Surcharges Fuel Industry
The system that beckoned Mr. Frljuckic runs on the ever-accruing stream of money from the surcharges first widely permitted in 1996. Today, many customers pay twice — usually $1 to $3 to the owner of the machine, and $1 to $1.50 to the bank that issued the card. A.T.M. fees now add up to $4.5 billion annually, according to Dove Consulting, a Boston-based firm.
An A.T.M. entrepreneur needs a machine and cash, which can be borrowed, to stock it, and a bank account, so that when a cardholder withdraws money, the cardholder's bank has some place to send the reimbursement. What the owner does not need is a license or government approval.
New owners are supposed to be evaluated by what are known as independent service organizations, or I.S.O.'s, which connect privately owned machines to the network. Each I.S.O., in turn, must be sponsored by a bank.
But the I.S.O.'s and banks have a spotty record of oversight, according to some in the A.T.M. industry. Fraud investigators, for example, have sometimes had trouble establishing the owners and locations of specific A.T.M.'s.
"It's harder to switch a registration on your car than to move around an A.T.M.," said Gregg James, a Secret Service agent who investigates financial crime.
The system, if not properly supervised, can be used to launder money. An owner can stock a machine with the proceeds from crime and then, after withdrawals, be reimbursed from customers' banks with "clean" currency.
The American Bankers Association says its members do not see money laundering as a problem. "That's not something that's come to my attention," said John Byrne, a lawyer with the association.
It has, however, caught the attention of the Secret Service and other federal officials. In 2000, an Indiana man pleaded guilty to laundering money through his machines. Another A.T.M. money-laundering case is awaiting trial in California.
"When I found out what he was doing I thought, `Ah, the perfect scheme,' " said Donna Eide, the prosecutor in the Indiana case. "It's a perfect way to get cash back into the system without reports being filed."
Small Store Owners Used
Nasser Alomari is typical of the small New York store owners who became unwitting accomplices in Mr. Frljuckic's widening fraud, investigators say.
Mr. Alomari, a Yemeni immigrant, had originally owned his own A.T.M. in his delicatessen, now the 10th Avenue Gourmet, in Manhattan. A private company serviced the machine, paying him $1 for each withdrawal. In a good month, that meant $600. And until one day in January 2002, that seemed enough. Then a stranger wearing a gold Rolex with diamond insets offered him a better return — $1.75.
He said the man insisted on installing his own A.T.M. Investigators say it had been fitted with a skimming device.
Federal records show that the man Mr. Alomari dealt with used an alias, as he had in buying 21 other machines. Investigators say he was Hamdija Frljuckic, brother of Iljmija. Hamdija Frljuckic began buying machines in August 2001 from a New Jersey independent service organization called Money Marketing.
"They knew the deep ins and outs of this business," a company spokesman, Eric Park, said. Money Marketing's vetting process conformed to the industry standard back then, he added, and included a review of a buyer's business records and driver's license. "I've never had a fake driver's license," he said. "How can you ever tell?"
Money Marketing says A.T.M. buyers now undergo criminal background checks and must produce, among other things, tax returns.
By early November 2001, investigators say, the thieves had collected account information from about 17,000 New Yorkers. The trap was set.
Similar Fraud Patterns
The first sign that something had gone seriously wrong came over that Veterans Day weekend.
Just as bank customers began to miss money in their accounts, unusual withdrawal patterns were being detected by computer analysts in the Arlington, Va., office of Fair Isaac. The analysts noticed something else: The patterns echoed those observed that year in California and Florida.
"Our investigators were 90 percent sure it was the same guys," said Mr. Urban of Fair Isaac. Investigators had another tactical advantage: With the highest daily withdrawal limit usually around $1,000, the thieves had to spend a lot of time feeding fake cards into machines. And during that time they were vulnerable.
Once Fair Isaac had identified compromised cards, their numbers were sent to NYCE, a company that connects A.T.M.'s and banks. Then, when a suspect card was used again, NYCE, using a software program called Rooster, pinpointed the location and contacted the Secret Service within seconds.
