Catch me if you can,' said student behind biggest chip and PIN fraud

A computer whiz-kid has been jailed over the theft of information from 19,000 credit cards

The computer mastermind behind Britain's biggest counterfeit credit card factory was jailed yesterday.

Anup Patel had amassed almost £2 million after details of 19,000 cards and PINs were stolen from British users. He set up a network of couriers to deliver batches of fake cards abroad to exploit a loophole in the chip-and-PIN banking security system.

While still studying computer sciences at a London university, the 30-year-old was developing state-of-the-art technology secretly to harvest customers' private bank details.

Petrol stations around the M25, among others, were believed to have been used to cash in on the large number of people using payment cards to buy fuel.

Fake payment terminals with hidden data readers, and secret cameras, often drilled into the ceiling, had been used to record bank details and PINs. That information was used to make bogus cards at Patel's factory and laboratory, which were found when police raided rented units at Croydon House Business Centre in South London in 2006.

Motorists discovered that they had been the victims of fraud when their banks contacted them to check whether they had withdrawn cash abroad or when the cardholders spotted suspicious transactions on their bank statements.

After an investigation that involved detectives tracing criminal gang links to Thailand, Eastern Europe and Turkey, Patel was jailed for six years for conspiracy to steal and conspiracy to defraud. Anthony Thomas, 45, a father of two who acted as a “mule” delivering the bogus cards to countries that do not use chips on cards, was jailed for two years for the same offences. The men will serve half their jail terms before being considered for parole. Another man is being held in Thailand on suspicion of being linked to the scheme.

Only now can The Times reveal that Patel, while on the run, had taunted Detective Sergeant Simon Russen, the senior officer hunting him, by comparing his criminal computer wizardry to the famous con artist Frank Abagnale Jr, played by Leonardo DiCaprio in the film Catch Me If You Can.

In a two-minute, late-night phone call, Patel joked that if he was DiCaprio, it meant that the detective was Tom Hanks, the actor who played the FBI agent. He then said: “Catch me if you can” before hanging up.

However, unlike Abagnale, who remained undetected for five years, Patel handed himself in to police after just two weeks when he realised that his fellow conspirators had been arrested at British airports and in Thailand.

Judge Nicholas Ainley, sentencing the pair, said that the City of London Police's cheque and credit card unit had uncovered an “industrial-scale factory” when they raided Patel's business centre premises.

Police believe that the gang amassed almost £2 million before the raid in October 2006 after an intelligence tip-off. Officers seized thousands of magnetic strips and blank plastic cards, a library of 19,000 skimmed card and PIN details, holograms, card printers, corrupted payment terminals and £20,000 in cash.

Mr Russen said it was clear they had uncovered the headquarters of a large-scale counterfeit operation.

“They were operating at the top end of credit card criminality, from manufacturing the cards to obtaining money internationally through ATM machines.” He said that Patel “used his high-tech knowledge to great effect”, adding that he was “striving to beat the chip-and-PIN system”.

It remains largely unclear how the terminals were placed at the garages or Patel or Thomas's involvement with that part of the operation.

Patel appears to have shunned the wealth that he was said to have created, instead remaining fascinated by the technology he was developing.

The cards recovered, police believe, suggest that the gang members could have made up to £16 million had they not been stopped.

More than 50 computer gadgets - exhibits in the case - were strewn across Court 1 of Croydon Crown Court. The jury of eight men and four women returned unanimous verdicts after less than two hours of deliberations.

David Povall, for the prosecution, revealed that Patel, of Thornton Heath, South London, had been jailed for 2 years for a credit card fraud in France ten years ago. Thomas, of Clapham, South London, had 65 previous convictions, mainly for petty crime.

Last year £144.3 million was obtained illegally by those able to beat the chip-and-PIN system introduced in 2002. The system became mandatory in 2006 for the 144 million payments cards in Britain.

While fake card fraud has been cut in Britain - £78.2 million was stolen in 2005 compared with £31.1 million in 2007 - organised gangs have begun shipping counterfeit cards to countries that do not require cards to have chips.

Only £18.2 million was lost abroad in 2005, compared with £113.2 million last year.

The use of cloned details has also increased fraud on the internet, telephone and mail order. In 2005, £183.2 million was stolen. This rose to £290.5 million in 2007.

However, the fraudulent use of lost or stolen cards has dropped (in 2005 £89 million was stolen, falling £56.2 million last year) and the interception of cards in the post has been cut (in 2005, £40 million was stolen, falling to £10.2 million in 2007).

High street transactions involving fake cards have also fallen, with the £135.9 million stolen in 2005, dropping to £73 million last year.

