📸 Photo

KINGPIN

cards with the account data and wrote each card's PIN on a sticky note affixed to the plastic. Then he'd get on his bicycle or take a long meandering walk through the city, visiting small, customer-owned cash machines at locations free of surveillance cameras.

He'd enter the PIN, then the withdrawal amount, and chump, chump, chump, chump, the ATM spat out cash like a slot machine. Max would pocket the money, write the new, lower account balance on the Post-it, then look around discreetly to make sure he hadn't drawn any attention before drawing the next card from his deck. To keep his prints off the machines, he'd press the buttons through a piece of paper or with his fingernails, or coat the pads of his fingers with hydroxyquinoline—a clear, tacky antiseptic sold in drugstores as the liquid bandage New-Skin.

Max dutifully sent a fixed percentage of his take to Russia via Western Union MoneyGram, per his agreement with the supplier. He was an honest criminal now, doing straightforward business in the underground. And even after getting his own magstripe writer, Max continued to give some of his PINs to Chris, who continued tapping his crew to burn through the cards aggressively.

On the surface, Max's ATM visits weren't much of a Robin Hood operation, but Max took moral solace in the fact that the cash-outs always ended with the cards being canceled. That meant the fraudulent withdrawals were being discovered, and Citibank would be forced to reimburse its customers for the thefts.

After some months, Max built a nice nest egg from Citibank's losses: He moved with Charity to a $6,000-a-month house rental in San Francisco's Cole Valley and installed a safe for his profits: $250,000 in cash.

His earnings were just a tiny piece of the losses from the CVV gaffe. In May 2005, a Gartner analyst organized a survey of five thousand online consumers and, extrapolating the results, estimated that it had cost U.S. financial institutions $2.75 billion. In just one year.