Defendants Elvis Rafael Rodriguez and Emir Yasser Yeje posing with approximately $40,000 with cash. Source: US Attorney, Eastern District of New York
If you’d been waiting for the ATM inside the deli at East 59th and Third in Manhattan on Tuesday, February 19th around 9:24PM, you would have been annoyed. A young man in a black beanie and puffy black jacket made seven withdrawals in a row, stuffing around $5,620 into his blue backpack. The man wasted no time. He exited the deli and headed up five blocks to repeat the process at four more ATMs, finishing his route at a Chase bank at 69th and Third at 9:55PM, where he made four withdrawals totaling $4,000.
While the man in the black beanie was beelining along the Upper East Side, seven of his co-conspirators were doing the same thing across Manhattan, repeatedly swiping prepaid debit cards that seemed to be limitless. An unknown number of fellow “cashiers” were doing the same thing in Japan and 24 other countries around the world at the same time. The cashiers in Japan were pulling in even greater hauls, thanks to the $10,000 withdrawal limits at some machines.
A shadowy criminal ring netted nearly $45 million in cash
The man in the black beanie was part of a sophisticated “Unlimited Operation,” according to prosecutors in New York. Hackers allegedly broke into the computer systems of at least two credit card processing companies, stole prepaid debit card account numbers and programmed them with astronomical balances. Normally, prepaid debit cards are capped according to how much the customer paid for the card; the hackers essentially created infinite cards.
The account numbers were then emailed or texted to accomplices on the ground, who used a device called a “skimmer” to encode the account numbers onto the magnetic stripes of dummy cards. The groundlings then went on a withdrawal spree, hitting as many ATMs as they could in a matter of hours, while the hackers watched the transactions from behind remote screens, in real time. Between two tightly-coordinated heists, the shadowy criminal ring netted nearly $45 million in cash.
“The cyberattacks employed by the defendants and their co-conspirators in this case are known in the cyber underworld as ‘Unlimited Operations,’” the United States attorney for the Eastern District, which is prosecuting the case in New York, said in a statement. “These attacks rely upon both highly sophisticated hackers and organized criminal cells whose role is to withdraw the cash as quickly as possible.”
Unlimited Operations are marked by three key characteristics, the attorney’s office said.