KARACHI: A private bank has confirmed that hundreds of its bank accounts were hacked through ATM (automated teller machine) cards as Federal Investigation Agency (FIA) officials said on Monday they were waiting for more details before launching a probe connecting this with a recent fraudulent activity in which several foreigners had been arrested for allegedly stealing data from banks with skimming devices at ATM facilities.

The Habib Bank Limited confirmed that over Rs10 million had been stolen from 559 of its accounts.

Naveed Asghar, a corporate and marketing executive of the HBL, told Dawn that there was no need to panic as the amount would be reimbursed to the affected clients.

“The amount stolen through fraud was Rs10.2m while the number of accounts holders affected is 559,” he said. “We have over 10m customers which means that the size of the amount missing is not very significant for the HBL, while the number of customers affected is also low. It is a fraud and we must check it and find the culprits...it happens in all countries that use ATMs.”

Customers advised against panic as their money will be reimbursed

He said that they were not aware of who the hackers were, but added that the transactions had been traced to Indonesia, China and other countries.

In June 2016, the FIA arrested and booked a Chinese national under sections of the Electronic Transactions Ordinance and the Pakistan Penal Code for defrauding bank users. Then in March this year, the FIA’s cybercrime wing arrested two more Chinese nationals under the same charges.

The FIA suggested that the use of “obsolete technology” by banks for ATMs and decades-old security system at booths had made them an easy target for an “organised foreign group”. The situation had prompted the FIA to approach the State Bank of Pakistan and ask banks to enhance security measures at the ATMs, and include the introduction of biometric features for the use of service.

The recent report by the HBL sent alarms bell ringing in the State Bank of Pakistan where officials spent a busy day discussing the fraud and gathering details of the alleged crime to learn about “how the security was breached and how much risk this hacking involved”.

“We have been in contact with the HBL to learn the exact situation of the problem but are searching for details,” said Abid Qamar, chief spokesperson for the State Bank. “We want to know how the security was breached and how much risk was involved in this hacking. We still don’t know how much amount was stolen. Similarly, we don’t know the whereabouts of the hackers. Currently it is all speculation.”

The FIA had a similar viewpoint, saying that they could only confirm that several bank accounts had been hacked, but the details of this were still awaited.

“I can confirm the incident but the fact is that there is no formal complaint lodged with the FIA,” said Hameed Bhutto, the FIA deputy director for cybercrime.

“We are aware of the fraud but are not aware of its volume or nature, which could give us leads and help launch the probe. Last year and then a few months ago, the FIA had arrested Chinese nationals involved in stealing data from banks, but we are not sure what kind of criminal activity has been executed while hacking the accounts of any banks recently,” he added.

Published in Dawn, December 5th, 2017