In New York's congested streets, though, getting there in time was a problem. "We had agents getting out of cars, running up the street," said Mr. James, the Secret Service agent.
In an escalating game of cat and mouse, the thieves began making withdrawals during lunch hour, when sidewalk and street congestion was at its worst. And they stopped feeding large numbers of cards into a single machine, instead slipping from one location to another.
"They would go in, hit an A.T.M., get on a subway, then go to the next A.T.M.," said Susan Zawodniak, executive director of the NYCE network.
To improve their odds, agents began staking out the sites of suspicious withdrawals. For five days, nothing. Then, on the evening of Nov. 15, Citibank told an agent, "approximately $7,000 had just been withdrawn from different accounts in rapid and successive transactions from the same A.T.M.," according to a Secret Service affidavit.
The agent rushed to the bank, where he found two other agents on stakeout. After a brief chase, they arrested a man seen leaving the bank. He was Fikret Korac, whom a federal prosecutor called "a criminal for most of his adult life." In his possession, agents said, they found 11 white plastic cards with magnetic strips and about $30,000.
Investigators viewed Mr. Korac as a low-level "runner." But after his arrest, prosecutors say, he called Hamdija Frljuckic, who quickly tried to withdraw $150,000 in cash from an account in a false name at J. P. Morgan Chase. But when he asked for the money in $100 bills, a suspicious bank officer refused, according to the Secret Service.
Within weeks, Hamdija Frljuckic was arrested — after visiting the machine at Nasser Alomari's store.
He is awaiting trial on charges relating to the A.T.M. thefts. But Iljmija Frljuckic remains at large.
"The main older brother flees with several million in a suitcase," an investigator said. "We have intelligence that he put A.T.M.'s in other places in the world."
Reached overseas by telephone, Mr. Frljuckic told The New York Times that he was willing to be interviewed where he was living, in Montenegro. But after several conversations to arrange the interview, he stopped returning calls.
In all, investigators say, the thieves withdrew money from 500 machines around New York City. The hardest-hit bank was Citibank, which lost about $1 million, said people close to the investigation.
Banks are reluctant to discuss the case. "Our hard and fast policy is we just don't discuss these sorts of things," a Citibank spokeswoman said.
At the state banking department, a spokeswoman, Bethany Blankley, said she knew little about the case because the compromised machines were not the agency's responsibility.
"We regulate the safety of the A.T.M. machines only for banks," she said, "not for supermarkets or little stands where you get cigarettes."
Industry Looks Inward
Last March, the A.T.M. industry gathered in Miami to meet with fraud investigators for some self-examination. The New York case was not the only one on their minds.
In late 2002, four Russians were arrested on charges of looting A.T.M.'s in Canada. Cardholders found their money disappearing in European cities they had not visited, including Paris, Amsterdam and Milan, according to a report filed by bank investigators.
The Canadian fraud seemed to replicate what prosecutors accuse Mr. Frljuckic of having done.
"The thing we found troubling," said H. Kurt Helwig, who runs the Electronic Funds Transfer Association, was that "this was organized crime."
An industry task force — including machine manufacturers, electronic networks and private machine owners — is fighting fraud through, among other things, better background checks and machines less prone to tampering. The hope is that these efforts will keep the government from stepping in. "It's a marketplace issue," Mr. Helwig said.
Because of their efforts, task force members say, skimming from private machines is not the danger it used to be. But concerns remain.
In March, Fair Isaac sent an "urgent notice" of thefts from A.T.M.'s in San Francisco and the Los Angeles area. Investigators say they believe those card numbers were stolen through skimming devices in privately owned machines.
But now more A.T.M. fraud seems to be occurring at bank-owned machines, industry officials say. They are refocusing their attention.
"It's almost as if the criminals were listening and watching," said Ms. Zawodniak of NYCE. "We build a 10-foot wall, and they build an 11-foot ladder."
