Help - Search - Members - Calendar
Full Version: Hacking Funds
Dumpshock Forums > Discussion > Shadowrun
Chaos Kingpin
My players are curious about not "working for the man." They possibly want to fight against the corps in sort of a Robin Hood fashion. I have come up with some really fun adventure ideas, but it seems like eventually the money would run out. I mean, who would be buying what they would steal from corps besides other corps?

There is little to nothing in the SR4 rulebook about Hacking funds. Is this possible? Or somehow creating secure credsticks. Could this be an extended test that a Hacker is always working on?

I have seen a little info on the "Radical Eco-Shaman" type character, but I wonder, is there any sort of Greenpeace/Adbusters type group that would fund anti-corp attacks? In a future world where urban life is dominated by the "Big Ten", is this style of play even possible without some organization catching on and wipe my players off the map? An Eco-Dragon Perhaps? I dunno, I just want to keep my PC players interested in the game, and still have plenty of things to spray with bullets and fireballs!
fistandantilus4.0
well sure, you could work w/ AzzieWatch, or for a dragon against the coprs, like HEstaby. You can be a neo-anarchists, work with AttacK!. Just check out Loose Alliances. Or they can go indy, and just sell their loot to a local fixer. Yes ,eventaully the corps would be after you, but that's what being a runner is all about!
Hell Hound
Fistandantilus3.0 is right, Loose Alliances has some good ideas in this regard. Its an SR3 book with very little in the way of rules so it is still usefull for an SR4 game. For example;

The Commission on Megacorporate Affairs (COMA): a secret UN organisation supposedly under the Secretary Generals command that works to screw over the mega's at every opportunity whilst the rest of the UN licks their corporate masters' collective boots.

Antifa Direct Action (ADA): a loose network of Anti Fascist groups that share information and resources. Some of the Mega's border on facism in the way their corporate citizens are controlled, and ADA is (or was in 2064) at a stage where some of its cells were becoming more radical, assasinating key personnel of facist groups rather than just going in for political agitation and peacefull rallies.

Black Star: The anarchist movement's special forces organisation, a decentralised network composed entirely of shadowrunner teams who only take on black ops that target the Powers that Be (which includes the Megas), but also provide training for other anarchists and supporters of likeminded causes.

Attack!: An umbrella organisation that coordinates the efforts of various factions aimed at tearing down the megacorporate feudal power structure. Radical eco-terrorists, anarchists, fundamentalist groups, communists, all sorts of organisations and individuals are coordinated, organised and assisted by Attack!

Eco-Terrorists: Groups like TerraFirst! GreenWar and the Green Cells of course clash with the Megacorps on the issue of pollution. These groups both include shadowrunner types and hire shadowrunners when they need extra muscle.

Most of these groups fund their operations through illegal means, laundering money through front groups, so runners working for them won't necessarily be strapped for cash.
fistandantilus4.0
QUOTE (Hell Hound)

The Commission on Megacorporate Affairs (COMA): a secret UN organisation supposedly under the Secretary Generals command that works to screw over the mega's at every opportunity for cash.

well it was a secret! Now it's out and they're screwed, thank you very much! nyahnyah.gif
Chaos Kingpin
Thanks! That helped alot. Any suggestions as far as hacking funds/conterfeit credsticks?
Critias
I'd imagine most companies have their cash money protected pretty hard. I'm sure it's occured to someone, at least once or twice before, to try and hack in and steal a gajillion nuyen, and that the corps (being profit minded, as a rule), frown on that sort of thing.

I'm sure it's possible -- hacking into some department's budget reports, altering a little here, a little there, creating an employee record in this company and that company and this office and that branch and then getting an occasional credit transfer for imaginary workers, to your account -- but I'm also sure it's difficult, and if it's not done carefully and quietly, will get you very much dead.
Brahm
QUOTE (Chaos Kingpin @ Jan 28 2006, 03:56 AM)
Thanks! That helped alot.  Any suggestions as far as hacking funds/conterfeit credsticks?

I think there is a blurb about certified credstick fraud, and how it doesn't create money. Instead you just create a duplicate certified credstick of the original one. They both report a given amount, but only the first one to report the transfer of all the money out works. The verification check with the Zurich Orbital Bank fails for the second one as a duplicate transfer.

But I cannot find the reference right now.

