JPMorgan Chase sues scammers following viral 'infinite money glitch' JPMorgan Chase has begun suing fraudsters who allegedly stole thousands of dollars from the bank's ATMs after a check fraud glitch went viral on social media. The so-called "infinite money glitch" exploded on X and TikTok over the summer, after customers abused a technical issue affecting ATMs nationwide that allowed them to …
We wouldn't expect these well-regulated and highly profitable organizations to be prey to the same connivery they inflict on their customers, right?
If there are some chinks in the transactional armor surrounding deposits and withdrawals I'd guess there are a lot more waiting to be investigated.
It's not illegal if you've paid off the regulators and politicians in totally legal (because of your lobbying) ways to make it legal. This is how big business controls the US government, and how it's trying very hard to control every other government on earth.
these well-regulated and highly profitable organizations
It's because of a lack of regulation they are so highly profitable. The 2008 global financial crisis was caused by numerous banks and other financial organisations promulgating toxic debt which they knew would come back and savagely bite them in the arse sooner or later. Toxic debt which could be created and sold on due to lax regulation. A lot of hedge funds made a pretty penny when it all blew up, they just weren't sure when that would be, but they knew it would eventually.
I'm not entirely sure "lax regulation" is appropriate here. I don't know about the US, although I suspect it was similar, the situation in the UK is that it was, essentially, government policy.
We had central banking encouraged, by government to set interests rates to achieve inflation of around 2%. The statisticians were directed by government to use a measure of inflation that excluded housing costs. That was government policy. At the same time manufacturing was being off-shred to the lowest cost countries available. If there was any dumping going on that was ignores. If it caused unemployment in local manufacturing that was ignored. We had low inflation and cheap money; voters like those and governments like voters to like what's happening. Voters even liked the idea that the alleged values of their houses was rising and that they could take out more cheap loans against those inflated values.
But all that cheap money went into soaring house prices. Even when house prices and, with them, rents were at clearly unsustainable levels of inflation there was no feedback mechanism in place because they weren't in the figure used to determine interest rates. The situation was flagrantly ignored and that resulted in the toxic debts. Actually I suspect it wasn't totally ignored. I've always suspected that Blair realised it couldn't end well, rode the resulting popularity while it lasted and stood aside in favour of his Chancellor (Finance Minister) just in time for the latter to become PM and face the consequences of his policies. Although, of course, the rest of us also had to face those consequences.
Yet the low inflation, low interest rates, and rising house prices all continued for another roughly 14 years in exactly the way you're arguing was unsustainable and would inevitably lead to toxic debts, but didn't again lead to toxic debts.
What changed was a) Regulation was made less lax (some of that is now being undone sadly), b) The banks stopped the stupid lending because the near wipe-out of an entire sector's shareholder capital had revealed what an unprofitable business strategy that was.
Yeah, because escalating rents are definitely sustainable, aren't they.
What has happened in the UK is that 14 years of subsequent conservative government, pursuing the exact same neoliberal economic policies of privatisation, lax regulation and austerity have continued the exact same pattern, and house prices are now so stupidly inflated that half of all "buy to let" mortgages are now reportedly... toxic debts.
If there's one thing that's inexcusable, it's making excuses for the exact same behaviour that caused the problem in the first place.
half of all "buy to let" mortgages are now reportedly... toxic debts
This has happened because subsequent Conservative governments have demonised landlords to distract from the lack of housing stock ultimately caused by: planning issues, skills shortage in the house-building sector, and general societal inequality plus regressive property taxes pushing up the value of the most desirable land without proportionate taxation. You purchase a buy-to-let property on some future expectation of rental income, but every year you get lumbered with some new unexpected tax, while the government hands out free money to anyone trying to buy a house to live in themselves. Quickly your business becomes unprofitable and you, the landlord, as well as your customers, the tenants, suffer. If you think this is anything like neoliberal policy you've been asleep while the inept knee-jerk regulating populists were at the wheel.
