Fraud - How does this work? Insider workings?

[Shake&Bake]

That's the part I don't get though, how did they do R16k if the daily limit is R5k? Sounds like they took all the money in one day.

I'd hazard a guess.

Reading this:

Capitec Bank client payments up to R5 000

Makes me wonder if that is per client or an amount in total.
It lends itself to be interpreted as being "per client" to me.

Thinking of it like that, then they could've moved the money to 4 accounts in 3 batches of R5k and then the balance to another account.

 

[KalMaverick]

Makes 100% sense then if it's per client, per day, and not just per day in total.

 

[HavocXphere]

Limits are usually per day. Having it per recipient would make little sense. Not sure what they mean by "client" though.

 

[KalMaverick]

Limits are usually per day. Having it per recipient would make little sense. Not sure what they mean by "client" though.

You can only transfer to Capitec clients from mobile banking.

 

[Shake&Bake]

@OP in hindsight - you didn't articulate the story very well either

 

[HavocXphere]

You can only transfer to Capitec clients from mobile banking.

huh? I hope "mobile banking" includes online via PCs...not just mobile.

 

[NeonNinja]

Aah, okay thanks guys. Clear now.

 

[Shake&Bake]

huh? I hope "mobile banking" includes online via PCs...not just mobile.

Phone only for Mobile banking.

The only transfer that can be done via mobile banking, is to another Capitec client, to a mobile number that is verified on Capitec's systems.
No other transfers can be made to other banks via MB afaik.

 

[R13...]

If they got 2 digits from him - they could likely then brute force the rest of it.

How do you brute force a bank pin? It only gives you 3 attempts

 

[KalMaverick]

huh? I hope "mobile banking" includes online via PCs...not just mobile.

With Capitec you get two options besides normal banking:

Mobile banking = Cellphone banking

In other words you dial a number on your phone and it brings up a menu and you can do certain things through the menu. One of those is buying airtime and paying Capitec clients.

Internet banking

In other words you log in through Capitec's online banking website and do whatever, you can of course do more with internet banking than with mobile/cellphone banking but of course you need either authenticator app on your phone or a physical authenticator.

 

[KalMaverick]

How do you brute force a bank pin? It only gives you 3 attempts

Capitec has a bank PIN (for use with ATMs and in the bank) and a mobile banking PIN (just for mobile banking). These are two separate PINs but I guess a lot of people use the same PIN for both.

Most likely (not sure though) the mobile banking PIN does not have a limit on attempts (or they got lucky and using the person's DOB worked).

EDIT: Anyone brave soul willing to test it for interest's sake?

 

[MKFrost]

EDIT: Anyone brave soul willing to test it for interest's sake?

Just tried it. Blocked my access after the fifth wrong attempt. Also received an SMS afterwards with message: "Your Mobile Banking Pin was suspended. Visit your nearest branch to reset."

 

[R13...]

Just tried it. Blocked my access after the fifth wrong attempt. Also received an SMS afterwards with message: "Your Mobile Banking Pin was suspended. Visit your nearest branch to reset."

5 times is too much time really lax security there Capitec

 

[KalMaverick]

Just tried it. Blocked my access after the fifth wrong attempt. Also received an SMS afterwards with message: "Your Mobile Banking Pin was suspended. Visit your nearest branch to reset."

Thanks! Sorry it got blocked though.

The only thing I can think of then is they guessed his PIN started with 19.

 

[Shake&Bake]

Thanks! Sorry it got blocked though.

The only thing I can think of then is they guessed his PIN started with 19.

Its a possiblity ey..

Thanks for the research MK

 

[R13...]

Its a possiblity ey..

Thanks for the research MK

Yeah if he used his birth date or numbers from his ID it would be an easy guess given two digits.

 

[MKFrost]

Internet banking still works fine so happy with this. Mobile banking [which I do not use] now blocked.

 

[KalMaverick]

Internet banking still works fine so happy with this. Mobile banking [which I do not use] now blocked.

Well at least no-one will be able to steal money via your mobile banking now.