$400m FRAUD

A scheme that exploited a since-discarded emergency feature of point-of-sale (POS) terminals was used to defraud two Jamaican financial institutions of nearly $400 million, law enforcement and banking industry insiders have disclosed.

One institution was defrauded of $270 million via a single transaction, while the second entity lost approximately $135 million through at least two transactions, according to the insiders.

The transactions were processed in late 2022 using bank cards and POS terminals that were deliberately placed in offline mode.

The cash stolen from the second financial institution was intended to be used to purchase two properties in Clarendon: a plaza that cost $102 million and a house that cost approximately $32 million, one law-enforcement insider charged.

The uthorities have since intervened to stop the purchase of both the plaza and the house and have already begun the process to have them forfeited, one investigator disclosed.

The Gleaner has opted not to publish the names of the institutions.

Based on how the fraudulent scheme operated, no customer’s account was impacted, one investigator indicated.

HOW IT IS DONE

Investigators explained that the fraudulent transaction was initiated by deliberately taking the POS terminal offline, because in that state it can only communicate with one bank: the one that issued it to the merchant.

The transaction was completed – with help from the merchant – by using a specially generated six-digit code and a valid card issued by a second bank, “even when the account it is linked to sometimes only has a dollar in it”.

It is still uncertain how the fraudsters got access to the code.

“Any amount of money you put in there, it (the transaction) is going to get approval once the point-of-sale machine is offline. And then, depending on how the bank sets up its processes, the bank is going to give you the credit [the] same time,” said the investigator, who requested anonymity due to not being authorised to speak publicly about the case.

“But when the bank is providing this authorisation, they’re providing the authorisation blindly.”

The verification by the second bank typically takes between 24 and 48 hours after the POS terminal is rebooted, giving the fraudsters ample time to either withdraw the cash or transfer it to other accounts under their control, according to investigators.

“By the time the other bank indicate that they never authorised the transaction, di man dem done move the money already. There is no limit per se as to the value of the transaction; it’s based on the discretion of the fraudster.”

The offline mode is a “genuine feature” that was implemented by the banks to help merchants process transactions during a hurricane, loss of Internet connectivity and other emergencies, one insider explained.

“It was a long-time legacy thing that has been around from the 1980s, but they’ve cut it out now.”

Revelation of the fraudulent multimillion-dollar transactions came hours after the Financial Investigation Division (FID) disclosed that a businessman is facing criminal charges for allegedly using a “sophisticated” scheme involving the use of POS terminals to fleece a local financial institution of almost $100 million.

Jerhoden Hinds, 25, proprietor of Original 24K Klothing Company Limited, has been charged with conspiracy to defraud, possession of criminal property, engaging in a transaction involving criminal property, and simple larceny, the FID said in a statement yesterday.

The scheme involved POS terminals issued by the financial institution for legitimate business purposes, which Hinds and his accomplices intentionally placed in offline mode “to exploit the system and commit fraud”, the FID statement alleges.

It’s alleged that the crimes took place between November 13 and December 28, 2022.

“By bypassing the bank’s real-time authorisation system, the scheme caused the bank to unknowingly advance funds to Hinds’ bank account, which were quickly depleted via withdrawals and transfers,” the FID statement further alleges.

“The transactions were subsequently flagged as fraudulent and losses to the local bank of approximately US$618,856 (the equivalent of J$99 million)”, the statement also states.

Keith Darien, principal director of investigations at the FID, said the case highlights the “increasing complexity” of financial crimes in Jamaica and the critical need for constant vigilance and inter-agency collaboration.

“Fraud not only undermines the financial system, but also erodes public trust,” said Darien, noting that the FID and its partners in law enforcement are committed to uncovering and dismantling these schemes.

Hinds was arrested at his home in Old Harbour, St Catherine, on Monday during an operation led by police personnel from several formations, including the Constabulary Financial Crimes Unit, the Special Operations Unit and the Counter Terrorism and Organised Crime Division.

Five cell phones allegedly belonging to Hinds, his spouse and his brother were seized during the operation, as well as two locked safes containing a total of J$1.9 million.

livern.barrett@gleanerjm.com