(http://gulfbusiness.com/2013/02/omans-bank-muscat-hit-by-39m-prepaid-card-fraud/)

Whilst only 12 card numbers were reported used, multiple clones were used.

To some extent we’ll all just have to wait and see how this pans out. But I’m thinking that when there was only cash (or gold or kewpie beads or whatever the physical means of exchange was), banks never did and still haven’t made themselves invulnerable to bank robbers. They learned how to better protect themselves, which minimizes their losses, but to a certain extent they just have to accept it as a cost of doing business. And then either do it or give up, and let somebody else take their lumps at it.

Interestingly, not many bankers have chosen the latter option, in the olden days or the present day.

There may not be (and is not) a customer account associated with each card, but each card does have a unique number, I’m assuming. And there is nothing preventing the processors from creating a separate database that tracks the history of each numbered card. Well, nothing but their not having thought of it and done it.

And it would be a simple matter to set up triggers to issue alerts to the appropriate person for review when the activity on that cardnumber goes outside the parameters considered normal. Granted, the hackers could endeavor to find out what the trigger parameters are and attempt to stay inside of them, but this would significantly cramp their style and speed. They might also attempt to disable or rewrite the triggers if they have full access to the database, but it is possible to have triggers (as well as the cardnumber database itself) reside and execute from outside the database, preferably on a machine that either can’t be reached from the machine the compromised database is being hacked from, or it’s name/location can be made to appear unknown to the compromised machine. Probably you’d want to make it completely unknown, so that only the trigger machine could initiate and validate the connection. If done correctly, the hackers would have no way to dodge the triggers short of full access to the entire network and the means to find and hack the triggers themselves. Sure, eventually they might do that, but some ingenuity in hiding the triggers and cardnumber database would stall them for a good long while. And through the wonders of mirrored and replicated databases that don’t have to even be on the same local network, it should be possible to detect when the triggers are hacked. By detecting mismatching data if nothing else, and many more clever tricks are pretty easily possible with no changes to standard database languages needed.

So the technology does exist to monitor these cards (I could do it), it’s just that no one has chosen to and done it.

Hacks like this have nothing to do with ‘anonymity’, anyway. Manipulating SQL on a server to raise an arbitrary field repeatedly only sounds complicated but the truth is a lot of these cards probably never existed to begin with — they were probably inserted as a line into the SQL database themselves.

Your ‘argument’ is severely flawed, lacks logic, and speaks of listening too much to propaganda spewed by governments about what will keep you safe.

Let’s look at 11 million dollars another way, if you want: This is maybe not even the ATM plus POS fees for a single day for many banks. While it is surely a sizeable sum of money, it is not something that happens every day. I would say a payment processor gets ‘hacked’ on this level every 2 or 3 years. In other words it happens less often than a major plane crash.

People, stop buying into FUD just because you do not understand how such things are ‘committed’. You are only going to become more and more slaves to a world that insists on tracking your every movements. Actually, we almost all are, already — why rush it?

So the card is just an access mechanism and there is no $500K on one card per se at any one time. That would be the total over a given set of refreshes.

Most likely while the card limit is frequently increased they stay below a limit that would be detected even if that limit is higher than normal withdrawal limits. By continually refreshing the card balance to that higher limit they can keep withdrawing until someone spots it presumably by the excessive number of withdrawal transactions.

In regards to transfer: there is no transfer – it is cashed out at the ATM. the card is simply cloned and sent to different countries. There each card withdraws cash at various ATM’s until the limit is reached.
And yes – amazing that no transaction monitoring system caught this!