📸 Photo

KINGPIN

end. When he investigated, he learned that the victim customers had all fallen for a phishing attack aimed specifically at their debit card numbers and PINs.

But something didn't make sense: CVVs were supposed to prevent exactly this kind of scam. Without the CVV security code programmed onto the magnetic stripe of the real cards, the phished information shouldn't have worked at any ATM in the world.

He dug some more and discovered the truth: His bank simply wasn't checking the CVV codes on ATM withdrawals, nor on debit card purchases, where the consumer enters the PIN at the register. In fact, the bank couldn't perform such a check consistently if it wanted to; the third-party processing network used by the bank didn't even forward the secret code. The Italian phishers could program any random garbage into the CVV field, and the card would be accepted as the real thing.

The manager moved the bank to another processing network and reprogrammed his servers to verify the CVV. The mysterious withdrawals from Italy halted overnight.

But Commerce Bank was just the beginning. In 2004, nearly half America's banks, S&Ls, and credit unions still weren't bothering to verify the CVV on ATM and debit transactions, which is why America's in-boxes were being flooded with phishing e-mails targeting PIN codes for what the carders called “cashable” banks.

Citibank, the nation's largest consumer bank by holdings, was the most high-profile victim. “This e-mail was sent by the Citibank server to verify your e-mail address,” read a message spammed from Russia in a September 2003 campaign. “You must complete this process by clicking on the link below and entering in the small window your Citibank ATM/ Debit Card number and PIN that you use on ATM.”

A more artful message in 2004 capitalized on consumers' well-founded fears of cybercrime. “Recently there have been a large number of identity theft attempts targeting Citibank customers,” read the spam, emblazoned with Citi's iconography. “In order to safeguard your account, we require