ATM numbers cracked in 15 attempts

Paul Vecchiatto
By Paul Vecchiatto, ITWeb Cape Town correspondent
Cape Town, 24 Feb 2003

Citibank of the US and credit card company Diners Club International have instituted proceedings to gag possible witnesses in a "phantom ATM" withdrawal case that is before the Durban High Court.

In a civil case, Diners Club SA accuses two individuals, Anil Singh and Vanitha Singh, of defrauding the ATM network.

The case is still in its infancy and it centres on what is described as "phantom withdrawals" made in Sandton during 2000.

The Durban Supreme Court requested expert witnesses from the UK to provide testimony.

The Register reports that the defence wanted to know just how secure the ATM network is and a couple of British researchers based at Cambridge University said they would check.

The two researchers, Mike Bond and Piotr Zielinski, discovered that - despite endless security controls - a bank insider could crack a cashpoint card`s personal identity number (PIN) on an internal bank network in an average of 15 tries, rather than the 5 000 tries that the ATM networks claim.

This means that someone with inside knowledge could easily grab several million rands, or pounds, or any currency, in a very short time. It also hangs a big question mark over the security of the ATM networks.

The PIN number incident will further shake the global credit card industry, which was rocked last week by news that a hacker had accessed about eight million credit cards in the US.

Diners Club International has brought an application to the British courts requesting that any expert testimony from current or former employees at Citibank`s Farnborough facility should be held in camera so that trade secrets are not revealed.

A statement by its lawyer states that while the Farnborough facility does not issue PIN numbers or approve transactions, it monitors about $836 million worth of transactions on a global scale per day. It wants any of the potential 13 witnesses requested by the defence to either be excused from testifying or give their testimony in private.

Diners Club SA refused to comment.