Citigroup software includes a mechanism intended to prevent the same “cash advance kiosk” withdrawal from being posted twice to an account. If near identical, near simultaneous transactions are submitted, the system is programmed to ignore all but one of the transactions. Thieves in California and Nevada discovered the flaw and took advantage of it.
Alleged ringleader Ara Keshishyan recruited at least 13 people to make transactions from different cash advance kiosk locations in at least 11 casinos around California and Nevada. The withdrawals were made against the same account with requests of the same amount submitted simultaneously at the cash advance kiosk. The money was then transferred to other Citibank checking accounts. The thieves would then withdraw the funds from the various Citibank checking accounts using ATM machines located throughout the casinos. Withdrawals were kept below $10,000 to avoid detection.
The thieves netted more than $1 million for their efforts which they promptly spent at the casinos (and were subsequently granted “high roller” status for their once-in-a-lifetime gambling binge).