{"id":473611,"date":"2022-12-11T14:59:31","date_gmt":"2022-12-11T12:59:31","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=473611"},"modified":"2022-12-11T15:00:44","modified_gmt":"2022-12-11T13:00:44","slug":"postbank-security-crisis-over-r150-million-stolen","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/technology\/473611-postbank-security-crisis-over-r150-million-stolen.html","title":{"rendered":"Postbank security crisis \u2014 over R150 million stolen"},"content":{"rendered":"

Postbank insiders have helped criminal syndicates steal over R150 million that should have gone towards helping South Africa\u2019s poorest families, Sunday Times reports<\/a><\/strong>.<\/p>\n

The report comes after the poorly-secured state-owned financial institution blocked grant recipients from making ATM withdrawals using their South African Social Security Agency (Sassa) cards.<\/p>\n

It halted withdrawals after R18 million was stolen<\/a><\/strong> from the Postbank.<\/p>\n

The report revealed that several severe operational security flaws at the Postbank are allowing fraudsters to rob it blind.<\/p>\n

Highly sensitive systems, including Postbank\u2019s integrated grant payment system, are being accessed using a single set of credentials.<\/p>\n

Up to 40 employees, ranging from junior to senior staff, have this key.<\/p>\n

Even when fraud is discovered, it is difficult to trace the transactions to a particular staff member.<\/p>\n

Those with the credential can also delete transaction logs, making it difficult to detect fraud in the first place.<\/p>\n

Citing insider accounts, the Sunday Times also reported that the Postbank has been operating the grant payment system without activating a feature designed to detect anomalies and alert the institution to possible fraud.<\/p>\n

Postbank interim CEO Lucas Ndala told the newspaper all indications point to an inside job.<\/p>\n

He said they\u2019ve seen disturbances like this every month since taking over Sassa grant payments from the Post Office.<\/p>\n

\u201cIt points to a concerted effort of sabotage against the bank,\u201d stated Ndala.<\/p>\n

Ndala confirmed that several people were placed on suspension as a precaution.<\/p>\n

\"\"<\/a>

Lucas Ndala, Postbank interim CEO<\/p><\/div>\n

This is not the first time the Sunday Times exposed extremely poor operational security at the bank.<\/p>\n

In 2020, it reported that Postbank\u2019s \u201cmaster key\u201d was stored in plaintext<\/strong><\/a> during a data centre migration in July 2018.<\/p>\n

Two staff members stored the key in plaintext on USB flash drives, and one of the drives couldn\u2019t be located.<\/p>\n

The 36-digit master key reportedly lets anyone read and write account balances, and read and alter information on any of the cards the bank has issued.<\/p>\n

Following the potential master key exposure, criminals siphoned around R56 million in 25,000 fraudulent transactions from Postbank accounts between March 2018 and December 2019.<\/p>\n

The Post Office initially denied that its master key for Postbank\u2019s cards was compromised, saying that the \u201cstories\u201d were unfounded and only sought to create panic among Postbank\u2019s clients.<\/p>\n

However, in January 2021, social development minister Lindiwe Zulu told Parliament<\/a><\/strong> that government was in talks to replace all Sassa cards following the security breach.<\/p>\n

Reports of all Sassa cards being replaced have led to widespread misinformation claiming the cards have expired.<\/p>\n

The Postbank has once again emphasised that its Sassa gold cards remain valid.<\/p>\n

Postbank\u2019s stolen millions \u2014 at least R175 million stolen since 2012<\/h2>\n

In March, the amaBhunghane Centre for Investigative Journalism reported that between 16 and 28 October 2021, criminals helped themselves to at least R89,459,330 in cash<\/strong><\/a> stolen from the Postbank.<\/p>\n

The perpetrators fraudulently transferred the money to 279 Sassa accounts, which they withdrew at ATMs using cloned cards.<\/p>\n

In 2020, Zulu revealed that over 1,700 Post Office workers<\/strong><\/a> received social grants for which they did not qualify.<\/p>\n

That resulted in Sassa bleeding around R1.5 million a month.<\/p>\n

The Post Office had also been targeted in several robberies, which saw Sassa cards and computers stolen.<\/p>\n

In 2012, a syndicate stole R42 million from Postbank<\/strong><\/a> in a heist between 1 and 3 January.<\/p>\n

The criminals had opened several Postbank accounts towards the end of 2011, and, over New Year\u2019s, they gained access to a Rustenburg Post Office employee\u2019s computer.<\/p>\n

From there, the syndicate made deposits from other accounts into its own.<\/p>\n

Over the next three days, they used ATMs in Gauteng, Free State and KwaZulu-Natal to withdraw cash from the accounts.<\/p>\n

Sunday Times reported that this type of attack had reared its ugly head again.<\/p>\n

In one incident, criminals deposited R13.3 million into a Postbank account in 13 transactions and withdrew R9 million between 29 and 31 October 2022.<\/p>\n

Another case saw R21 million of Sassa funds deposited into a fraudulently created account, of which R16 million was withdrawn.<\/p>\n

This recent fraud was reportedly perpetrated after hours, on Saturdays, when the branches are closed.<\/p>\n

Criminals apparently got into the Postbank\u2019s system and client database remotely, using credentials belonging to bank tellers.<\/p>\n

As a result, Postbank is considering halting all weekend and after-hours transactions for the time being.<\/p>\n

\n

Now read: Postbank SASSA gold card has not expired<\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"

Insiders have aided syndicates in stealing millions from South Africa\u2019s poorest.<\/p>\n","protected":false},"author":15,"featured_media":413640,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[35,3888,70103],"class_list":["post-473611","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-headline","tag-postbank","tag-south-african-social-security-agency-sassa"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/473611"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=473611"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/473611\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/413640"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=473611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=473611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=473611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}