Slashdot Mirror
Stealing From Banks One Cent at a Time
JRHelgeson writes "In a story strangely reminiscent of Superman 3, a 'hacker' allegedly stole over $50,000 from PayPal, Google Checkout as well as several unnamed online brokerage firms. When opening an online brokering account it is common practice for companies such as E-trade and Schwab to send a tiny payment — ranging from only a few cents to a couple of dollars — to verify that the user has access to the bank account listed. According to the story, the attacker wrote a script that opened thousands of accounts at dozens of these providers. He was arrested not for taking the money, but for using false names in order to get it."
When reached for comment, the "hacker" had this to say:
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
What the fuck does that mean?!
How is this like Superman 3? I thought the point in that movie was to shave off the remainders in interest calculations. This is just a simple case of seeing someone transfer a few cents to your account when you open it and trying to abuse the system. The problem of course is that it's extremely obvious and you'll get caught, just like this guy did.
I read the internet for the articles.
I have used similar services in the past. They always remove the money after the transaction. How did this guy prevent that from happening?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
I had this very idea a few days ago when paypal put two 40 cent payments in my checking account. Thank god I didn't go with it, eh?
No.. when I change my credit card information on PayPal they deduct 15SEK that and then I get them back on my PayPal account (from which they take a percentage?) So it's realy PayPal that steals?
As far as I can tell, the article doesn't actually mention that Largent managed to rip off PayPal, only that PayPal, Google Checkout, et al. use the small deposit method for verification. Seriously, reading for comprehension isn't hard, people. Hell, it even mentions the scope right in the lede.
They that would sacrifice their
Totally stole my idea. That jerk!
Of course he wasn't arrested for taking the money. Said institutions willingly deposited that money into his account(s), yes? And these institutions did so under the pretense that this was to identify the customer? So the charge makes sense. The guy didn't steal money, it was given to him... a "him" with a fake identity.
Proudly supporting the Libertarian Party.
If you have to make up a name or SSN to open the account, then in fact, you are doing something wrong. Color me simple, but that's the way I see it. :\
This is clearly a case where a novel approach to crime is still, well, criminal.
Man, they'll throw the "Hacker" label on anyone these days, won't they?
Those who believe the Internet is private,
find their privates are on the Internet.
Damn it feels good to be a gangsta.
The most you'll do is a few years in one of those "country club" prisons, right?
Wire fraud? Bank fraud? Don't you need to have done these actions against actual banks for these kinds of charges to get levied?
At least his script didn't almost capsize the oil tankers... people would be super pissed off then.
Don't drop the kryptonite in the shower.
The amounts were being deposited into the same few bank accounts. The thing I can't figure out is, given the sheer number of transactions involved, how was this not spotted sooner?
If there was an assumption that it wasn't worth it prior to this (due to the tiny amounts involved in a genuine authentication check), I assume now they will implement a system that flags a bank account which receives authenticating deposits over a certain number.
when he started using names like...
Haywood Jablome
Connie Lingus
Dick Trickle
Seymour Butts
Hugh Jass
Ben Dover
Should of used a better name generator.
Namaste
This is like the penny jar, except a whole lot of pennies and nobody gets hurt.
At least he did not create a script that automatically rounded every payment up to the nearest... oh wait...
Even if he gets a fine, he can always apply to pay off the debt in small payments - say a few cents every time...
Reminds me of a debt my father picked up from a school my sister attended for less then a week. They charged him for a whole year. Not to be deterred he promptly paid them half the amount they invoiced him for. Months later and six angry letters later he paid them half of the sum they asked for. Months later.. ah well, I am sure you can see the pattern here. Fast forward 14 years and they finally wrote of the rest of his debt (I think 1GPB) as a good will gesture (and I am reliably informed he is legend in the schools finance department). I have no idea how much the administration cost to school at the end of it, but it all seemed good natured enough.
You know what I'd do with $50,000? 2 chicks at the same time.
if this is worth attempting, especially in the trading industry.
