{"id":75807,"date":"2013-04-17T23:06:01","date_gmt":"2013-04-17T21:06:01","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=75807"},"modified":"2013-05-09T17:43:00","modified_gmt":"2013-05-09T15:43:00","slug":"how-scammers-hack-your-bank-account","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/75807-how-scammers-hack-your-bank-account.html","title":{"rendered":"How scammers hack your bank account"},"content":{"rendered":"

Gaining access to someone\u2019s online banking account often requires fairly directed attacks and a good deal of patience on the hacker\u2019s part.<\/p>\n

Adrian Vermooten<\/a>, head of digital channels and payments at Absa<\/a> Retail, explained that a cybercriminal usually gets a user\u2019s account number, PIN, and password through a phishing attack before moving on to getting access to their cellphone number.<\/p>\n

However, even these initial phishing attacks have become increasingly sophisticated, Vermooten said.<\/p>\n

While the typical scam e-mails that purport to be from the bank asking for your login credentials are still doing the rounds, Vermooten said that recently many people have been falling for an e-mail claiming to be from the South African Revenue Service (SARS<\/a>).<\/p>\n

The typical structure of this phishing scam is an e-mail claiming that SARS wants to pay out thousands of Rands to you after evaluating your tax return.<\/p>\n

You are told to click through to the SARS website and are then prompted at a very official looking page for your online banking details.<\/p>\n

\"Adrian

Adrian Vermooten<\/p><\/div>\n

\u201cHacking\u201d the cell networks<\/h3>\n

With your online banking account credentials in hand the hackers need to breach the next factor of authentication, for which most SA banks use SMS.<\/p>\n

If they didn\u2019t already get your cellphone number, Vermooten explained that scammers try to track down where you work, which could often be as easy as searching for you on Google.<\/p>\n

They then phone your workplace and try to social engineer your cellphone number out of whomever they speak to.<\/p>\n

After they get their hands on your number, the hackers find a way to hijack your number for a short while to intercept the random verification number sent out by the bank.<\/p>\n

Vermooten explained that while it is possible that the scammers get insiders at the networks to do this for them, it is also entirely possible that the employees of cellphone operators become victims of the hackers themselves.<\/p>\n

Without an insider at the mobile network, Vermooten explained, cybercriminals use other methods to try and hijack your number.<\/p>\n

One such trick is using the video camera on a smartphone to record the passwords employees type into the web-based admin software they use at many mobile networks.<\/p>\n

This is obviously not done overtly, Vermooten explained, with the hackers engaging employees in conversation while placing their phone down on the counter before asking for something that requires them to log in.<\/p>\n

Getting the money out<\/h3>\n

The next part of the attack is to transfer the money into an account that can\u2019t be traced back to the fraudsters.<\/p>\n

One way the scammers get their hands on one without trying to get around FICA, Vermooten said, is also through social engineering.<\/p>\n

They would tell a fellow traveller in a taxi a sob story about how they\u2019ve just got a job for the first time in months but that their employer insisted on paying their salary to a bank account, which they don\u2019t have.<\/p>\n

Offering the target account holder a nominal fee of R100 or so for their help, the scammer now has a completely legal bank account to transfer the money to, Vermooten explained.<\/p>\n

\"Gandalf:

Is it secret? Is it safe?<\/p><\/div>\n

Moving away from SMS<\/h3>\n

Scammers can take six months to get the necessary information together before executing the attack on your bank account, Vermooten said.<\/p>\n

\u201cRemember, this is their full-time job,\u201d Vermooten explained when asked what could be done to curb this kind of scamming.<\/p>\n

If the banks or cellular operators tighten security constraints in one place, the fraudsters will simply target something else, or switch banks.<\/p>\n

Despite this inevitability, Vermooten said that they are in discussion with the mobile networks, and are looking at ways to move away from SMS as the second factor of their authentication mechanism.<\/p>\n

Business customers at some of South Africa\u2019s banks have been using USB security dongles for some time. Capitec<\/a> has also issued consumer banking customers with stand-alone random number generators, or given them the option of a security app that is linked to their smartphone.<\/p>\n

The bottom-line for users at this stage is the same message the banks have been putting out for years, with renewed emphasis:<\/p>\n