The FBI has charged fourteen people with stealing more than $1million by taking advantage of a loophole in the way Citigroup processes its electronic payments.

Criminals are alleged to have stolen the money from Citibank using cash advance kiosks located in Nevada and Southern California casinos. According to the FBI, the gang exploited a gap in Citibank’s e-payment security protocols by making multiple withdrawals from different kiosks in the space of just sixty seconds.

According to the FBI’s press release, the scam worked like this:

The gang’s ringleader Ara Keshishyan is alleged to have recruited a number of co-conspirators, who each went and opened several accounts with Citibank. Once the accounts were opened, Keshishyan gave his co-conspirators what’s known as ‘seed money’ that was deposited into the new accounts.

Once the money in the accounts had cleared, the gang members carefully coordinated a series of simultaneous withdrawals from about a dozen different cash advance kiosks located at Casinos scattered throughout Las Vegas, Laughlin and California.

Timing was absolutely crucial to the plot. Somehow, Keshishyan had discovered a glaring vulnerability in Citibank’s security protocols, wherein the system treats multiple withdrawals made from the same account within a space of 60 seconds as duplicate transactions – in other words, the system thinks that the multiple withdrawals are a mistake, and that in fact only one withdrawal has been made.

According to the indictment against him, Keshishyan paid off his co-conspirators with a cut of the profits before pocketing the rest of the funds for himself – which he would then use to gamble at the casinos. Apparently, the gang members were such regular visitors that some casinos even provided them with free rooms.

The fourteen defendants have been charged with fraud offences and face up to five years jail for their crimes. Keshishyan also faces 14 separate counts of bank fraud, and with it a potential 30-year jail sentence.