It was a theft allegedly carried out on a massive scale, with military precision, and it repeatedly victimized the holders of debit and credit cards.
Two-dozen "runners" would allegedly be on standby at different ATM machines in the wee hours of the morning, awaiting a call from a ringleader. Upon getting the green light, they would start withdrawing money simultaneously from different machines, using cloned bank cards.
Police say it would only take five minutes. On just one such occasion, 79 bogus cards were allegedly used to make 203 transactions at 23 different bank machines – with the accused thieves getting away with $30,000.
The RCMP says that scam was being replayed multiple times each week in the Montreal area, as it announced a series of arrests Wednesday of alleged members of a $100-million debit- and credit-card scheme that had international ties.
Some members of the group are facing gangsterism charges – which police call a first for a Canadian fraud case – and Wednesday's arrests mark a first. A gangsterism conviction carries a mandatory minimum sentence.
Police said 46 people were arrested and about 60 raids were conducted in the Montreal area and in Ontario. More than a dozen others remained on the lam and police said other arrests were likely.
The RCMP calls the operation an international one: the alleged criminal group is believed to be associated with accomplices in Vancouver, as well as others operating in countries such as Australia, New Zealand, Malaysia, Tunisia and England.
"We are working with our international partners to assist them in identifying the stratagems within their own country," RCMP Supt. Guy Pilon told a news conference Wednesday.
"We believe that we've put an end to a significant operation that was [working]here in the province."
The highly organized operation was allegedly split into three cells with specific roles – leaders, technicians and runners.
Some members of the group were allegedly modifying ATM machines with fake PIN pads and tiny cameras. But the most popular scheme involved allegations of stealing point-of-sale PIN machines from businesses and restaurants and modifying them.
Police said stolen terminals would be taken to hotel rooms, where technicians would hack into the computer processors that held credit- and debit-card information. The terminals were rigged using Bluetooth technology so information could be relayed to fraudsters remotely.
The terminals were then returned before the next business day and would remain in place for several weeks while data was gleaned from customers and sent remotely to fraudsters.
The account information and PIN number would be transferred to blank cards. Runners would then use the cards in co-ordinated attacks, striking at bank machines at the same time.
RCMP Sgt. Yves Leblanc described one early morning attack – where $30,000 was drained from various bank accounts in the Montreal area in five minutes – before bank security divisions could stop it.
"This went on once, twice, three times a day. It went on maybe four or five times a week," Leblanc said.
While the fraud is estimated at $100-million, police worked to identify 22,000 victims defrauded of $7.7-million to help build their case.
Pilon said the investigation began in conjunction with Quebec provincial police in September, 2008, after financial institutions made several complaints to law enforcement.
He said the banks also helped police track down leaders of the ring.
The accused face 368 charges that include gangsterism, fraud and identity theft. Many appeared in court by video Wednesday.
None of those charged are employees of the businesses targeted, but police believe that in some cases the alleged fraudsters had inside help.
Police say there are simple solutions for businesses to defend against such a scam. In many cases, it's as easy as securing the terminal to a desk. While customers can also be vigilant, police say it's hard for them to know if a terminal has been tampered with.
"The police and the private sector need to work together to secure the environment," Pilon said.
Jacques Hebert, Quebec director for the Canadian Bankers' Association, says fraud costs Canadian banks about $500 million each year.
The Canadian Press