Operation Echo smashes Bulgarian cybercrime gang

Complete counterfeit card production kits confiscated - plans to draw cash at magnetic stripe card-using ATMs in Asia thwarted

Operation Echo smashes Bulgarian cybercrime gang
Operation Echo smashes Bulgarian cybercrime gang

Bulgarian and French judicial plus law enforcement agencies - working in close cooperation with the European Cybercrime Centre (EC3) at Europol and Eurojust in The Hague - have smashed a Bulgarian organised crime network suspected of a variety of crimes, including card plus e-payment and associated document fraud, currency counterfeiting and drugs trafficking.

According to Europol, Operation Echo - which was carried out on Wednesday of this week - resulted in 11 arrests, including four European Arrest Warrants, and 29 house searches across Bulgaria. The European police agency says that bulk of the simultaneous searches and arrests took place in Silistra, Varna and Razgrad - all cities in Bulgaria.

Europol says that officials from the European Cybercrime Centre (EC3) attended the scenes of the arrest, using a mobile office to access Europol's database, as well as exchanging information in real time between the various agencies and their personnel.

Investigators found three "complex" production sites for payment card skimming kit in the city of Varna during the raids, and Europol says that "quantities of micro camera bars, card readers, pieces of electronics and plastic cards ready to be encoded" were seized.

The raids also revealed complete systems capable of producing counterfeit bank cards - along with magnetic strip readers and writers, computers, mobile phones and flash drives. All the kit was confiscated during the multi-city searches.

SCMagazineUK.com notes that the police also say they confiscated dozens of forged payment cards with records of PIN numbers, ready to be used at other ATMs.

All the raids and arrests were coordinated from the command centre set up in Silistra regional headquarters of the Bulgarian State Agency for National Security. French and Bulgarian offices started working on the investigation at the start of 2013.

Following the establishment of a joint investigation team (JIT) between the two countries at that time, operational and coordination meetings were held together with Eurojust and Europol. In addition, Europol supported the investigation with operational analysis from the early stages, while Eurojust provided legal advice, funding and essential logistical equipment.

Europol says that the main modus operandi of the criminals was to harvest financial card and allied data from ATMs in different areas of France - mainly in Nancy, Metz, and Lyon - and in other EU countries, which they then used to create fake payment cards. The fake cards, says the agency, could then be used to withdraw large amounts of cash from ATMs outside the EU, including in Indonesia, Malaysia and the Philippines.

SCMagazineUK.com understands that these locations were chosen because of their use of magnetic stripe data on the cards, rather the EMV smart card system - aka Chip & PIN in the UK.

Commenting on the success of Operation Echo, Europol's Director Rob Wainwright said that crime is conducted more and more online and its character is increasingly transnational.

"This operation against payment fraud shows the international scale of organised crime, which affects citizens, businesses and our collective security. It also shows the effective and ever increasing cooperation among the international law enforcement community and their effective response to the evolving threats of organised crime," he explained.

Commenting on the case, Keith Bird, UK managing director with Check Point, said that criminals are increasingly using detailed knowledge of payment systems and sophisticated means to exploit those systems, enabling them to steal large sums quickly in distributed attacks that leave few traces. 

"Responding to these threats needs a coordinated response by European police forces - as we saw with the 2012 ‘Eurograbber' attack, which stole more than £30 million from 30,000 customers of 30 banks in Italy, Spain, Germany and the Netherlands. The gang behind that case was eventually caught thanks to coordinated efforts by police, the banks and security investigators," he explained.