The name "Timipah Ikemi" isn't currently shown in the linked CNBC article. It's not impossible his name was "borrowed" or account hijacked. It would be kind of stupid of him if he did. Harris County, Texas records show Timipah Mahkurdi Ikemi held one job between 2015 and 2018. One of the most recent records in 2018 lists a job of Detention Officer and a pay of $6,299.65. The highest paying job held by Timipah Mahkurdi Ikemi was in 2017 as a [Juvenile Probation] Detention Officer making $19.33.
....that's piss poor planning.
If they were to stupid to, at no point go "Is it ok to allow people to withdraw unlimited funds they don't have?" then this is no glitch.
And....it's 2024. Cheques? Pretty sure the last I had was about 5 / 6;years ago, and that was off the government.
The Americans still love them unfortunately - their banking system is archaic and about 20 years behind the rest of the west. They still can't really get off of magstripes on cards - they required chip & signature to replace magstripes but not chip & pin which is IMO insane. If you're changing standards to require new technologies then why go for a halfway house solution?
It was allowing people to withdraw basically the entire amount of the check.
What I wonder is why the heck do ATMs have that much cash in them? Maybe in a casino I could see that, but just regular ATMs? Or are they going to a couple dozen ATMs that night before the check bounces the next day?
Also you'd think they'd have some business logic (or "AI" if you want to sound modern) so that accounts that had never had a balance of more than x couldn't suddenly get a check for 50x and withdraw it all in one go. Ditto for new accounts. Its like basic fraud protection on credit cards, they look at patterns of past use and determine potential fraud based on that. Which is why you might get a "fraud alert" if you do something different like suddenly making a huge charge when you never have before, or charging in multiple countries when you haven't ever used that card overseas before.
and MS still supports it. FYI MS has versions of OSs that most people have never heard of - "Embedded" versions. Much much more secure, extremely stripped down. These days you can find XP and 7 on ATMs/Printers (appliances) systems still. But, you can't connect any device (even a mouse) unless it is built to, networking limited to exactly what its' supposed to do and nothing else. Not an easy hack. An ATM is not likely to get hacked in the US, but it is likely to get stolen and or exploded to get the money out of it. There is so much security in good ATMs these days, the OS is the least of the concerns.
" why the heck do ATMs have that much cash in them"
They don't - one person would deposit the check at an ATM, then then the account holder would withdraw it - through their app and or at a branch and deposit the money elsewhere. There are daily withdrawal limits at ATMs. The "trick" was due to the checks not being held until cleared when deposited in ATMs and the funds from bad checks being made immediately available - which this is why checks are Normally held until cleared.
Cheques - or checks (it's a leftpondian tail) have been in circulation for, oh, a billion years and it's well-established that it takes a couple of days for them to clear - ask anyone who got paid by them back in the '80's.
And yet, for reasons unexplained, Chase decided to ignore their own processes and pay out on uncleared deposits? More fool them.
Mind you, it's still illegal to deliberately abuse such...umm...oversight - it's called fraud - which is a shame: they should really be allowed to get away with it and Chase obliged to foot the losses out of their obscenely good profit margins as an object lesson in managing stupidity!
"Chase takes its responsibility to combat fraud seriously and prioritises protecting the firm and its customers to make the banking system safer," the bank said in the court filings.
Well that’s clearly not true, they obviously don’t take fraud seriously or this would not have been allowed to happen.
Was this written by someone who hasn't lived long enough to make a serious mistake? Maybe a six-year-old? Or is it, once again, yet another example of the hyperactive nastiness farm at work right now, based on GoDaddy and NameCheap? And yet, it has worked, achieving my engagement.
Well, off to do something that is not a soul-sucking-black-hole-of-negativity comment section. How it is that HN has not fallen into this widening abyss remains a mystery to me.
As usual, there is more to this story than we are reading here. Most likely, this was an inside job. Someone at Chase had to know that the ATM system had this oversight; perhaps someone even placed it there intentionally. I hope they trace this back to the real villains using the fraud charges as leverage.