Or maybe I dreamed it all and should stop sleeping with my head resting on that running RFID tag easer.
Hell Hound
Rerouting funds would be a risky, but potentially lucrative, method of obtaining cash. If you are already hacking into a corps systems to mess with their operations, you are probably going to be able to check their transaction records and predict when the next major funds transfer will occur (like when their insurance company pays out for the damage your current run will cause). Then you could organise for it to be transferred to an offshore private bank account moments after the money reaches the corporation.

It's like a high tech and high stakes variation on an old burglary trick. After breaking in to a reasonably lucrative house the burglars try again a few weeks later when they figure the owners have replaced everything they stole the first time. (Luckily in my case my insurance company was slow and the burglars impatient).

Of course, intercepting a virtual cash transfer of any appreciable size would be a shadowrun in itself, and you would need somewhere to get rid of it in a hurry since the corp you stole it from would be all over you very quickly. Some anti-corp groups might offer to launder the cash for you in exchange for a percentage, mobs could do the same but would take the majority of the cash and just pay you a 'finders fee'. In the end it would depend on how much you stole and who you took it from. Steal a big wad of cash from a Megacorp and no one will touch you.
hobgoblin
thing is, there is no actual funds changing hands. instead its a matter of one bank telling another bank (preferably over a secure channel) that their client wants to transfer an amount to a client of the other bank.

then one bank decrease the account at their end, and the other increase. the datatrail at both ends verifys the transfer. its when the datatrail going missing that you have a problem.

now, if you can fake a transfer from bank A to bank B, suddenly you have "created" money wink.gif isnt non-physical cash fun? the trick is to spend said cash on physical items before the "error" is spotted, and then sell the items of again to a third party. preferably do this 2-3 times, using certified credsticks each time.

tick is to make the trace more costly then the sum you "stole" wink.gif

im guessing that all the AAA and many of the lower level corps have their account with the big bank in the sky.

basicly, dont belive that a electronic money transfer is anything like what you see in swordfish and similar where the numbers count down. the transfer will be over in seconds, ones the verifications have been taken care of.

so stealing cash by intercepting a money transfer is more or less a no go.

as for creating a fake certified credstick, that depends on how the stick works. is its entire sum stored on a encrypted chip inside the stick. or is is just a access "key" to a numberd account stored on some banks node?

given how laughable encryption in SR is, logicaly i would think its the latter. but i would not be surprised if its the former, and that the big boys are running one hell of a spin on how secure it all is. as long as it do not happen to often, or they can somehow pin it on user error, they dont care.

point isnt to make it 100% secure, but more trouble then its worth for joe wageslave to risk his social and economic life over. you have a nice job, a nice apartment, a steady income. why risk it by creating fake credsticks?

now, if you somehow no longer exist (officialy that is), but know how to do it, feel free. its a nice income source. and if you do it to often, some runners, a special ops team, or maybe even the star, will shop up at your place to tell what a bad boy you have been...

it does not have to be 100%, is just have to look like its 100% smokin.gif
its a bit like enron, see no evil, hear no evil, speak no evil, and it may be worth your while. but rock the boat and you will go down with the ship...
FrankTrollman
There's been a major crash in recent memory, so expect confidence in e-currency to be low enough that a lot of people will conduct most/all transactions in paper cash once again. As for hacking funds, it can be done, but there's nothing you can do to a credstick that will make you have fat stacks of fake money.

A credstick doesn't have any money at all, it just contains a very complex set of formulas that allow it to authorize servers that are very far away to transfer funds from one account to another. Hacking funds can be done a number of ways, and would work like this:

[*] Hack ZO. This is not reccommended, but if you go VR into Zurich Orbital itself and fight your way through all of its black black IC, you can use Edit to add as many zeroes as you want. Make sure you cover your data trail really well, because security hackers check for that sort of thing and can request that you be Thor Shot.

[*] Spoof ZO. Again, not reccommended, but it's more thinkable. In this model, you whip out some insanely fancy data interception, and tell someone's credstick that a large amount of money has been transferred to their account. This will only work as long as your spoof holds, but in the meantime you can have real goods and services delivered to you.

[*] Hack some Assets. In this model, you don't do anything to the finances at all, and instaid go after the much easier target of assets. You sell some things that are not yours (Real Estate, Urban Brawl Tickets, Software Licenses) for money that ZO considers to be "real".

[*] Hack a funds transfer request. In this model, you hack someone's credstick to authorize a funds transfer to your account. You can't transfer more funds than they have, and you'll need to have (or successfully spoof) access to their credstick.

The last two are the ones that are likely to work, but as they rely upon committing fraud against actual people or organizations, you'd better spend that money fast, or kill the victims, or whatever, because when that fraud gets reported the corp court is going to send a fraud management team after you to manage your claim.

