Russian Hackers Steal Check Images On A Large Scale

This is not your grand-father's check theft anymore.

Boston Globe:

Internet crooks target check images

Hackers write $9m in fakes on 1,200 accounts

By Jordan Robertson, Associated Press  |  July 28, 2010

SAN FRANCISCO — Think of it as one more reason not to write checks.

Hackers believed to be operating out of Russia have figured out a high-tech way to carry out the decidedly low-tech crime of check fraud, a computer security company says, writing at least $9 million in fakes against more than 1,200 legitimate accounts.

But these hackers got the account information in an unusual way: They broke into three websites that specialize in a little-known type of business, archiving check images online.

Check counterfeiting is a crime that savvy Internet criminals usually pass up. After all, it’s far easier for them to make money by stealing credit card numbers and online banking passwords.

The scam was discovered by SecureWorks Inc., an Atlanta computer security company. It’s working with the FBI and says the hackers have not been caught.

Retailers and other businesses use the sites to store records of all the checks they write. Check-cashing operations use them to sock away images of checks they receive. And some banks pay them to store images of customers’ checks, so the customers can see them when they log in to their online banking accounts.

The criminals downloaded all the images they could find, grabbing bank routing numbers, names and addresses, and signatures of account holders. They used the information to create their own checks with easy-to-acquire software and printers.

Because the account information is real and the victims don’t know their accounts have been compromised, the odds of the checks going through are high.

SecureWorks notified the three sites and said they have closed their security holes, but warned that the scam is ongoing and is targeting other, similar sites.

“It’s not the standard kind of criminal operation,’’ said Joe Stewart, director of malware research for SecureWorks’ Counter Threat Unit.

“Check counterfeiting is kind of old-school, but these guys have figured out how to make it highly automated,’’ he said. “They can get all this data and use that to write counterfeit checks all day long.’’ [More]

posted by: gqjournal