Security & Fraud

ATM Hacker Behind $55M Computer Scheme Pleads Guilty

In the denouement to a breathtaking cash heist, the brains behind a hacking ploy that grabbed $55 million pleaded guilty in a Brooklyn Federal Court to bilking ATM machines globally.

New York Daily News reported Wednesday (March 2) that Ercan Findikoglu, described as “merely a high school graduate,” nonetheless was able enough to breach the computer systems of “at least” three payment processors stretching across Visa, MasterCard and a series of debit cards

In a statement before the court and Brooklyn Federal Judge Kiyo Matsumoto, the confessed hacker said: “I intended to defraud the financial institutions by manipulating the account balances.”

In describing his efforts, Findikoglu said he boosted account balances and then sent the account information on to what were termed “cash crews” that operated in 26 cities across the globe, in thefts that took place between July 2010 and Feb. 2013. His own home base was in Turkey.

Once the information was transferred, the crew members started to take cash from the ATMs, usually in large amounts, the charges filed in Court stated. The latest admission of guilt, that of the mastermind, came after 13 co-conspirators pleaded guilty.

In New York City alone, roughly $2.8 million was stolen from ATMs, representing the largest cash heist since the 1978 Lufthansa lift, immortalized in the movie “Goodfellas.”

In terms of the sentence Findikoglu faces, he could be in jail for 14 years upon being sentenced in July. He also must pay $55 million to financial institutions victimized in the scheme and pay a $250,000 fine. Upon finishing his term, he will be extradited to Turkey, Daily News reported.


Latest Insights: 

Our data and analytics team has developed a number of creative methodologies and frameworks that measure and benchmark the innovation that’s reshaping the payments and commerce ecosystem. The May 2019 PSD2 Tracker Report, is a go-to, monthly resource for updates on trends and changes regarding PSD2 and other privacy and data protection regulations.


To Top