IT officials involved in scam

Five persons, including three Income Tax department officials and a television artist, have been arrested on charges of duping the department to the tune of Rs three crore by filing fake I-T returns of PAN card holders and illegally transferring refunds in their own accounts, CBI said here on Sunday.

The accused were identified as Dilip Vyas, I-T inspector Pramod Prabhakar, senior tax assistant Rajesh Pillai, I-T employee Raju Nagpure and television artiste Manoj Sangtiyani, CBI officials said.

While the main accused Vyas was nailed on February 17, the rest were arrested today, they said, adding that four more accused Mohan Ghadge, Sandeep Roy, Nidan Dalvi and I-T employee Shrikant are still absconding.

The officials said although Rs three crore fraud has come into light so far, the cheating amount may go over Rs 14 crore.

Explaining the modus operandi, CBI Joint Director (west zone) R R Singh said, "Vyas, posing as a chartered accountant, has collected PAN card numbers from 23 persons and bank account details and blank post-dated cheques signed by them.

"He then prepared fake IT returns, computation sheets and other related documents of these PAN card holders and provided the details to his aide Prabhakar.

"Subsequently, Prabhakar entered the said data into the computer system of IT department and generated e-refund which was electronically transferred to bank accounts of the PAN card holders."

Vyas then transferred the I-T refunds in his and aides' bank accounts in United Bank of India and Kotak Mahindra Bank using signed cheques issued by the PAN card holders, leaving one per cent of the refund amount in the holders accounts, Singh said.

"In this manner, the accused have transferred about Rs three crore in their account in the last seven months. The accused had another 70 PAN card holders' details. The fraud might go over Rs 14 crore," he said.

The cheating came to light when one of the I-Ts top officials were tipped off about it on January 19, Singh said.

"Prabhakar knew all loopholes in the Information Technology Department and practises of the I-T department and took advantage of them to execute their plan," Singh said.

Stating that the software of the I-T is incapable of making online checking of the TDS payments, Singh said the officials should also regularly change their passwords to prevent misuse of the system.

CBI is also probing if the 23 genuine PAN card holders had any idea about the fraudulent practice by the accused, he said.

PIN NO MORE A SECURITY MEASURE

A fatal flaw in the chip and PIN technology that is supposed to guarantee the security of millions of credit and debit cards has been identified by scientists.

The loophole means stolen cards can be used in shop terminals and bank cash machines without being identified, it is claimed.

In theory, thieves would be able to make purchases and cash withdrawals without needing to key in the four digit PIN or being detected.

The chip and PIN system became universal on Valentine's Day 2006, replacing the use of signatures to authorise purchases.

At the time banks said the introduction of the PIN system would reduce card fraud because even if a card was stolen it could not be used by a thief who did not know the number.

Card fraud did fall initially, however, the figure rose 43 per cent by the end of 2008 to £610million and is thought to have risen even higher last year.

Professor Ross Anderson, from the Cambridge University Computer Lab, has uncovered a number of ways in which the system can be beaten. However, he claims the latest discovery is shocking in its simplicity.

Prof Anderson claims the banks may now need to rewrite the security software around the entire chip and PIN system in order to make it fully secure.

The researchers discovered that a small circuit board containing a computer chip and transmitter can be attached to the chip on the plastic card and concealed up the sleeve.

This communicates with a computer stored in a backpack worn by the criminal when using the card at a till or cash machine.

When the user is asked for the four digit PIN to authorise the transaction, they only need to key in a random code.
The software attached to the card then signals to the till terminal that a correct PIN has been used.

'We think this is one of the biggest flaws that has ever been uncovered against the PIN system and I have been in this business for 25 years,' said Prof Anderson.

Details of the flaw were revealed on BBC's Newsnight programme last night. It showed how four different cards could be authorised for purchases in a Cambridge University canteen by using a fake PIN of 0000.

Consumer lawyer, Stephen Mason, told the programme: 'The loopholes in the chip and PIN system are serious and I don't think they have been properlyaddressed by the banks. They really have to think about this seriously.'

The introduction of chip and PIN brought with it a greater risk that victims of card fraud would have to carry the cost of any losses.

Some banks have refused to refund losses where they argued consumers had been careless with their cards or failed to keep their PIN a secret.

Prof Anderson added: 'The banks have been lying about the security of their systems and the industry regulators have been completely gullible.'

But the banks trade body, the UK Cards Association, denied the discovery was serious.

'We believe that this complicated method will never present a real threat to our customers cards,' it said.