Bandits Without Borders

Guatemala isn’t exactly renowned for efficiency and neither is Latin America. Mention “manana time” and there’s no need for any explanation. G.S.T or “Guatemalan Standard Time” is an attempt at humor and understanding, with only two exceptions to the ‘˜manana’ rule. The Empresa Electrica aka the one and only electric company and the various competing telephone/media providers. With the electric company, when your bill isn’t paid, they turn off the power immediately. With the mobile phone/internet providers, you pay by the minute and when the time is up, you’re not.

This attitude of lassitude might explain why a major bank in Latin America, long established in Guatemala and recently acquired by a banking behemoth out of Colombia hasn’t moved more quickly to put out a continuing international firestorm of complaints. BAC, otherwise known as Banco America Central and/or Credomatic has been on notice for several months that their Antigua branch has been the source of hundreds of thousands of dollars and other currencies withdrawn illegally and re-routed to Bogota, Colombia. It may be also sheer coincidence or a random act of fate that the underlying purchaser of BAC happens to be the Bank of Bogota, which in turn is an asset of the umbrella corporation known as the Grupo Aval. This mega- conglomerate is owned and controlled by one of the wealthiest men in the Western Hemisphere, a Mr. Juan Sarmiento, ranked #147 on the Forbes Billionaire List. It is inconceivable that the picayune amounts of a million dollars or so would make any difference to such a powerhouse of a company or a financial tycoon of the Latin persuasion. Considering that Grupo Aval paid $1.9 billion dollars for the assets of BAC, it doesn’t make any sense that they wouldn’t also invest in the latest security but that appears to be the case.

Oddly enough, the first wave of unauthorized ATM debits began in September, three months after the Grupo Aval announced the pending acquisition of BAC. There were some behind the scenes stock maneuvers, some of which required the then-owner, G.E Capital (yes, another electric company) to purchase the outstanding twenty five per cent of shares and add those to their holdings of 75% of the stock. Once accomplished, with whatever profits one might have made if one knew the inner workings, the deal was closed in December of 2010. Coincidentally in that month, there was a spike of unauthorized withdrawals from the same branch of the same bank, with a similar trail back to Bogota.

This has continued through January, February and so on — and now, a few months later nothing has changed except for two things. Just in time and perhaps just another coincidence for the massive crowds that attend the world famous celebration of Easter Week in Antigua, the centrally located and most heavily used ATM’s, located in the lobby of the aforesaid ‘˜bank’ had two improvements. The first was the removal and re-wiring of a standalone BAC ATM located a few doors away, and which later joined the trio of mute electronic bandits in the lobby. The second was the posting of two large vinyl banners, announcing in both English and Spanish the methods of avoiding ATM thefts and the literal bottom line proclamation of the use of the ‘˜latest anti-skimming technology.’ All well and good, one might think. Progress and technology has come to Antigua and the problem is solved. Case closed, or ‘˜book ‘˜em, Danno — murder one.”

If only it were so. If only there wasn’t the daily complaints and discoveries of de-nuded bank accounts being remotely vandalized by Colombianos, Venezuelans, Mexicans and assorted other varieties of bandits without borders. From all appearances and reflections on the current remote ‘˜transactions of the worst kind’ there is a common thread. The data streams from one ATM to the bank of the issuing card and back are capable of being intercepted and redirected. This is not new technology although to the gnomes of the Gautemalan banking industry and their so-called ‘˜fraud experts’ the world of MP3 players, video cameras and newly installed cover pads over the keyboards represent the cutting edge of protection. One might compare such to the medieval use of sheep intestines to the present day latex condom: the purpose is the same but the technology has improved. The end result is likewise the same: there is no security regarding any deposits.

It has been said by the General Manager of BAC/Credomatic Guatemala that the banking data is sent via transmission of a 256k bit level of encryption. There are two problems inherent in this method: the first being that 256 bit encryption is neither secure nor unbreakable and the second is that this data is being sent over wireless data points within Guatemala. It has been demonstrated and proven that remote acquisition and manipulation of ATM functions is child’s play: admittedly ‘˜advanced child’s play’ but not impossible or terribly difficult. The electronic keys to the ATM’s vault are available over the Internet for a few dollars, as are data mining software programs specifically meant for 21st century remote gold digging. It is any wonder that some employee or some external cyber-thief found the pickings just too easy to ignore?

It may well be that the very size of this newly created trans-continental beast is analogous to a dinosaur: by the time that a pain message is transmitted from the tail to the head, months go by. The General Manager of the banks’ Guatemalan subsidiary is an urbane and determined gentleman of Germanic extraction, and seems to want to solve these issues. Is this simply a case of fearing the ‘˜kill the messenger’ syndrome or a situation where the typical Latin response is to wait and see, avoiding responsibility in the short term and ignoring the signs of a major international problem? To give the corporate board members their due, it may be that the acquisition of bank branches stretching throughout every country in Central America takes time to assimilate and to become familiar with each countries operations. It’s been reported that there wasn’t a meeting between the Colombian board members and those of Guatemala until sometime in March. It’s highly unlikely that anyone at that meeting raised their hand, as if to say “we might have a small problem in Antigua.” In the meantime it has been said by impeccable sources that Belgium or a banking entity in that country has sanctioned all ATM transactions originating in Guatemala. There is, at this point, a rumor that a Danish bank has done the same, perhaps originating from some Danish tourists who happened to be staying at an expensive hotel and discovered that their bank accounts had been drained.

The stories, anecdotes and daily occurrences of cyber-theft haven’t stopped, abated or diminished. New and old ATM cards are being cyber-stripped, as is the older captured data that is being used to repeatedly rape still-functional accounts near and far. Are these the original gang of remote raiders? Probably not entirely: the data has value to others and this can sold, used and re-used until the distant victim and/or their bank has discovered the illicit withdrawals. There are no laws in any Latin American country against this type of theft. “We need proof..” said the BAC manager at a recent meeting sponsored by the Guatemalan tourist agency. Observe the manager of the Antigua branch, opening the front panel of an ATM and playing with a keypad. Listen to 50 or so outraged American residents giving direct testimony, at more than one meeting. Read what the US and British embassies have posted on their web sites. The US Embassy alone has logged over a hundred complaints and those numbers are several months old. Read the daily emails and Facebook accounts of banditry in action or the next article in a local magazine, Que Pasa. Follow the electronic trail of serious sums of money back to Bogota. Proof? To paraphrase B. Traven, one doesn’t need any ‘˜stinking badge’ to tell the difference between the thieves and the miners: they’re one and the same.

This is not to say that there aren’t other problems with other ATM’s in Guatemala: there are but none so centered or numerous as the BAC branch in Antigua. As the infamous US bank robber Willie Sutton once said, when asked why he robbed banks, ‘˜because that’s where the money is.” As some fifty thousand or more visitors descend upon Antigua for the massive Easter Week processions and the banks are closed for the holiday, the only sources for cash are the ATM machines. It’s a 21st century gold mine for some and the shaft for the unlucky and unsuspecting users: caveat emptor indeed. Something stinks in Antigua and it’s not badges.