-Frank
Rotbart van Dainig
Sometimes, I really wonder whether people bother reading background info at all... before making stuff up.

The only credsticks you'll ever see 2070 are certified ones, and hard 'cash' tends to be limited to black markets or really underdeveloped countries.
Chaos Kingpin
QUOTE (Rotbart van Dainig)
Sometimes, I really wonder whether people bother reading background info at all... before making stuff up.

The only credsticks you'll ever see 2070 are certified ones, and hard 'cash' tends to be limited to black markets or really underdeveloped countries.

Sometimes I wonder if people even bother to read all of the posts before chiming in...

I don't know exactly what you are talking about when you say "making things up," so far all I have seen is a constructive discussion revolving around a solutions to a problem. And I might add, discourse that up until know has been very interesting and helpful.

What exactly are you getting at with the certified credsticks? As far I can tell that is exactly what we have been talking about, and the "cash" you mention is nowhere in this thread. We are exploring avenues for moving digital currency.

Yes, I am sure that there is some obscure info somewhere back in the 10 plus years os SR's history and that is exactly why people come to a place like this with questions for those who may have the information.

Now, are you just trying to SOUND wise to ways os Shadowrun, or do actually have anything CONSTRUCTIVE to say?
hobgoblin
QUOTE (Rotbart van Dainig)
Sometimes, I really wonder whether people bother reading background info at all... before making stuff up.

i wonder, who was that aimed at?
Aku
QUOTE (hobgoblin)
QUOTE (Rotbart van Dainig @ Jan 28 2006, 07:59 PM)
Sometimes, I really wonder whether people bother reading background info at all... before making stuff up.

i wonder, who was that aimed at?

i i had to wager, i'd bet on frank
Rotbart van Dainig
QUOTE (Chaos Kingpin)
Sometimes I wonder if people even bother to read all of the posts before chiming in...

Uhm, well... yeah, thats what I thought about your reply - sorry for not copy-quoting so that the context is immediately visible... I was just referring to the post directly above. wink.gif

QUOTE (FrankTrollman)
There's been a major crash in recent memory, so expect confidence in e-currency to be low enough that a lot of people will conduct most/all transactions in paper cash once again.

This is the point I referred to, simply because it directly contradicts Life on the Edge - Day to Day - Show me the Money:

Commlinks are the things used instead of credsticks.
Since those happen to be online most of the time, it is quite easy to hack them...

QUOTE (Chaos Kingpin)
Now, are you just trying to SOUND wise to ways os Shadowrun, or do actually have anything CONSTRUCTIVE to say?

Well, if you are asking that politely...

Check real credit card fraud cases - with accounts, that's about the only way to go for anything not falling prey to automated checks:

Making transactions with someone elses money, and spending it immediately if concerning sums are likely to be noticed.

Or, very slow but much safer, gaining acces to many commlinks and creating a bot-net of agents.
These transfer very small accounts over a long time, through the accounts of the bot-net, and ultimatly to some off-shore accounts, disguised as charity organisations.
September
Remember, NO corp except a two-week old start-up is going to have hundreds if not thousands of different accounts. There's no 'Saeder-Krupp Bank Account' - there's the 'Saeder-Krupp Chicago-Area Military Expenditures' account and the 'Saeder-Krupp Seattle-Megaplex Advertising Deparment' account. Part of stealing corporate money is figuring out where it won't be missed, at least not at first. A useful trick? Inflate the amount of money your Johnson withdrew at the bank (this takes some footwork to track him down). Then take the extra for yourself.
Chaos Kingpin
I got a little testy...

Good idea with looking into current fraud cases... I'm on it!
Brahm
QUOTE (Brahm)
QUOTE (Chaos Kingpin @ Jan 28 2006, 03:56 AM)
Thanks! That helped alot.   Any suggestions as far as hacking funds/conterfeit credsticks?

I think there is a blurb about certified credstick fraud, and how it doesn't create money. Instead you just create a duplicate certified credstick of the original one. They both report a given amount, but only the first one to report the transfer of all the money out works. The verification check with the Zurich Orbital Bank fails for the second one as a duplicate transfer.

But I cannot find the reference right now.

Or maybe I dreamed it all and should stop sleeping with my head resting on that running RFID tag easer.

