Three Ukrainian nationals used counterfeit ATM cards to steal nearly $6 million
from Citibank N.A., Washington Mutual Inc. and First Bank of St. Louis, according to
an FBI affidavit recently obtained by ATM&Debit News.
A subsequent indictment says the three–Yurity Rakushchynets, also known as
Yuriy Rakushchynets and Yuri Ryabinin; Ivan Bi l t s e, also known as Ivan Belyayev; and Angelina Ki t a e va–either stole the money themselves through ATM withdrawals or facilitated the thefts between Sept. 30, 2007, and March 4.
First Bank discovered the thefts in October, according to an affidavit in support
of a Feb. 28 arrest warrant for Rakushchynets, a Brooklyn, N.Y., resident.
First Bank executives notified the FBI's St. Louis field office that four of the bank's iWire Inc. prepaid MasterCard accounts had been compromised on either Sept. 30 and Oct. 1, according to a sworn affidavit signed by Albert Murray, an FBI special agent assigned to a squad that focuses on cyber crime and intellectual property. IWire is a payroll company based in Jericho, N.Y.
Withdrawals Occurred Globally
Th i e ves used the stolen iWi re account numbers to make fake debit cards, and this
led to more than 9,000 fraudulent withdrawals or attempted withdrawals at ATMs
around the world. The thefts "resulted in a total loss of approximately $5 million," the
affidavit says. The document does not dis-close how the account information was
However, the suspects allegedly made 12 ATM withdrawals using cards made
from stolen iWi re account numbers between 2:55 a.m. and 3a.m. Oct. 1 at the
same Washington Mutual branch in Brooklyn. The thieves stole approximately
$9,624 from the branch's ATMs, according to the FBI.
The Citibank Thefts
The FBI affidavit that describes the First Bank and Washington Mutual thefts
also covers the gove rn m e n t's inve s t i g a t i o n into ATM fraud at Citibank. In Fe b ru a ry, Citibank, the world's largest bank in term s
of assets, contacted the FBI about the t h e f t s. Citibank executives told the FBI a
t h i rd - p a rty server–not the bank's– that p rocesses ATM withdrawals at 7-El e ve n
In c. convenience stores had been breached.
"Earlier this ye a r, Citibank received notice from a third- party tra n s a c t i o n
processor for the ATM industry that the processor's systems were potentially compromised in late 2007," Robert Julavits, Citi spokesperson, wrote in an e-mail message.
Ca rd t ronics In c., the world's larg e s t ATM ISO, purchased 7-Eleven's 5,500 ATMs
last July for $135 million. Houston-based Cardtronics issued a statement last week
saying its ATMs meet all industry security standards.
New York-based Citi identified all of the compromised account numbers and,
according to Murray, bank officials said t h i e ves used the compromised data to
manufacture cards and make hundreds of fraudulent ATM withdrawals all over New
York in February.
On Feb. 20, for example, the suspects allegedly made two withdrawals totaling
$3,000 at a Citi branch in Brooklyn. Earlier that same day, at another Brooklyn branch
of Citibank, they allegedly used fraudulentcards to withdraw $5,000.
Citi alerted the FBI after bank officials noticed something was amiss with ATM
withdrawals thoughout New York City. InDecember, Citi, which has 134 branches in
New York, began limiting ATM withdrawals throughout the city.
The earlier incident and the 7-Eleven incident are unrelated, Julavits says.
A Common Link
What links the ATM thefts at Washington Mutual and Citi are images of
the same individual on video surveillance c a m e ras at both institutions, says the affidavit supporting Rakushchynets' arrest.Ca m e ras at branches of both banks show a white male we a ring a baseball cap with "Top Gun" emblazoned across the top. The suspect also wore the same tan-colored
jacket or sweat shirt under a darker jacket when making fraudulent withdra w a l s
from Citibank and Washington Mu t u a l AT M s.
Through an investigation that included
monitoring ham radio Web sites and Web sites where individuals buy and sell stolen
card information, the FBI identified Rakushchynets by his nickname and user
identification number. He used the same user identification number and nickname on the carding and ham radio Web sites.
Rakushchynets is a ham radio enthusiast, and the Fe d e ral Co m m u n i c a t i o n s
Commission mailed him letters, warn i n g of administrative violations. The FCCa d d ressed the letters to Yuriy Ra k u s h c h y n e t s. He also was photo g raphed attending a ham radio conve ntion we a ring his "Top Gun" baseball cap
and the same clothes he was photographed in while withdrawing funds
from Citibank and Washington Mu t u a l AT M s.
On the carding Web site, he was attempting to sell 50 stolen card credit card
numbers, says the affidavit supporting his arrest.
Rakushchynets fraudulently withdrew $750,000 in February from Citi ATMs,
according to the affidavit authorities filed with the U.S. District Court for the Eastern
District of New York.
L a w - e n f o rcement officials arre s t e d Rakushchynets, 29, Feb. 28 at his home,
w h e re he lived with his wife, Ol e n a . Officers had a search warrant for the couple's
home, which was signed by Ari Ba ranoff, a U.S. Se c ret Service Agent
assigned to the El e c t ronic Crimes Task Force.
Bags And Boxes Of Cash
A search turned up more than $800,000 in cash, including $690,000 stuffed in
garbage bags, shopping bags and boxes. Agents also found $1,020 in "51 crisp $20
bills in Olena's pocketbook," the affidavit for a search warrant said. "The serial numbers on the $20 bills were in sequential order, suggesting that the cash was taken out of ATM," according to the affidavit.
The couple paid a $100,000 deposit on their home, and Olena paid cash for a
$34,000 Mercedes Benz automobile, even though she is unemployed, an affidavit
says. Olena also had $99,000 in a safety deposit box in No rth Fork Bank in
The agents also found card-encoding devices used to make fraudulent debit,
ATM and gift cards. Rakushchynets' home computer was logged into a well-known
"carding" forum, the secret service's Baranoff said in an affidavit.
Olena said her husband and Biltse, would leave the Rakushchynets' home
with "bundles of credit cards in rubber bands and return with large sums of cash."
Biltse, also a Brooklyn resident, was arrested March14.
Ac c o rding to the indictment of Ryabinin, Biltse and Kitaeva, the fraudulent
acts began in October. Kitaeva's apparent job was to bank the
Ki t a e va deposited $20,000 into an unnamed bank account in Brooklyn two
weeks after Rakushchynets and Biltse used cards encoded with stolen Citi card numbers to withdraw funds from Citi ATMs in Manhattan, N.Y., the complaint says.
Kitaeva was arrested March 14. The government charged the three with
conspiracy to defraud the United States and producing and trafficking in counterfeit
access devices. Calls to the defendants' attorneys were not returned.