[ISN] Citibank ATM fraud 'just tip of iceberg' - analyst

[InfoSec News]

http://www.theregister.co.uk/2006/03/13/citibank_fraud_follow-up/

By John Leyden
13th March 2006

An ongoing ATM fraud problem that forced Citibank into reissuing an
unspecified number of US credit and debit cards is only part of a
larger ongoing threat, a leading analyst warns. Avivah Litan, a
research director at Gartner, said that Citibank is only one of a
number of victims and that the banking industry is "less than halfway
through this latest scam, which will continue to affect large numbers
of cardholders".

Citibank said it blocked PIN-based transactions of Citi-branded
MasterCard cards in the UK, Russia and Canada to protect US customer
accounts. It blamed the problem on a security breach involving an
unspecified US retailer. Litan, by contrast, suggests the theft of PIN
data is the more likely cause of the security flap. She adds that
other US banks have been forced to reissue ATM cards after customers'
details were compromised.

"Gartner believes that these combined bank actions reflect the largest
PIN theft to date — and point to a new wave of 'PIN block' card
fraud," Litan writes. If hackers broke into retailer servers and steal
PIN blocks that represent encrypted PIN data as well as terminal
encryption keys (typically stored on retailers' terminal controllers),
they might be able to determine a cardholder's PIN and create
counterfeit cards that enable them to withdraw cash at ATM machines.

Litan reckons that this - rather than a simple retailer breach -
accounts for a recent rise in ATM fraud affecting US banks. "In this
particular scam, the thieves probably also stole (likely from a
retailer) magnetic-stripe data found on the back of ATM cards, which
large banks typically validate," she adds.

The Payment Card Industry (PCI) Data Security standard prohibits the
storage of PIN blocks and covers terminal operations. Gartner advises
card issuers to follow this guidance. The analyst firm also has advice
for enterprises, payment vendors and regulators which can be reviewed
here [1]. ®

[1] http://www.gartner.com/DisplayDocument?doc_cd=138479