While chip-and-PIN technology is common in Europe, few countries use the more secure system. Notably, America predominantly uses the magnetic swipe and signature system. Outside Europe few countries have adopted chip-and-PIN. Those that have include South Korea, Taiwan, Japan, Australia, Brazil and Mexico.

Last night a 44-year-old British man, another alleged courier, was being held in Thailand in connection with the gang. He was arrested at Luton airport while trying to board a flight to Istanbul with fake cards and carrying files of PIN codes.

He fled while on bail but was seized in Phuket after withdrawing cash illegally. He came to the attention of the authorities after he was repeatedly photographed wearing a pollution face mask while removing money from cash machines.

Patel, who was born in India and came to Britain at the age of 2, obtained a 2:2 in computer sciences from Kingston University in 2006. continues here

Fraudsters' bugs transmit credit card details to Pakistan

Thieves have planted new sophisticated bugs in supermarket card readers so customer details can be cloned

Detectives are investigating a sophisticated credit card fraud against customers of some of Britain’s biggest supermarkets that may be linked to extremists in Pakistan. 

Fraudsters have targeted more than 40 stores in Britain, including those of Asda, Tesco and Sainsbury’s, in an elaborate scam that police say involves tiny devices inserted into the stores’ “chip and Pin” credit card readers. 

Specialists say the technology is the most advanced they have seen and is being used in supermarket chains across Europe. 

The devices, which are reported to have been made in China, are reading and storing selected customers’ Mastercard and personal identification numbers as the cards are inserted into readers at supermarket checkout tills.

The bugs transmit the information by wireless technology to Lahore, Pakistan, according to a senior American counter-intelligence official. 

Customers’ cards are then cloned and used to steal money from their credit and current accounts and to pay for items such as airline tickets on the internet. 

A senior British police source said he was unable to confirm reports in America that as much as $100m had been siphoned out of customers’ accounts. 

The fraud was revealed by Joel Brenner, the American government’s top counter-intelligence officer. He said: “Small but intelligent criminal organisations are pulling off transnational, multicontinental heists that only a foreign intelligence service would have been able to do a few years ago.” 

The US National Security Agency, which monitors electronic communications worldwide, is said to be tracking the case because of its links to Pakistan, which has become a base for Al-Qaeda. 

A counter-terrorism official in Britain emphasised yesterday that the authorities here had yet to uncover clear evidence of any scam linked to Al-Qaeda, but said they did not rule out the emergence of such evidence. 

This weekend MPs called for a full investigation. Patrick Mercer, a member of the Commons home affairs committee, said: “This is a deeply worrying matter and I hope the authorities aren’t in denial about any links to terrorism.” 

There is growing evidence that terrorist groups are resorting to sophisticated technology to raise money. 

Last month a London court convicted a Sri Lankan gang with suspected links to the Tamil Tiger terrorist group of running an elaborate credit card fraud at petrol stations across the country. 

Cameras installed in secret compartments in the ceilings above the credit card readers recorded motorists putting in their Pin numbers. Account information was also electronically copied as the cards were put into readers. This was sent abroad and employed to clone credit cards that were subsequently used around the world. 

A Mastercard spokesman declined to discuss details of the latest case but said safeguarding financial information was a top priority. 

Rising concern about the growth in credit card fraud has led Mastercard to improve monitoring of unusual or suspicious transactions. It has started sending automated calls to card holders’ mobile phones asking them to confirm recent transactions. 

In the latest scam the gang is suspected of having tampered with the chip and Pin machines, either during their manufacture in China or at some point after they came off the production line. 

A special chip is inserted behind the machine’s motherboard and it sends, by mobile phone, the details and Pins of selected cards to criminals in Lahore. Brenner said: “It was impossible to tell, even for someone working at the factory, that they had been tampered with.” 

Jemma Smith, a spokesman for Apacs, the interbank group that leads the fight against card fraud, said that a special police unit was investigating Pin pads at 40 stores, including those of Asda, Sainsbury’s and Tesco. 

“The police are aware of Pin pads having been tampered with, with devices inside them that wire information,” she said. However, no investigation by the unit had yet uncovered links to Lahore, she said. 

Shoppers at Asda in High Wycombe, Buckinghamshire, reported last month that their cards had been used to make illicit withdrawals overseas after they had visited the store. One customer said 25 withdrawals from his account, totalling £1,400, had been made in the US and Pakistan. 

The banking industry hoped that chip and Pin cards, introduced in February 2006, would help cut fraud. However, total card fraud losses increased by 14% in the six months to June 2008 compared with the first half of last year. Total card losses for this period were £301.7m, of which more than 40% was fraud abroad. continues here