Shades of Grey

Shades of Grey
Season	2
Number	10
Writer	Louis Milito
Director	Brandon Guercio, Kate Sargeant Curtis
Original Airdate	December 20, 2015
Navigation
Previous Episode: iWitness
Next Episode: 404: Flight Not Found

Shades of Grey is the tenth episode in Season Two of CSI: Cyber.

Synopsis

An innocent bystander is killed when ATMs spew money into the street, so the Cyber team investigate a bank heist being orchestrated by a cyber Robin Hood.

Plot

Whaling attack - an email scam that targets a high-level executive in order to gain access to his company's network.

Across the street from Cyber headquarters, two women jump for joy in the street as money seemingly rains down from the sky. Their jubilation is short-lived, as a gunman arrives, shoots a man, and leaves with the money. Nelson witnessed the events and enlisted an FBI agent to go with him and help the victim; however, they were too late.

Nelson fills Avery in on what he saw, telling her that the ATM across the street was spewing out cash. When the gunman approached and fired his gun, the two women were scared off. Meanwhile, Mia Wilcox tells Russell that her brother, Andy, stopped to withdraw money and that it started pouring out without him pushing any buttons. Suddenly, the gunman arrived and demanded the cash. Without much hesitation, he shot Andy, took the cash, and ran off.

Krumitz goes through the ATM's surveillance footage and finds that an hour before the shooting, the video feed went dead. The malfunction was created by malicious code; someone hacked into the ATM to pull off a cyber bank heist. Krumitz is soon able to determine that the target took control of the ATM by using a whaling attack on the bank's CEO, Ashton Wagner. The malicious code shows that the target had a three step plan: 1) the whaling attack on Ashton Wagner, 2) using Ashton's credentials to own the bank's network, and 3) taking control of the ATMs through that network. All the target had to do was send Ashton an email pretending to be someone he trusted. When he clicked a link, the target got Ashton's login credentials and was instantly inside the bank's network.

The transaction report from the ATM shows that after the camera cut out, customer transactions stopped being recorded. Instead the message "Payback Time" was recorded over and over. The team questions why someone would hack the ATM but not show up to collect the money. It's discovered that when Andy put his debit card into the machine, the card automatically trigged the ATM to spit out $10,000.

This ATM wasn't the only one hacked, as Barnaby Bank ATMs across the city soon start spitting out money. Nelson tries sending out a code to shut the ATMs down; however, the target simply overwrites the script. Since they can't shut the ATMs down this way, Russell gets the idea to simply have them unplugged. Krumitz identifies a function that was launched in the target's code when Andy's card was swiped. There's a list of 22,678 Barnaby Bank users whose cards would trigger an "ATM jackpot." It's soon discovered that the people who posted about the windfall on social media all had less than $200 in their accounts. Avery concludes that this isn't a heist, it's a "Cyber Robin Hood."

Though the team is able to have the Barnaby Bank ATMs in the District unplugged, CEO Ashton Wagner refuses to shut down the network. The target is still in the system and will likely come up with another way to steal money.

Krumitz receives an envelope addressed to him that contains a photo of the moment Andy Wilcox was shot and killed; the killer's face can clearly be seen. Though the camera was supposedly down, the target was still watching. Avery believes he wanted to see the joy on people's faces when money started spewing out of the ATM; however, Andy's murder was an unintended consequence of the hack. It seems that the target wants to help identify the killer.

Nelson discovers that some people on the list of 22,678 are getting random cash deposits while some aren't; curiously, every deposit has been a random amount ending in a five or zero. Those who have been lucky enough to get a deposit have also received a message with it: "Congrats. As a valued member of Barnaby Bank, you've been selected to receive a cash refund." Ashton Wagner address the media about the hack and mentions that customer accounts have been suspended until the issue is resolved. Of course, since the target has access to the system, he can unfreeze the accounts whenever he wants.

It turns out that Elijah's name is on the list; however, he hasn't been one of the lucky people to receive a deposit. He's sure he has way more than $200 in his account, but he soon sees that this isn't the case. The bank statement shows that thousands have been spent on luxury items over the last few weeks, something both he and his wife didn't purchase. Elijah tells Devon that he hasn't used the debit card in months, but he suddenly realizes that he accidentally left his card and driver's license at a bar one night. Bartender Nina Moore tracked him down and returned the lost items.