(IANOC)
They really don't care if $2 million goes missing on a trade, so who the hell's going notice that it's a penny short?
Think about it, millions of trades going through the system each day and you, the IT developer, shave a single penny off each one of them. You could almost retire by the end of the month.
Now all I have to do is wait for this Credit Crunch to end and apply for a job working in the Front Office.
Summation 2
Since when taking money from chumps is called an attack? Google and Paypal set up the system and they paid out carelessly, why call this ingenious programmer an attacker?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I remember the interest rounding hack of the 80s. Bank IT personell at a few occasions got the smart idea to transfer rounding remainders from interest calculations onto an internal bank account. The extra small micro sums (fractions of currency units) from all interest calculations would quickly add up to many millions, virtually producing money from nothing. A few got caught, but I wonder how many IT guys at banks actually got away with that.
AFAICT the same thing should still be possible today when interests are calculated. Probably such tapering is prevented by tighter controll of IT personell and independant reviewing.
However I think it's still the most elegant form of bank-'robbery'. Has anyone heard of simular more recent incidents of this sort of thing?
We suffer more in our imagination than in reality. - Seneca
Banks:
Stealing from customers one cent at a time.
I don't understand how he managed to do this. He can't use 50,000 bank accounts. There aren't 50,000 payment services. So why would any of them send a few cents to the same bank account more than once?
Can anyone explain this to me? It makes no sense at all.
... does he have a script to return the money?
I'm a minority race. Save your vitriol for white people.
penniesforeveryone
How many hours of community service do you get for 58,000 counts of petty theft?
SJW: Someone who has run out of real oppression, and has to fake it.
It's obvious he knew exactly what he was doing, and he knew it was wrong. But you have to acknowledge the inventiveness and sheer perseverance.
The twitter monologues. Click on my homepage and be amazed.
Such rumors have been common, though it's rare to see documented evidence.
In the 1980's John Forster wrote "The Ballad of Silicon Slim", a country/western ballad song about a home computing thief. An excerpt:
In the dead of night he'd access each depositor's account
And from each of them he'd siphon off the teeniest amount.
And since no one ever noticed that there'd even been a crime
He stole forty million dollars -- a penny at a time!
Little Janet was only eight but she had her own account
And the seven dollars in it was to her a huge amount.
So the day that penny vanished one unhappy little tot
Screamed, "Hey, what happened to my penny?"
And the teller tried to tell her but could not.
(Or check the Risks Digest of 3 February 1992)
Clearly No QA process to check repeated micropayments to the same bank account number.
Or perhaps this is how he got caught?
The financial industry has such a thin veneer of sophistication.
Sign up for a gazillion Paypal accounts, use ONE bank account, and after Paypal
... hurry.
deposits the money, withdraw the money and close the account.
Profit !!!!! And a fitting end to Paypal. Pennies DO add up. The transaction
costs alone would bankrupt Paypal. Somebody write a script
Peter: "That virus you're always talking about, right? The one that could, uh, rip off the company for a bunch of money."
Michael: "Yeah, what about it?"
Peter: "Well, how does it work?"
Michael: "It's pretty brilliant. What it does is, every time there's a bank transaction where interest is competed, you know, thousands a day, the computer ends up with these fractions of acent, which it usually rounds off. What this does is, it takes those little remainders and puts it into an account."
Peter: "This sounds familiar."
Michael: "Yeah, they did it in Superman III."
Peter: "Right."
Michael: "Yeah. Underrated movie, actually. And then there were a bunch of hackers, did it in the '70s as well. One of them got busted."
Peter: "Well, so they check for this now."
Michael: "No, here's the thing. Initech's so backed up with all the software we're updating for the year 2000, they'd never notice."
Peter: "You're right. And even if they wanted to, they couldn't check all that code."
Michael: "Thumbs up their asses. Thumbs up their asses."
