be reading a coded message on their screen telling them to ‘call in immediately’. RedBrigade would have to scrutinise the teller’s face. Is she rumbling me this minute? Should I run? Or do I just stand here like an imbecile and wait for the cops to turn up? Maybe there’s nothing wrong at all and I’m being paranoid?

Not at WaMu. Those cheapskates didn’t want to waste money on computer screens and coded security messages. So if the card was rejected in this establishment, RedBrigade would just look slightly surprised, apologise and walk off. Nobody called in the cops at WaMu.

But his cards never were turned down. On this December day in 2003 the lady swiped his card and it was approved straight away. He then signed a printed-out receipt with a transactional code on it, before walking to the machine at the front of the bank. In went the code. A momentary wait and then, like a fantasy one-armed bandit in a Las Vegas casino, it spewed out the cash in fifties: 1,000, 2,000, 3,000 . . . on and on, until RedBrigade stuffed 200 fresh fifty-dollar bills in his pocket.

Sometimes it seemed as though the banks had left their ATMs open to him and his friends on purpose. It was so easy, he thought, it was as if we were the chosen ones. He particularly enjoyed siphoning funds from Citibank. Of all the banks, Citi deserved it. First of all, they were the most immoral of all those bastard bankers. Second, their security sucked.

Phishing was, from an early stage, critical to all manner of cyber- crime. Even if a company’s digital defences were sealed tight, a relatively inexperienced hacker could breach them with a phishing attack. This is the mass dispatch of emails to addresses that are sometimes targeted as belonging to a specific company – a bank, for example – and some- times chosen at random. Many spam messages contain either an infected attachment or a link which, if pressed, would direct a browser to a site that can automatically download malware. If a hacker sends out several million spam emails, he does not need a high response rate in order for it to be worthwhile – each compromised computer promises access to bank accounts and other personal or financial information.

Banks have always been faced with one overwhelming security head- ache: their customers (although this did not excuse the banks’ appall- ingly weak security systems during the first fifteen years of Internet