The gunman who shot and killed Andy Wilcox is identified from the photo and arrested. Krumitz analyzes the wording the target used, focusing on the word "refund." He realizes that the target is refunding overdraft fees, which explains why the deposits ended in a zero or five; the overdraft fees are all multiples of $35. Though it seems that accruing thousands of dollars worth of overdraft fees isn't possible, Krumitz explains to Nelson and Raven that's frighteningly easy to do. Banks, he says, have a policy called "check reordering"—though someone paying their bills via check would write the ones for the smallest amounts first (ex: utilities, cable, etc.), the bank processes the checks with the largest amounts first (ex: rent). Those living paycheck to paycheck would have the larger check processed first, resulting in multiple overdraft fees when the smaller checks were processed later. "Robin Hood" is refunding all of the overdraft charges the bank took through this "scam." It's possible the target is just a fed up Barnaby Bank customer looking for revenge.

Things escalate further when a fight erupts in the street between a customer who received a refund and one who didn't; the fight results in a stabbing. Avery notes that while the refunds were supposed to make people happy, the target forgot to factor in one thing—human greed.

Someone claiming to be Robin Hood posts on ToggleFly, urging the citizens to stop fighting. He says that the bank is their enemy and vows to create further chaos. A news report soon shows a masked Robin Hood driving an armored truck through the streets of the District; the truck's back door is open, and money falls into the streets. The man accomplished this by gaining access to the bank's underground parking garage and disabling their security camera with the same code used to shut down the ATM cameras.

It's known that there was $1.2 million in the back of the armored truck. With the ATMs unplugged, the bank had chosen to store their cash reserves in the back of the truck with the intention of getting it out of the District. Unfortunately, Robin Hood struck first, using a keycard to gain access to the truck. The truck itself is soon found underneath an overpass; no identifiable fingerprints are recovered. Avery points out that Robin Hood knew where the money was, how to get in, and how to get out. This was an inside job, and she requests the names of everyone who has access to the underground parking structure where the truck was stolen from.

Elijah confronts Nina outside of the bar where she works. She denies racking up the charges on his debit card, despite the fact that some of them were oddly specific to her tastes. Nina also points out that she returned the card, something she wouldn't do if he was guilty. Since there's no evidence that she made the purchases, Elijah has to let her go.

Russell shows Avery that they can identify someone based on the vein pattern in their hands, which he says is even more reliable than a fingerprint. Robin Hood's hand is clearly visible in the surveillance photo of the armored truck, so the vein pattern is compared to everyone at the bank who had access to the armored trucks. The matching vein pattern is found and cross-referenced with employees who swiped their ID card on the day in question. This provides the team with a badge number and leads them to AJ Kim. When arrested, AJ waives his right to remain silent, confesses to the bank hack, and says he's willing to go down for his cause.

AJ explains that he's been a teller at Barnaby Bank for five years. He claims that in the last year, the bank made $7 billion on overdraft fees alone, which negatively affected those customers who could barely live paycheck to paycheck. Avery informs him that while the bank's actions are reprehensible, his actions led to one person getting shot to death and another getting stabbed. AJ says that his guilt over this is why he sent the surveillance photo of the shooter. He adds that he reporting the overdraft scam to his boss went nowhere, so he took matters into his own hands to give the poor a voice. AJ believes that he's started a movement and will be seen as a martyr; however, Avery vows to keep his name and picture out of the press so nobody learns of his association with the hack. Elijah soon gets an alert that he received a $100,000 wire transfer into his Barnaby Bank account. AJ swears that he's working alone, so someone else is responsible for this.

Elijah isn't the only recipient of the windfall, as $100,000 is transferred to every Barnaby Bank customer in the D.C. area—over 300,000 people. AJ is ruled out as the person responsible, and Russell soon discovers that the money was funneled through a vulnerability in the system that Raven had apparently patched. However, according to the bank's network, the patch is no longer there. Furthermore, Raven's phone has inexplicably been off of the FBI network for over a day.

