This article makes it more clear why everything was kept quite quiet on this investigation, as arrests are now being made.  In fact the breadth of the problem is more than we knew earlier, with other merchants involved.

"Some of these arrest were linked to recent nationwide compromises of debit-card customer information and PINs involving a number of retailers and debit card issuers,"

 What is intriguiing, is that the investigation began on something else, and landed on the "Citi" thing as part of that broader investigation.

Operation Rolling Stone, which originally did not focus on the epidemic of debit-card fraud, has at least exposed some new leads, Cherry said.

Here is the detail, thanks to SecurityFocus. 

Relevance to Bankwatch:

 Stated quite eloquently in the article: "Moreover, the companies that are the source of the breaches should acknowledge the incidents and take responsibility". 

 _________________________________________________

Robert Lemos, SecurityFocus 2006-03-31

The U.S. Secret Service arrested seven people across the nation this week as part of an ongoing investigation that has turned up links to the massive debit-card breaches that have worried banks and consumers.

The investigation, dubbed Operation Rolling Stone, has resulted in 21 arrests in the last three months and involves local, state and international law enforcement. The online uncover operation targets Internet criminal groups that "threaten our financial infrastructure," Jonathan Cherry, spokesman for the U.S. Secret Service, told SecurityFocus.

Continue reading “Secret Service make arrests in the Citi ATM fraud”

 The criminals are always one step ahead.  Banks continually come out with safety suggestions, and on is to never link to a banking site, always type in the URL.  In this example the criminals are able to spoof that, by hacking the ISP that hosted the Banks site, and redirecting legitimate customers to a fake site, where they (the criminals) gathered the customers usernames and passwords.

Banks Hit With New Spoofing Attacks – Yahoo! News

Thu Mar 30, 11:00 AM ETThree Florida banks have had their Web sites compromised by hackers in an attack that security experts are calling the first of its type.

.. attackers were able to hack servers run by the Internet service provider that hosted the three banks' Web sites. They then redirected traffic from the legitimate Web sites to a bogus server, designed to resemble the banking sites,

… Users were then asked to enter credit card numbers, PINs, and other types of sensitive information

Continue reading “Banks have to deal with significant ambiguity relative to security”