A worldwide gang of criminals stole £29 million in a matter of hours by hacking their way into a database of pre-paid debit cards then draining cash machines around the world, US prosecutors said.
Seven people are under arrest in the US in connection with the case, which prosecutors said involved thousands of thefts from ATMs using bogus magnetic swipe cards carrying information from Middle Eastern banks.
The fraudsters moved with astounding speed to loot financial institutions around the world, working in cells including one in New York, Brooklyn US Attorney Loretta Lynch said. She called it "a massive 21st-century bank heist" carried out by brazen thieves.
One of the suspects was caught on surveillance cameras, his backpack increasingly loaded down with cash, authorities said. Others took photos of themselves with giant wads of notes as they made their way up and down Manhattan.
Hackers got into bank databases, eliminated withdrawal limits on pre-paid debit cards and created access codes. Others loaded that data on to any plastic card with a magnetic stripe - an old hotel key card or an expired credit card worked as long as it carried the account data and correct access codes.
A network of operatives then fanned out to rapidly withdraw money in multiple cities, authorities said. The cells would take a cut of the money, then launder it through expensive purchases or ship it wholesale to the global ringleaders. Ms Lynch did not say where they were located.
It appears no individuals lost money. The thieves plundered funds held by the banks that back up prepaid credit cards, not individual or business accounts, Ms Lynch said. She called it a "virtual criminal flash mob" and a security analyst said it was the biggest ATM fraud case she had heard of.
There were two separate attacks, one in December that reaped £3.2 million worldwide and one in February that snared about £26 million in 10 hours with about 36,000 transactions. The scheme involved attacks on two banks, Rakbank in the United Arab Emirates and the Bank of Muscat in Oman, prosecutors said.
The plundered ATMs were in Japan, Russia, Romania, Egypt, Colombia, Britain, Sri Lanka, Canada and several other countries, and law enforcement agencies from more than a dozen nations were involved in the investigation, US prosecutors said.
The accused ringleader in the US cell, Alberto Yusi Lajud-Pena, was reportedly killed in the Dominican Republic late last month, prosecutors said. More investigations continue and other arrests have been made in other countries. An indictment accused Lajud-Pena and the other seven New York suspects of withdrawing £1.8 million in cash from hacked accounts in less than a day.