When confronted, Raven swears that she has nothing to hide. Nelson is able to back her up, showing Avery that the patch Raven applied was deleted from the bank's network just an hour later. The patch was so sophisticated that it would take years for another hacker to find it, but Raven realizes that the hacker knew exactly what to look for. She identifies the other hacker as her ex-boyfriend Jackson Richmond, who she bumped into on the street the day before. The thought is that Jackson hacked her phone during their chance meeting and has been keeping tabs on her since; the bank exploit was a bonus. Since he would be caught if he only wired money to himself, he wired it to 300,000 people to take the suspicion off of him.

Raven's phone logs show that she accessed her virtual voice assistant, something she says she didn't do. The timestamp lines up with when she bumped into Jackson. While Jackson never had physical access to the phone, Nelson figures out that he hacked into it by using Raven's headphones as an antenna. All he had to do was be within six feet of where Raven was. He then used his laptop to silently trigger the voice commands on Raven's phone. The voice command was used to launch a website that was already corrupted with his malware. However, Jackson slipped up, as he forgot to anonymize himself when he registered the website domain. This allows Nelson to identify the IP address for the device Jackson was using to do the spying. His current location is tracked to the FBI headquarters, where Raven is scheduled to be on trial for one of her pre-FBI exploits; Jackson is listed as a character witness.

Raven meets with Jackson, convincing him that she's been granted her freedom and no longer works for the FBI. After the two share a kiss, he happily tells her that he's responsible for the Barnaby Bank hack. He admits that he funneled the money through a bunch of dummy accounts and believes they can move out of the country and continue living their past lives—just $5 million richer. Avery, Elijah, and Nelson have been listening in on the conversation, and Elijah arrests Jackson for cyber bank fraud. Raven privately tells Nelson that Jackson is part of her past and that she wants something different for her future.

Raven meets with the judge and has only good things to say about Avery and her time with the Cyber division. Much to her surprise, however, Avery cites recent events and recommends that Raven continue working with the FBI. Avery later tells Raven that she withheld information; if the team knew about her meeting with Jackson, they may have been able to prevent a lot of what happened with the bank hack. She adds that while she trusts Raven, she doesn't trust her judgment. An incensed Raven says that she put her ex-boyfriend behind bars, which she believes is an indication that she's put her hacker past behind her. Avery later sits down with Russell, informing him of the judge's verdict—Raven has to serve the rest of her sentence with the FBI. She admits that answering the judge's question truthfully would've meant Raven's release; therefore, she chose not to answer the question at all. Avery believes that Raven isn't ready to leave just yet and hopes that, someday, she'll realize that Avery was just looking out for her.

Meanwhile, Elijah returns home from work and is surprised to find that his wife invited a guest over for dinner—Nina. It just so happens that the two women are in the same spin class. Nina mentions that Elijah had stopped at her bar and opened up about his personal life. As Devon and Elijah argue, Nina ejects herself from the conversation and leaves with an spiteful look on her face. With Nina gone, Elijah advises his wife to stop hanging out with her, adding that Nina is the one who stole their debit card and accrued the fraudulent charges. Devon, however, is incensed that Elijah spilled his guts to a stranger and accuses him of having an affair.

Cast

Main Cast

• Patricia Arquette as Avery Ryan
• James Van Der Beek as Elijah Mundo
• Charley Koontz as Daniel Krumitz
• Shad Moss as Brody Nelson
• Hayley Kiyoko as Raven Ramirez
• Ted Danson as D.B. Russell

Guest Cast

• Molly Burnett as Nina Moore
• Yani Gellman as Jackson Richmond
• Alexie Gilmore as Devon Atwood
• Derek Mio as AJ Kim
• Carlson Young as Mia Wilcox
• Michael Cline as CEO Ashton Wagner
• Anderson Davis as Agent Davison
• Jake Delaney as Andy Wilcox
• Stephanie Michels as Judge Terris

Music

• Million Bucks by Maino (ft. Swizz Beatz)

See Also

• List of CSI: Cyber episodes
• CSI:Cyber Season 2
• Category:Images from Shades of Grey