The gang used counterfeit Standard Bank credit cards to withdraw 1.4 billion yen ($13 million) in 14,000 transactions from ATMs at 7-Eleven convenience stores over three hours on a Sunday morning, according to a source familiar with the matter.
Most ATMs in the 7-Eleven stores belong to Seven Bank, a Japanese bank part-owned by Seven & I Holdings which runs the store chain in Japan, one of only two Japanese banks that allow withdrawals on foreign cards.
The thieves are still at large.
“They were smart in selecting Japan,” said one banking security consultant who asked not to be identified.
“They found a badly protected ATM network in a low-risk country, guessing that the fraud analytics software would not automatically block the transactions.”
South Africa’s Standard Bank said on Monday it had suffered the losses, not its customers, and that it had alerted the authorities. It estimated its total loss at R300 million.
The bank declined to comment further on Tuesday.
Seven Bank said it was cooperating with police. Japan’s banking regulator, the Financial Services Authority (FSA), and Japanese police declined to comment.
Seven has about 22,000 ATMs across the country. Japan Post Bank also accepts overseas credit cards, but only about 540 of its 27,000 are open 24 hours a day.
Reports in Japanese media said the withdrawals were made on 15 May at ATMs in Tokyo and 16 prefectures across Japan’s main island Honshu and neighbouring Kyushu. That would have taken a substantial number of “mules” to make the transactions and ferry the cash, said experts.
“($13 million) in a matter of hours is nothing short of blinding,” said Dan Kelly, a Hong Kong-based cybersecurity researcher at Dragon Threat Labs.
“The use of loopholes in the bank’s procedures makes sense, but trying to rustle up a mule network in one country without making too much noise can’t be easy.”