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
...where the heck are the captcha's?... if there was a solid use of captcha's on the sign-ups, it would take a serious amount of processing to ding through each sign-up. Certainly would take more than "scripts".
Dang, I had to even confirm a captcha just to post this stupid message!
PayPal is called a 'bank' now?
Huh. Learned something new - thanks! I always thought Salami Attack was a bad 80s porn movie...
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
He should have burned down the interweb!
What I find interesting about this is that none of the other institutions noticed they were depositing all those separate pennies into the same account. I would think they would have safe guards that would come up and say, hey we already have made a deposit to that account; but, based on the article it was his bank that noticed....
if I truly wanted to...
Look at this from Paypal's perspective: you've got millions of people trying to sign up on your system. Statistically speaking, hundreds of thousands of them are not so bright, and will do things like forget they already tried signing up, not see their bank statement and try doing it again, etc. Since the cost of re-authenticating them is less than a buck (mostly for the ACH transfer fees) and the expected lifetime value of the account is still (for Paypal = eBay) anywhere from $10 to several hundred to depending on where you got the lead, obviously you want to let them try it again.
So we've disposed with the rationale for prohibiting 2 verifications. Now we need to draw a line somewhere. Here's what goes through this engineer's brain: it isn't obvious to me that putting the line at 3 is any better than putting it at 2. The possibility of exploit is remote, the damage from exploit is minimal and containable, engineer time is expensive, there might be some legal/regulatory/compliance issues that prohibit me from solving this problem in a minute by arbitrarily setting MAX_VERIFICATION_TRANSFERS to 20, and any restriction multiplied by millions of customers causes support problems and the attendant costs.
So yeah, I think that not doing the seemingly obvious thing is defensible here. The goal of Paypal/the bnaks/etc isn't to be fraud free, it is to maximize profits. Sometimes, the profit maximizing path means tolerating security risks with minor impact and non-trivial costs to address. Did it work for Paypal in this instance? Well, yeah -- they had about a decade of no problems and then when a problem finally did crop up it cost them less than a man-month to resolve. Easy peasy.
Help poke pirates in the eyepatch, arr.
there is someone arguing it wasn't illegal:
Why didnt he use 7-eleven defense? They're pennies for everybody!
Damn it feels good to be a gangsta
Feedin' the poor and hepin out wit they bills
Although I was born in Jamaica
Now I'm in the US makin' deals
/white
//not a gangsta
Soo... Could it be done legally?
Say, a town of 10000 - 100000 (or more) humans tries to do something like this.
Say, the town needs to refurbish its community center or a kids' playground.
Set up couple of bank accounts, and have real people, with real info use them for registration.
Would that be illegal?
Mit der Dummheit kämpfen Götter selbst vergebens
Instead of transferring it into your own account transfer it into the account of someone you hate. Getting someone's account number is actually not all that difficult. It's on every check they write for instance. Mmmm. The sweet taste of revenge.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
Our credit card processor overcharges the sales tax on the monthly charge by $.01 every month...i think someone has beat you to it in most cases...
:(
Kinda worried actually because either:
1. Someone messed with the computer and is stealing a penny each month.
2. They can't calculate the percentage correctly?!? This is all they do is figure percentages of things!!
The percent shown for tax is correct and there is nothing to round off so no rounding error. No, they don't give a damn even afteer they find out...still the same 6 months later
...one cent at t time.
Steal a penny from the Banks - go to jail - Banks steals $10 from you - calls it a "service charge".
We need the banks (except the World Bank), but it is despicable that they are allowed to play with our money the way they do. Twice I have been locked out of my money. And it was a weekend, so the banks were closed. I asked the 24/7 help guy from India what I should do, and his advice was: Can you borrow some money from someone until Monday when the bank opens?
The phaomnneil pweor of the hmuan mnid. Fcuknig amzanig eh!
He went wrong by not having the money all deposited in one account, then the lump sum moved over to a swiss bank account or something of that nature. I'd imagine the banks could freeze it at some point however.
