dozen fraudsters arrested in Columbus, Ohio had used the technique to empty Chase accounts during a cardless ATM pilot.

Why it matters: Cardless withdrawals skip the ATM PIN and, at the time, allowed up to $3,000 per transaction during business hours at branch ATMs - and cash withdrawals fall under Regulation E rather than the card networks' zero liability rules, so the bank's own investigation decides whether you are made whole.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related