The system that beckoned Mr. Frljuckic runs on the ever-accruing stream of money from the surcharges first widely permitted in 1996. Today, many customers pay twice — usually $1 to $3 to the owner of the machine, and $1 to $1.50 to the bank that issued the card. A.T.M. fees now add up to $4.5 billion annually, according to Dove Consulting, a Boston-based firm.
An A.T.M. entrepreneur needs a machine and cash, which can be borrowed, to stock it, and a bank account, so that when a cardholder withdraws money, the cardholder's bank has some place to send the reimbursement. What the owner does not need is a license or government approval.
New owners are supposed to be evaluated by what are known as independent service organizations, or I.S.O.'s, which connect privately owned machines to the network. Each I.S.O., in turn, must be sponsored by a bank.
But the I.S.O.'s and banks have a spotty record of oversight, according to some in the A.T.M. industry. Fraud investigators, for example, have sometimes had trouble establishing the owners and locations of specific A.T.M.'s.
"It's harder to switch a registration on your car than to move around an A.T.M.," said Gregg James, a Secret Service agent who investigates financial crime.
The system, if not properly supervised, can be used to launder money. An owner can stock a machine with the proceeds from crime and then, after withdrawals, be reimbursed from customers' banks with "clean" currency.
The American Bankers Association says its members do not see money laundering as a problem. "That's not something that's come to my attention," said John Byrne, a lawyer with the association.
It has, however, caught the attention of the Secret Service and other federal officials. In 2000, an Indiana man pleaded guilty to laundering money through his machines. Another A.T.M. money-laundering case is awaiting trial in California.
"When I found out what he was doing I thought, `Ah, the perfect scheme,' " said Donna Eide, the prosecutor in the Indiana case. "It's a perfect way to get cash back into the system without reports being filed."
Small Store Owners Used
Nasser Alomari is typical of the small New York store owners who became unwitting accomplices in Mr. Frljuckic's widening fraud, investigators say.
Mr. Alomari, a Yemeni immigrant, had originally owned his own A.T.M. in his delicatessen, now the 10th Avenue Gourmet, in Manhattan. A private company serviced the machine, paying him $1 for each withdrawal. In a good month, that meant $600. And until one day in January 2002, that seemed enough. Then a stranger wearing a gold Rolex with diamond insets offered him a better return — $1.75.
He said the man insisted on installing his own A.T.M. Investigators say it had been fitted with a skimming device.
Federal records show that the man Mr. Alomari dealt with used an alias, as he had in buying 21 other machines. Investigators say he was Hamdija Frljuckic, brother of Iljmija. Hamdija Frljuckic began buying machines in August 2001 from a New Jersey independent service organization called Money Marketing.
"They knew the deep ins and outs of this business," a company spokesman, Eric Park, said. Money Marketing's vetting process conformed to the industry standard back then, he added, and included a review of a buyer's business records and driver's license. "I've never had a fake driver's license," he said. "How can you ever tell?"
Money Marketing says A.T.M. buyers now undergo criminal background checks and must produce, among other things, tax returns.
By early November 2001, investigators say, the thieves had collected account information from about 17,000 New Yorkers. The trap was set.
Similar Fraud Patterns
The first sign that something had gone seriously wrong came over that Veterans Day weekend.
Just as bank customers began to miss money in their accounts, unusual withdrawal patterns were being detected by computer analysts in the Arlington, Va., office of Fair Isaac. The analysts noticed something else: The patterns echoed those observed that year in California and Florida.
"Our investigators were 90 percent sure it was the same guys," said Mr. Urban of Fair Isaac. Investigators had another tactical advantage: With the highest daily withdrawal limit usually around $1,000, the thieves had to spend a lot of time feeding fake cards into machines. And during that time they were vulnerable.
Once Fair Isaac had identified compromised cards, their numbers were sent to NYCE, a company that connects A.T.M.'s and banks. Then, when a suspect card was used again, NYCE, using a software program called Rooster, pinpointed the location and contacted the Secret Service within seconds.