Something like..
swiss account
|
temporary account
|
Many, many temporary accounts
This space intentionally left blank
In the dead of night he'd access each depositor's account
And from each of them he'd siphon off the teeniest amount.
And since no one ever noticed that there'd even been a crime
He stole forty million dollars -- a penny at a time!
So you're saying he stole it once piece at a time and it didn't cost him a dime?
There's a Mr Cash on line one, something about being owed 20 years of back royalty payments on a country crime ballad.
0 1 - just my two bits
He had to use fake names and addresses. Could you imagine how much junk mail he would receive if he didn't?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
In this case, he's a hacker using the Slashdot/ESR definition, instead of the typical everyday definition. People around here should be excited.
I wonder how the script got around any kind of user authentication? I, for one, have problems reading those Captcha things with my eyes... I wonder how you'd get around those with a script.
Wait, you take them from the crippled children?
nt
I think the Superman-3/office-space like rounding error robbery was actually done in the 1950s.
I vaugly remember reading about it in a book called "computer crime" or "computer cappers" or something like that. I read about this in the 1970s, but I sorry if my memory is a bit foggy.
I walked over to the, to the bench there, and there is, Group W's where they put you if you may not be moral enough to join the army after committing your special crime, and there was all kinds of mean nasty ugly looking people on the bench there. Mother rapers. Father stabbers. Father rapers! Father rapers sitting right there on the bench next to me! And they was mean and nasty and ugly and horrible crime-type guys sitting on the bench next to me.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
Generating plausible SSNs is very easy to do. The Social Security Administration posts public info on how to verify numbers. They update that info monthly. Web pages like this one use that info to generate numbers that have probably been issued, will soon be issued and numbers that cannot possible be issued.
These were my ass pennies.
I think it's disproportionately slated because the kind of people most likely to discuss a Superman film are Superman fans. Being less focussed on Superman, missing Lois Lane and Lex Luthor, as well as being simply less serious, they probably see this as a lightweight sellout, and not what they want from a Superman film.
I can understand that, but that doesn't mean I agree with it. Yes, it's kind of cheesy (partly in retrospect) and maybe a bit silly for the fanboys' tastes- but then, isn't the whole Superman thing faintly silly anyway?! IMHO it's a fun film, the computer stuff is interesting, and the robot woman at the end was quite scary when you were like 7 years old.
I'd say that Superman II is better if you want a "proper" Superman film, but even the "Superman goes bad and fights himself" bit in III was good in this respect. Either way, I'll take it over the overrated first movie any day.
Superman IV *was* toss on toast, though
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
Too bad the big year 2000 crash did not happen :D
Some of it did happen. But mostly only small stuff.
The big foulup didn't happen because billions were spent to fix it in advance.
(Amdahl had a two-rack mainframe available at the time for a few bux under a million and for a couple years leading up to the big day something like half their sales were to companies that wanted a completely separate machine to test their Y2K fixes without risking the live, mission-critical processes.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
One bank I use deposits small amounts for verification purposes and then immediately withdraws them. They wouldn't fall victim to such a scam. I think it's ING Direct.
Now that Snopes has come out on the field, this XKCD is obligatory.
Do you smell that? It's the karma burning.
"I've spent my whole life figuring out crazy ways to do things. It'll work." -- Montgomery Scott, "Relics"
We could make tens of dollars a day. .... Sweet!
I am a name troll of Westlake. Visit my homepage to learn why.
Like Paypal and other banking/payment sites, TD Ameritrade deposits two transactions of a few cents each. Unlike Paypal, et al. A few days later they take back the few cents they deposited.
Yes, they're really that cheap.
This kind of attack hardly an invention of the movies. The salami attack has been around for a long time.
The rounding version of the "Salami slicing" attack, actually.
One of the earliest ones that was discovered took advantage of a bank's interest computation program's method of processing the accounts in alphabetic order by primary accountholder's name. It collected the rounding fractions and deposited them in the last account processed. The program's author opened an account with a bogus last name starting with "Z" to collect the slivers. Thus there was no hard-coded account number and the extra code was small and hard to spot.