As a long-time Chase customer, I resent their relentless marketing, which is utterly out of place on a user account home page, such that it has actually finally required uBlock. I am irritated by the security theater pop-ups around Zelle and wire transactions (although it could save the newbs' money--maybe), but those were probably a response to the CFPB inquiry in that area.
I have grown to appreciate their online and fraud-detection systems, as well as their indispensable real-time transaction alert notifications, which are the sole advantage of the otherwise morally unacceptable transaction surveillance they do. For me it's a worthwhile trade: they are welcome to surveil me if the data let them auto-flag and prevent unusual transactions that could cost me tens of thousands of dollars. The mere acknowledgment of that just goes to show how hot the water has gotten for this frog, who was so previously uncompromising about surveillance.
GDPR, please. And not just for show--if they actually enforced that regulation, how the world would improve!
Internet strangers who say "think about what you have written."
Times don't change: forty years ago, my father used to say how insulting to the intelligence to have someone say, "Think about it!" Like a waiter telling you your choice of wines as "A fine choice, sir." Of course it's a fine choice; I made it. Hat tip to the Holy Grail: "Good idea, oh Lord!" "Course it's a good idea!"
If it is anything like Santander, then no, those security theatre pop-ups will not protect anyone, because they come up everytime I make a transaction, eg the transfer I make to my savings account pretty much every month, or the transfer to pay my credit card bill.
The fact that it always comes up, means that people are conditioned to ignore it, because it always comes up.
It's plain old fraud. The bank is stupid to clear the funds from a cheque before it has cleared, but I'm not sure how clearing a cheque should take anything more than a few minutes in today's world, though. Surely, there are only three things that need to be done: verify the cheque is genuine, verify the source account has the funds, and transfer them.
Over here in the UK, it's common practice for ATMs (or cash machines as we call them, we don't call anyone who works in a bank a "teller"), to limit the amount that can be withdrawn in a day, usually to £300, IIRC. There seem to be a couple of gaping flaws in this bank's processes here.
Nevertheless, if someone withdraws funds they don't really have, then the end result is an overdraft. If it's an unauthorised one, it'll probably come with punitive daily fees and an interest rate that would make Chuck Norris break down and cry. As well as the matter of the fraudulent "check", the person doing this is going to be on the hook for paying back the money, plus a whole load more, to the bank, unless they've taken the money, and run off with it, in which case, I hope the perps find somewhere nice to live for the rest of their lives, without a US extradition treaty, and where a few hundred thousand is enough to set themselves up. I think they'll discover rapidly that it really isn't as much money as they thought, and certainly not "infinite".
The CHIPS system (at least here in the US) that clears checks and transfers funds is still very slow. IT has nothing to do with technology.
The bank where the funds currently reside wants to hang on to them as long as possible. The make their daily earnings on those funds and if they can "use" the other banks partial funds to satisfy the customer so be it! Now this is not as profitable as it once was but getting banks and their systems to change is like pushing a boulder up hill.
Meanwhile, in the UK, your banking app allows you to take a picture of a cheque below a certain threshold (I think it's £5,000) in order to pay it in, and the funds are usually available pretty much immediately. I don't think the 5-day-wait-clearing system exists at all any more. In some ways, the US appears to be very much behind the times (see also: clinging onto customary units when pretty much the whole of the rest of the world has partially or wholly adopted the metric system, and allowing people to carry weapons in public).
In this case, no. The actual deal is "a few extra days is interest." If the banks can keep hundreds of millions a day a couple of extra days in theit clearing house accounts, that works out to quite a lot of invisible profit that comes from stealing pennies from hundreds of millions of people.
Holding onto a check until it clears, is holding onto a rock to see what's inside, it takes time, time is money, process is money - whats not money is the check until it clears - there is no interest earned on a rock/check that has no value. Not profitable for the FI. FI make money 'lending" money, if it not lent out it's costing money.
If you worry about Banks profiting from you, check out a local Credit Union, they (at least in the US) a differently regulated and CEOs (all SR Staff) make wayyyyyyy less than big banks, and your vote counts (unlike politics).
"Surely, there are only three things that need to be done: verify the cheque is genuine, verify the source account has the funds, and transfer them."
