B U S I N E S S

Indian card processor in $45 m heist is ElectraCard
Security breach at Pune-based firm led to global cyber bank theft
Dubai/New York, May 11
One of the credit card processing companies whose security was breached in a $45 million global cyber heist was India's ElectraCard Services, according to two people familiar with the situation. ElectraCard Services processes prepaid travel cards for National Bank of Ras Al Khaimah PSC (RAKBANK), one of two Middle Eastern banks named by U.S. prosecutors on Thursday as victims of the heist, the people said.

Prepaid debit cards: A weak link in bank security
New York/Bangalore/ Boston, May 11
A brazen gang of cyber criminals, who stole $45 million from bank ATMs in 27 countries, exposes an Achilles heel in the global financial industry: prepaid debit cards. Cyber security experts and industry analysts say the burgeoning use of prepaid debit cards for everything from gift certificates to disaster relief handouts is making it easier for hackers to withdraw large amounts of money before detection.

Investor guidance
Tax calculated on CTC, not gross annual income
I have just joined a bank. The bank has provided me with two sets of calculations as far as my compensation goes -- CTC (cost to company) and gross annual income. Will my tax liability be calculated on the basis of my gross annual income or my CTC?

Indian card processor in $45 m heist is ElectraCard
Security breach at Pune-based firm led to global cyber bank theft

Dubai/New York, May 11
One of the credit card processing companies whose security was breached in a $45 million global cyber heist was India's ElectraCard Services, according to two people familiar with the situation.

ElectraCard Services processes prepaid travel cards for National Bank of Ras Al Khaimah PSC (RAKBANK), one of two Middle Eastern banks named by U.S. prosecutors on Thursday as victims of the heist, the people said.

The prosecutors said an international criminal gang made two coordinated hits on cash machines around the world, withdrawing $5 million on December 21 last year and a further $40 million on February 19 this year.

The gang was able to make big withdrawals after hacking into an Indian and a U.S. credit card processing company to raise the balances and withdrawal limits on MasterCard prepaid debit cards, the prosecutors said. They did not name the processing companies.

A U.S. official and an employee of RAKBANK in Dubai both said the Indian card processor — used in the heist on December 21, 2012 — was ElectraCard Services, which is based in Pune, India. The two people spoke on condition of anonymity.

Ramesh Mengawade, the CEO of ElectraCard Services and its parent firm, Opus Software Solutions, could not be reached through his executive assistant or through e-mail on Saturday.

RAKBANK has said two of its Prepaid MasterCard Cards have been launched with the support of ElectraCard.

MasterCard bought a 12.5 percent stake in ElectraCard in 2010, ElectraCard has said. MasterCard has said it had cooperated with law enforcement in the investigation and stressed that its systems were not involved or compromised in the attacks.

Cyber security experts said the global scope and speed of the $45 million bank theft was unprecedented. The global gang had operatives in 27 countries who could fan out to thousands of ATMs in a matter of hours, and withdraw money using fraudulent prepaid debit cards, according to U.S. prosecutors.

The U.S. Justice Department gave details of the heist on Thursday in an indictment against eight men accused of being the New York cell of the organization. The department said seven of the men have been arrested.

Dominican police on Friday confirmed that the eighth, Alberto Lajud-Pena, allegedly the leader of the New York cell, was shot dead in a robbery attempt in the Dominican Republic on April 27.

Also on Friday, German prosecutors said they arrested two Dutch citizens, a man and a woman, on February 19, who were withdrawing cash at machines in Duesseldorf from accounts at Bank of Muscat of Oman, the other bank named by U.S. prosecutors.

The ringleaders of the global operation were believed to be outside the United States, but U.S. prosecutors have declined to give details, citing the continuing investigation. Germany is the only other country so far to announce arrests. — Reuters

Prepaid debit cards: A weak link in bank security

New York/Bangalore/ Boston, May 11
A brazen gang of cyber criminals, who stole $45 million from bank ATMs in 27 countries, exposes an Achilles heel in the global financial industry: prepaid debit cards. Cyber security experts and industry analysts say the burgeoning use of prepaid debit cards for everything from gift certificates to disaster relief handouts is making it easier for hackers to withdraw large amounts of money before detection.

Prepaid cards have fewer controls on them than on regular credit and debit cards issued by banks. Each prepaid card issued is like a blank slate: anonymous, new, and lacking any credit history or individual behavior pattern against which bankers and payment processors can measure activity to look for red flags.

They are also easier to hack. Raising a withdrawal limit on a prepaid card involves hacking into a system at a third-party payment processor, a company that is generally smaller than a bank and, if based outside the United States, potentially subject to looser cyber security standards.

"It's usually prepaid debit cards. That's the card of choice in this. The bad guys know the system and they have been able to exploit it," said Joe Petro, a managing director at Promontory Financial Group, who worked for 20 years as the head of fraud prevention and investigations for Citigroup Inc.

"The vulnerability stems from third-party processors, who may not have the same level of security systems that banks are able to have," he added. Petro was speaking generally and said he did not have direct knowledge of the $45 million heist.

In a globally coordinated campaign, hackers broke into two unidentified payment processing companies that handled the prepaid debit cards for two Middle Eastern banks, U.S. prosecutors said on Thursday.

The global scope and speed of the theft was unprecedented, cyber investigators said. In the case of Bank of Muscat, $40 million was stolen in just over 10 hours.

Experts said the use of prepaid debit cards, instead of credit cards, was not accidental. Credit cards are attached to individuals whose spending habits over time give banks and credit card companies clear patterns they can use when trying to identify unusual or illicit activity. — Reuters

India outsourcing comes under scanner

Outsourcing of jobs by global financial institutions to Indian shores has come under scanner, with the perpetrators of a US $45 million worldwide ATM heist apparently breaching computer systems of a payment processing firm in India for their con job. This is the fourth major instance in less than a year when outsourcing of key jobs by global financial conglomerates to India has found a mention by global regulatory or enforcement agencies for wrong reasons, including for ineffective controls against suspicious transactions, a global rate rigging scandal, money laundering risks and now a huge swindle operation. Late last year, a joint probe by British and Swiss regulators found key controls for "detection of suspicious trading activity" failed at an India outsourcing unit, contributing to USD 2.3-billion loss caused by a rogue trader of global banking giant UBS. — PTI

Investor guidance
Tax calculated on CTC, not gross annual income
A. N. Shanbhag