Eventually somebody whose real name started with "Z" and was further along in the alphabet opened an account with the bank. When his interest payments far exceeded his balance he contacted the bank to find out what was wrong.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
i take exception to the constant kicking people give superman 3 - it's a comedy classic i tells ya! and the scene where superman fights himself in the junkyard... iconic moment. obviously superman 3 is not as classy and the first two, but it works in comic-book come to life kind of way.
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
He wasn't "Stealing from Banks". As you know, Paypal is not a bank. Google Checkout is not a bank either.
Neither are required to safeguard your money the same way a bank does. Paypal can and often does freeze the deposits in accounts for it's members without warning and your recourse towards unfreezing accounts leaves much to be said.
FWIW, there is a new Person-to-Person payment competitor to Paypal that is actually run by a bank and your deposits are FDIC insured. It's called Revolution Money Exchange. It's currently free like Paypal was in the beginning but I'm sure they'll add more fees sooner or later.
How could he be "Stealing from Banks" when Paypal is not a bank. Google Checkout is not a bank either.
Neither are required to safeguard your money the same way a bank does. Paypal can and often does freeze the deposits in accounts for it's members without warning and your recourse towards unfreezing accounts leaves much to be said. I haven't heard horror stories about Google Checkout but they are not a bank either - they are a payment processor for merchants.
FWIW, there is a new Person-to-Person payment competitor to Paypal that is actually run by a bank and your deposits are FDIC insured. It's called Revolution Money Exchange. It's currently free like Paypal was in the beginning but I'm sure they'll add more fees sooner or later.
Oh, and if you sign up for Revolution, you get a couple pennies deposited to any accounts you link to it, so don't sign up 50,000 times under a fake name or you'll be stealing from a Bank for real!!!
I've had a fair number of times when a credit/debit card transaction went through, and it turned out it was for 1 or 2 cents more than what I had on my original receipt.
Typically, this seems to happen with purchases made at restaurants, where you write in a tip on the receipt before leaving it with a server.
Is this really done on purpose, or perhaps just someone transposing numbers or being sloppy when keying in the amount to be billed? Wouldn't doubt some of each happens, but in any case - who is going to really put up a big fight over a penny in a case like this? Only reason I ever notice it is because I track all my finances in Quicken, and manually enter every paper receipt I bring home.
"How come the security has called us op? Like we're going to steal something..."
-"I stole something."
"I guess we all do..."
-"No I stole something else..."
Here be signatures
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
This reminds me of the that movie from the 1980s with Richard Pryor (iirc) where he takes the 1/2 cent from everyone's paycheck. He gets an extra check and it's a million dollars or something like that.
I work for a large retailer. One day we realized that the register hardly ever figured the same sales tax as we do, even with a calculator and the right .001 of a percent. Well we came to this conclusion. It does not charge tax on the subtotal of your transaction. It charges tax on each item individually. I have heard that we are NOT the only place that does this. I honestly don't know who but if the walmarts of the world do this. You can only imagine how much money this could be in a years time.
even lower
Shortest path from salami attack to anal rape
Salami attack
Fraud
Crime
Rape
3 clicks needed
Me lost me cookie at the disco.
Full of the "credits" here, "debits" there, etc, lots of joke decision boxes,but with a "special subroutine" near the end.
We drew some "rounding" routine near the end, implying that all rounding was to be done to the lower cent.
All excess pennies accumulated from rounding were sent to a special fund- "Booze for the I.S. xmas office party" or some such designation.
The I.S. V.P. (probably called the CIO these days) walked in one day, and chuckled at the flowchart.
That is, until he came to that "rounding" logic. He mildly freaked, and quickly told us in no uncertain terms that if the accounting people ever saw this, there would be hell to pay, and he then erased it immediately.
.
- aqk
F U
I track things the same way, but I've never seen that. You might just be unlucky.