The first of those might require that the cheque is taken out of the machine to go into the banking system and that's not likely to be until the next day.
In the UK at least, cheques have, for a long time (since the 1980s I think) had security features that have made them machine-readable, at least to verify the sort code, account, and serial number via MICR. One job I held many years ago involved working in a place that printed cheques, using special magnetic toner, because those numbers in a weird "futuristic" font are designed to be recognisable by their magnetic signature when passed through a magnetic reader.
These days, the combination of magnetic verification, and optical recognition (especially of cheques with printed figures on them) should mean that these can be read and verified in seconds. It's very hard to fake a cheque's serial number unless you know the range that has currently been issued, but not yet used, which, for most people, is a cheque book limited to 20 or so numbers at a time. The issuing bank can tell an authorised body (i.e. another bank) immediately if a serial number has been issued but not yet used, and also if the name on the cheque matches the name of the issuing account. There's no reason why a cheque cannot be read by feeding it into a cashpoint, especially with today's image recognition technology, which is a million times better (probably not even hyperbole) than it was in the 1980s. As I said, most banks will verify a cheque by you taking a picture of it in your banking app, which no doubt allows them to perform these exact checks.
If you "deposit" a cheque into a cashpoint, and it needs someone to pick it up and process it manually the next day, then you have to wait overnight fort he funds to clear. I don't actually see that as a problem. If you deposit cash, I'd expect the same thing. Why should they trust you that the banknotes you are saying you are depositing in an envelope actually in there, or are even genuine. If you wanted to deposit cash to a bank and have the funds immediately available, you'd do it over the counter, or use a machine that individually verifies each note as you feed it in, like a vending machine or a change machine in an amusement arcade does. I don't know if any cashpoints offer that facility, I've very rarely had to deposit cash.
> but I'm not sure how clearing a cheque should take anything more than a few minutes in today's world, though
1. If you deposit the cheque into a deposit machine using it's inbuilt scanning technology then someone has to come & collect it & process it to make sure it's genuine. That is usually daily (only time I've seen a machine capable of doing this in the UK is inside a bank branch).
2. Banks still rely on older computer systems which deal with batch processing. This usually means reconciliation and daily activities are processed at midnight. This also allows them to have a daily "snapshot" of how much money the bank actually has on hand without any transactions happening to remove or add said money which may bounce or take time to process or which may be held by authorities or any number of other events.
3. Because of 2, banks usually transfer money to each other daily once their batch processing is done. This will be an "at midnight" figure reflecting the amount needing to be transferred when the freeze on activity occurred at midnight when processing starting. This is required because the banks obviously have to move money between themselves to cover the value of all the cheques which a customer of one bank has given to the customer of a different bank to deposit.
4. Cheques deposited into an account in the same bank as the drawing account can often be cleared immediately though as the transfers are just between accounts in the same banking chain. This is up to the individual bank though.
I have experienced wire fraud when I was a BofA customer. Their attitude was "Somebody stole $300K USD from you - that's entirely your problem". Idem for the so-called "Law enforcement community".
My suspicion is one reason why the banks don't give a damn about wire fraud is because the fraudsters are also their paying customers. Did anyone ever see these banks release figures on what percentage of the money they have in their accounts is stolen money, obtained via wire fraud ? I imagine that these fraudsters are also a good source of profit for the major banks, who are keen to keep any customer, no matter where the money in their account came from......
I do infosec at a FI, and I have 2 friends that recently got hired by BOA. The fraud team at BOA is over 1000 people, from hackers to devs to anti-fraud investigators (I'm a bit jealous, thats more than all our staff) Fraud is a huge deal, multiple automated systems, huge constant review. Calling members to ask if they meant to write a check for 10k to a nigeran prince. Telling people every dam day - no they didn't win the Clearing house, no that check sent to you from a buyer on craigs list is fake, and they want you to pay for shipping.... every day all day long. I see congratulations letters shared internally for preventing fraud against customers - and thank you letters from customers that almost got ripped off. In short, its a bigger fight than you may think. sorry to hear you got burned.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