In New York's congested streets, though, getting there in time was a problem. "We had agents getting out of cars, running up the street," said Mr. James, the Secret Service agent.
In an escalating game of cat and mouse, the thieves began making withdrawals during lunch hour, when sidewalk and street congestion was at its worst. And they stopped feeding large numbers of cards into a single machine, instead slipping from one location to another.
"They would go in, hit an A.T.M., get on a subway, then go to the next A.T.M.," said Susan Zawodniak, executive director of the NYCE network.
To improve their odds, agents began staking out the sites of suspicious withdrawals. For five days, nothing. Then, on the evening of Nov. 15, Citibank told an agent, "approximately $7,000 had just been withdrawn from different accounts in rapid and successive transactions from the same A.T.M.," according to a Secret Service affidavit.
The agent rushed to the bank, where he found two other agents on stakeout. After a brief chase, they arrested a man seen leaving the bank. He was Fikret Korac, whom a federal prosecutor called "a criminal for most of his adult life." In his possession, agents said, they found 11 white plastic cards with magnetic strips and about $30,000.
Investigators viewed Mr. Korac as a low-level "runner." But after his arrest, prosecutors say, he called Hamdija Frljuckic, who quickly tried to withdraw $150,000 in cash from an account in a false name at J. P. Morgan Chase. But when he asked for the money in $100 bills, a suspicious bank officer refused, according to the Secret Service.
Within weeks, Hamdija Frljuckic was arrested — after visiting the machine at Nasser Alomari's store.
He is awaiting trial on charges relating to the A.T.M. thefts. But Iljmija Frljuckic remains at large.
"The main older brother flees with several million in a suitcase," an investigator said. "We have intelligence that he put A.T.M.'s in other places in the world."
Reached overseas by telephone, Mr. Frljuckic told The New York Times that he was willing to be interviewed where he was living, in Montenegro. But after several conversations to arrange the interview, he stopped returning calls.
In all, investigators say, the thieves withdrew money from 500 machines around New York City. The hardest-hit bank was Citibank, which lost about $1 million, said people close to the investigation.
Banks are reluctant to discuss the case. "Our hard and fast policy is we just don't discuss these sorts of things," a Citibank spokeswoman said.
At the state banking department, a spokeswoman, Bethany Blankley, said she knew little about the case because the compromised machines were not the agency's responsibility.
"We regulate the safety of the A.T.M. machines only for banks," she said, "not for supermarkets or little stands where you get cigarettes."
Industry Looks Inward
Last March, the A.T.M. industry gathered in Miami to meet with fraud investigators for some self-examination. The New York case was not the only one on their minds.
In late 2002, four Russians were arrested on charges of looting A.T.M.'s in Canada. Cardholders found their money disappearing in European cities they had not visited, including Paris, Amsterdam and Milan, according to a report filed by bank investigators.
The Canadian fraud seemed to replicate what prosecutors accuse Mr. Frljuckic of having done.
"The thing we found troubling," said H. Kurt Helwig, who runs the Electronic Funds Transfer Association, was that "this was organized crime."
An industry task force — including machine manufacturers, electronic networks and private machine owners — is fighting fraud through, among other things, better background checks and machines less prone to tampering. The hope is that these efforts will keep the government from stepping in. "It's a marketplace issue," Mr. Helwig said.
Because of their efforts, task force members say, skimming from private machines is not the danger it used to be. But concerns remain.
In March, Fair Isaac sent an "urgent notice" of thefts from A.T.M.'s in San Francisco and the Los Angeles area. Investigators say they believe those card numbers were stolen through skimming devices in privately owned machines.
But now more A.T.M. fraud seems to be occurring at bank-owned machines, industry officials say. They are refocusing their attention.
"It's almost as if the criminals were listening and watching," said Ms. Zawodniak of NYCE. "We build a 10-foot wall, and they build an 11-foot ladder."
