The Federal Bureau of Investigation has issued a warning that cybercriminals are planning a global attack on financial institutions that involves hacking systems and stealing millions of dollars via automatic teller machines.

Dubbed “ATM cash-out,” the attack is said to involve unnamed criminals compromising a financial institution with malware to access customer card information, alter account balances and disable maximum ATM withdrawal amounts and transaction limits.

“The FBI has obtained unspecified reporting indicating cybercriminals are planning to conduct a global ATM cash-out scheme in the coming days, likely associated with an unknown card issuer breach and commonly referred to as an ‘unlimited operation,’” a confidential alert from the FBI obtained Sunday by security researcher Brian Krebs stated.

The warning noted that small-to-medium size financial institutions were more likely to be targeted “due to less robust implementation of cybersecurity controls, budgets, or third-party vendor vulnerabilities.” It also said that after hacking or phishing their way into targeted networks, the cybercriminals remove fraud controls just prior to the withdrawal stage.

“The cybercriminals typically create fraudulent copies of legitimate cards by sending stolen card data to co-conspirators who imprint the data on reusable magnetic strip cards, such as gift cards purchased at retail stores,” the FBI noted. “At a pre-determined time, the co-conspirators withdraw account funds from ATMs using these cards.”

Cybercriminals targeting ATM networks are not new. Skimming operations, which involve placing hardware on top of an ATM to capture card details or implanting malicious code in an ATM, are fairly common. Where this appears to be different is that the attack is also a global campaign targeting banking systems to maximize the potential haul from the attack.

The FBI is encouraging banks to implement improved security procedures both to prevent an attack and to detect one if and when it occurs. Recommendations include implementing strong password requirements, the use of two-factor authentication and enhanced network monitoring and auditing.

Photo: Pexels