Found it in the skills chapter USING FORGERY, page 124-125. Although my summary is a bit off, the gist of it is correct.
stevebugge
QUOTE (September @ Jan 28 2006, 12:43 PM)
Remember, NO corp except a two-week old start-up is going to have hundreds if not thousands of different accounts.  There's no 'Saeder-Krupp Bank Account' - there's the 'Saeder-Krupp Chicago-Area Military Expenditures' account and the 'Saeder-Krupp Seattle-Megaplex Advertising Deparment' account.  Part of stealing corporate money is figuring out where it won't be missed, at least not at first.  A useful trick? Inflate the amount of money your Johnson withdrew at the bank (this takes some footwork to track him down).  Then take the extra for yourself.

Actually there probably is a single Saeder-Krupp bank account. What it sounds like you're talking about is internal accounting, which reflect how the company keeps track of it's expenditures and revenues and determines if individual branches are profitable or not and uses the data to determine wages, benefits, prices, and the value of the company. Ultimately all of the money spent is pulled from a single actual bank account and all the money collected is put in to that same account.

SO as far as hacking accounts go, if you can get in to the internal accounting (and I would not recomend doing this to SK because everything I've read says Lofwyr is smart enough to do his auditing himself almost in real time) you could have a payment issued to a front of your choice, authorized, and probably paid to you. Of course evetually internal auditors would review the expenditure and question it.
Brahm
QUOTE (stevebugge @ Jan 28 2006, 05:55 PM)
QUOTE (September @ Jan 28 2006, 12:43 PM)
Remember, NO corp except a two-week old start-up is going to have hundreds if not thousands of different accounts.  There's no 'Saeder-Krupp Bank Account' - there's the 'Saeder-Krupp Chicago-Area Military Expenditures' account and the 'Saeder-Krupp Seattle-Megaplex Advertising Deparment' account.  Part of stealing corporate money is figuring out where it won't be missed, at least not at first.  A useful trick? Inflate the amount of money your Johnson withdrew at the bank (this takes some footwork to track him down).  Then take the extra for yourself.

Actually there probably is a single Saeder-Krupp bank account. What it sounds like you're talking about is internal accounting, which reflect how the company keeps track of it's expenditures and revenues and determines if individual branches are profitable or not and uses the data to determine wages, benefits, prices, and the value of the company. Ultimately all of the money spent is pulled from a single actual bank account and all the money collected is put in to that same account.

Not all their cash is going to be in one account. My wife and I have our own small consulting business and including the accounts for tax avoidance, not to be confused with tax evasion, we have 5 different bank accounts under various different entity names for the operation of that company.

The internal funny money accounts though are definately a way to move around cash to hide the theft from their accounting for a while so you can get away.
stevebugge
QUOTE (Brahm)
QUOTE (stevebugge @ Jan 28 2006, 05:55 PM)
QUOTE (September @ Jan 28 2006, 12:43 PM)
Remember, NO corp except a two-week old start-up is going to have hundreds if not thousands of different accounts.  There's no 'Saeder-Krupp Bank Account' - there's the 'Saeder-Krupp Chicago-Area Military Expenditures' account and the 'Saeder-Krupp Seattle-Megaplex Advertising Deparment' account.  Part of stealing corporate money is figuring out where it won't be missed, at least not at first.  A useful trick? Inflate the amount of money your Johnson withdrew at the bank (this takes some footwork to track him down).  Then take the extra for yourself.

Actually there probably is a single Saeder-Krupp bank account. What it sounds like you're talking about is internal accounting, which reflect how the company keeps track of it's expenditures and revenues and determines if individual branches are profitable or not and uses the data to determine wages, benefits, prices, and the value of the company. Ultimately all of the money spent is pulled from a single actual bank account and all the money collected is put in to that same account.

Not all their cash is going to be in one account. My wife and I have our own small consulting business and including the accounts for tax avoidance, not to be confused with tax evasion, we have 5 different bank accounts under various different entity names for the operation of that company.

The internal funny money accounts though are definately a way to move around cash to hide the theft from their accounting for a while so you can get away.

How many accounts a company has is probably dependent on what line of business they are in too. The company I work for (mid sized trucking and shipping company) has only a single bank account, and probabaly the most unnecessarily complicated internal accounting ever.
Brahm
QUOTE (stevebugge)
How many accounts a company has is probably dependent on what line of business they are in too. The company I work for (mid sized trucking and shipping company) has only a single bank account, and probabaly the most unnecessarily complicated internal accounting ever.

Sure it will depend, but this is a very simple business. I subcontract for contractors. I bill them, they bill their clients. Cheques get cut.

