Skimming the Surface of Japanese ATM Fraud

In the May 3 issue of the Daily Yomiuri Online, there’s an article about ATM fraud in Tokyo that, if the details are true, provides a fascinating glimpse into possible ties between traditional Japanese organized crime and Chinese identity-theft operations. [http://www.yomiuri.co.jp/dy/national/20060503TDY02001.htm] According to the article, an alleged gangster with ties to the Yamaguchi-gumi crime syndicate, Koji Shishido, was arrested by Tokyo Metropolitan Police on charges relating to an ATM fraud case.

Shishido reportedly told the Tokyo police on April 13 that in August 2005, he was sitting in a coffee house in Ueno, Tokyo, when a late-middle-aged Chinese man who spoke Japanese approached him. The man supposedly told Shishido that “he was counterfeiting ATM cards using [miniature] cameras [mounted near ATMs], and that he had a plan to use the cards to take money out of people's accounts." When the police asked why someone would approach him in that manner, Shishido reportedly replied – tongue presumably planted firmly in cheek – that "I guess he thought I looked and dressed like a gangster."

The deal that they struck gave Shishido a 20 percent commission on funds that were withdrawn using counterfeit ATM cards that the Chinese group helped to make. Shishido reportedly proceeded to recruit people from cellphone Internet message boards to participate in the ATM fraud scheme. At least 20 recruits “were put up in hotels in August in Asakusa, Tokyo, and near JR Sugamo Station, where they were based during their two months of repeated identity theft.” Also, cameras were mounted near ATMs of what was then UFJ Bank to record data on the bank's customers. To date, the Daily Yomiuri reports that 17 Japanese men and women, including Shishido, have been arrested in connection with the case.

One critical detail, however, is missing from the article. While the cameras could certainly record PINs that customers typed on the keypads, how did the counterfeit-card ring get the bank account numbers associated with the real customers’ cards? The most logical conclusion, given the speed with which bank customers would have approached ATMs and conducted transactions, would be skimmers mounted on the ATMs. Reports of portable credit-card skimmers in Japan go back to at least 2002 [http://search.japantimes.co.jp/print/features/media2005/fd20050130tc.htm], but the only reason to use cameras near the ATMs is to capture the PIN while the actual card is in the customer’s possession. Hand-held skimmers wouldn’t have fit the bill.

Last year, a Japanese Financial Services Agency panel that studied bank card-related crime recommended several measures to reduce the incidence of ATM fraud: replacing magnetic-stripe cards with integrated-circuit cards to make the cards harder to counterfeit, putting expiration dates on cards, lowering the maximum ATM withdrawal to perhaps 500,000 yen (equivalent at that time to a surprising US $4,585) per day, and considering changing the standard four-digit PIN to something more complex. [http://search.japantimes.co.jp/print/business/nb06-2005/nb20050625a2.htm] Curiously, there was no mention of measures to counteract ATM-mounted skimmers, even though those have been in use in Asia, Australia, New Zealand, and North America for some time. Nor is there any mention of ATM-mounted skimmers in other articles about ATM fraud in Japan. A substantial part of the story about ATM fraud trends in Japan has yet to be told.