ISLAMABAD, March 15: The National Bank of Pakistan on Saturday said that some people had fraudulently withdrawn Rs20 million from its automated-teller machines (ATMs) in Multan, while the Federal Investigation Agency believes that the bank’s online money providing system has been “hacked”.

While NBP president Ali Raza said the misuse of bank’s ATMs in the industrial zones of Punjab was a mere “glitch” and not a cyber crime, the head of FIA’s National Response Centre for Cyber Crimes (NR3C), Syed Ammar Jafri, told Dawn that the NBP’s ATM service had been hacked and it was a cyber crime.

“That’s why the NBP management has sought the help of NR3C — the FIA’s special wing for combating cyber crimes,” Mr Jafri added.

“Give me three or four days and I will tell you how many people are involved in the crime.” He did not rule out the involvement of those who knew about the security system of NBP’s ATM service.

He said it could also happen to other banks operating in Pakistan, but the NBP had been targeted perhaps for its weak security.

He said the FIA had taken into custody a retired employee of a bank, Amir Abbas, who was being grilled. Amir was arrested in Multan after the NBP management had registered an FIR against him.

Mr Jafri said that without hacking the system it was impossible to withdraw cash from the NBP’s One-Link through cash cards with zero balance. He said that cash cards of two employees of another bank, one of them retired, had been used, which meant that those who withdrew money had hacked the NBP system.

“If the system was not hacked how the ATMs were made to give positive response instead of negative?” he asked.

Sources told Dawn that before the NBP suspended its One-Link service on Friday, the gang had withdrawn money from four branches of the NBP in Islamabad.

However, the bank’s spokesperson said she did not know anything about the misuse of ATMs in the capital.

NBP’s clients can now use only the bank’s own ATM facility after the suspension of One-Link.

The sources said that millions of rupees had been withdrawn from the bank’s branches in Lahore, Sialkot and Faisalabad as well.

An official statement issued by the NBP said that with the bank’s help some culprits had been arrested red-handed while conducting fraudulent withdrawals from ATMs in Multan.

“The gang is currently been interrogated by the FIA and a case has already been registered with the relevant agency,” the statement said.

“The bank hopes to recover the fraudulently withdrawn money from those who perpetuated the fraud.”

The NBP is currently in the process of re-certification of its ATM switch software with One-Link and software vendor which is expected to be completed in two weeks. Soon after the completion of the process, the NBP will restore its links with other banks (14 in number) which are members of the One-Link.

An expert told Dawn that it required at least a thousand transactions (days) to withdraw Rs20 million from the NBP through ATMs which restricted clients to taking out only Rs20,000 per day.