A week ago, on July 29, when everyone was getting their beach bags ready, two representatives of Raiffeisen Bank knocked on the offices of the General Directorate of the State Police.
The reason was the filing of a fraud report. The bank had been attacked. Not with guns, not in masks, not by its employees, but by 40 thieves who had taken advantage of a “loophole” in its payment system.
More than 40 odd customers were found to have withdrawn small amounts of money from time to time, mostly 100 euros, when they had no deposits or accounts filled with money. Together, at different times, they had taken a small “bag” of about 200 thousand euros from the bank. But that is all they have been reported for, as the bag could be larger.
How do you withdraw money when you have nothing in your account?
This was what engineer RZ, a guy passionate about electronics and programming, had thought about. As the main suspect, he had noticed an almost unbelievable anomaly. In the late hours of the night, the Raiffeisen system “slept” along with the employees. During these hours, you could make online transfers within accounts or from card to card, using the bank’s applications, while they answered you without asking whether you had money or not.
At two specific times around midnight, “Ali Baba” discovered that if you transferred money from one account to several others, the system would not say “no”. The money could be withdrawn by the people to whom these transfers were shown, while the account that had made the “gifts” was only seen some time after this action had been carried out. All an electronic anomaly of the Raiffeisen Bank digital platform in Albania.
RZ had discussed this flaw as “nothing wrong” with a friend of his, EM, also a resourceful guy who knew the banking system quite well, having worked for the microfinance company Kredo.al .
To avoid being noticed, small amounts had to be extorted that were sent from one account to dozens of others. This was the idea of EM, which had ready microcredit “cells” with people who had no problem handing over their ID cards to open bank accounts in exchange for a small fee. If 400 euros appeared in the account, the person making the withdrawal would get 100.
But “Ali Baba” and the 40 thieves began to stand out, because the accounts began to smell.
Raiffeisen submitted a list of more than 40 people to the police, requesting investigations and arrests for the robbery that took place late at night, by Ali Baba with a tablet in his hand. And not once, but dozens of times.
The bank claims it was defrauded and the perpetrators should be put in prison.
The police are silent, Raiffeisen is silent, the Bank of Albania is silent about this event that should have been told and shared with the public, so that at least they stay awake, if their bank is sleeping. /Kontrast.al