So this shipping business doesn't have any employee profit sharing plans then? Not even one that most employees are unaware of? That would be odd unless no family members of the owners work there, and usually that needs it's own account. What about accounts for the owner to siphon on earnings but have it become income immediately?

Also once you get up to multinational level you usually have multiple subsiduaries, each will require some sort of a separate account even if some of them are often fairly empty but with a high throughput of cash.
stevebugge
Well it has an ESOP, which could be considered a bank account I suppose. If you count the 401K it would have as many as 3. But as far as business operations go there is a single account.

Members of the owners family are paid like regular employees, as is the owner himself. It's a well established company so the owner can pay himself a sizeable salary, I believe the profits are disbursed annually as a bonus. I'd still say that the number of accounts a company has is probably dependent on industry and management style, as well as size and business locations.
Tiger Eyes
On the subject of 'creating funds' for your team, here's one of my team's favorite tricks...

The hacker goes into a small company (Company A) with online sales and sets up an administrative (if necessary) passcode. She then places a sales order for some item that the company orders from its supplier (Company B) and marks the order 'paid in full'. Company A's automated ordering system orders the item, has it shipped, and the runners either pick it up (using generic vans and disguises), preferably directly from a warehouse, or have it delivered to a suitable location.

The 'stolen goods' are traded for money, favors or contact-building. Or, used to supply us.

The hacker, immediately after said item is delivered/picked up, goes back into the system and erases all tracks of the order: the sales slip, the video footage of the pick up, the delivery logs... everything. (We've done this enough - and we have players who have worked in shipping/inventory control/internal audit to give us the details - that we've come up with a SOP).

With electronic billing and automated accounting systems, it takes weeks (or months) before the two companies figure out what happened... Company B asks for payment, Company A denies ever ordering or receiving anything... If you do this with a company that has lots of sales (but isn't a mega-corp) it will take lots of time for them to figure out they've been hacked. Plus, eventually one or the other will write it off to shrink...

Like I said, we avoid the mega-corps and their closely held subs...

We run a very low financed team - we work for an NGO - so we have to find creative financing solutions. biggrin.gif Since we have no cash for bribes, we do our research and bribe with goods... Amazing the reception a case of fine whiskey will get you... biggrin.gif
Chaos Kingpin
very nice...

Now we are getting somewhere. What I am getting exited about almost more than the "free money" is that unbeknowest to my runners, I will be silently hunting them down. So, if they get too cocky about it and slip up a little... *chop!* the cleaver comes down.

I think I will like this GM thing...
Zen Shooter01
Yeah, money is data, data can be stolen.

And there are lots of people who want to buy things besides corporations. SINless people living in feral urban zones and rural areas need things - steal a truckload of granola bars, or sneakers, or light bulbs, and sell it to them at 50% off.
nick012000
Or, judging by the rules on fencing stuff... 70% off. wink.gif
Lagomorph
Our team tends to make money by doing insider trading (we've done something like this twice now). We just short sold stock on one of the corps we attacked since the data we leaked would drive the stock down, and net us a profit. Shortselling is a process which you make money off of a stock going down, so if you make the stock go down, you make money. Simple eh?

edit: Besure to never use that SIN again though if you do this biggrin.gif
evil1i
QUOTE (Lagomorph)
Our team tends to make money by doing insider trading (we've done something like this twice now). We just short sold stock on one of the corps we attacked since the data we leaked would drive the stock down, and net us a profit. Shortselling is a process which you make money off of a stock going down, so if you make the stock go down, you make money. Simple eh?

edit: Besure to never use that SIN again though if you do this biggrin.gif

Well other than a Mega assuming you are a fixer profiteering off work contracts there shouldn't be too much of a backlash from this kind of action.

1) The SIN shouldn't be in anyway connected to the company the shares are related to (eg just some joe shmoe off the street buying and selling shares)

2) Only some of your runs should result in share fluctuations (if they are quiet in/outs then more than likely actions and their fallout will be covered up by victim corp and this helps with 3)

3) Reason for fluctuation may not be immediately (if at all) evident and so share trade shouldn't be flagged by stock exchange.

4) Do your trading through a broker and there is a good chance your SIN will never get linked to the shares in question anyway.

5) a bit of legwork should allow you to profit in the other direction too (eg find out who gets the profit from your run and trade in their shares because as their competitor goes down there is a good chance they'll go up)

You could even try out proactive insider trading whereby you hack into a news network and plant info regarding a corp you just did a run against based on info you took whilst inside their system/compound. The dirt should cause the share fluctuation you are looking for and profit off
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Dumpshock Forums © 2001-2012