Thieves use victims’ SIM cards to hack into online banking

Boston-based Web security firm Trusteer has uncovered a new scheme to raid online bank accounts.

Trusteer, whose clients includeING Direct, CIBC and other globalfinancial giants, previously deciphered attacks in which criminalsactually changed victims’ mobile phone numbers to redirectone-time-password (OTP) authorization systems used by banks to theirown cell phones.

In the newly discovered method, the bad guys steal the mobile deviceSIM (subscriber identity module) card, thereby using it to bypass bandauthentication mechanisms.

Here’s an example of how it works: thieves use the Gozi Trojan to stealIMEI (international mobile equipment identity) numbers from bankaccount holders when they log in to their online banking application.The bank uses an OTP system to authorize big financial transactions.When they’ve got the IMEI number, the criminals contact the victim’swireless provider, report themobile device as lost or stolen, and askfor a new SIM card.

Once the thieves have obtained the new SIM card, all OTP’s intended forthe victim’s phone are sent to the device owned by the criminalinstead.
Trusteer will post a second example of how this fraud can be achieved,plus images to go along with it, on itsblog Tuesday.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

Get ITBusiness Delivered

Our experienced team of journalists brings you engaging content targeted to IT professionals and line-of-business executives delivered directly to your inbox.