- Joined
- May 15, 2016
- Messages
- 14,571
- Likes
- 2,645
- Points
- 1,730
The bank disclosed this data through the voice menu.
The Central Bank warned banks about a scheme that allowed attackers to obtain additional information about clients of one of the credit institutions and subsequently use them for fraud using social engineering methods, RBC reports .
The cybercriminals turned from spoofed customer numbers to the interactive voice menu system when calling the bank, wrote the Center for Monitoring and Response to Computer Attacks in the Credit and Financial Sphere (FinCERT) of the Bank of Russia in a letter to credit institutions. banking market.
The scheme used allowed fraudsters to find out information about the account balances of their potential victims. Later, this data was used in fraudulent calls to customers in order to steal money from bank cards, follows from the letter.
As the representative of the Central Bank explained, such fraud became possible due to the fact that one of the banks did not comply with the recommendations for countering mobile fraud and protecting customers from unauthorized access to their confidential information through IVR (interactive voice menu system), which were given in 2019 ...
The Central Bank investigated the incident after one of the banks reported a sharp increase in the number of calls to its customers from fraudsters who knew about the balances of funds in the accounts, follows from the letter. As a result, the following was found:
The Central Bank warned banks about a scheme that allowed attackers to obtain additional information about clients of one of the credit institutions and subsequently use them for fraud using social engineering methods, RBC reports .
The cybercriminals turned from spoofed customer numbers to the interactive voice menu system when calling the bank, wrote the Center for Monitoring and Response to Computer Attacks in the Credit and Financial Sphere (FinCERT) of the Bank of Russia in a letter to credit institutions. banking market.
The scheme used allowed fraudsters to find out information about the account balances of their potential victims. Later, this data was used in fraudulent calls to customers in order to steal money from bank cards, follows from the letter.
As the representative of the Central Bank explained, such fraud became possible due to the fact that one of the banks did not comply with the recommendations for countering mobile fraud and protecting customers from unauthorized access to their confidential information through IVR (interactive voice menu system), which were given in 2019 ...
The Central Bank investigated the incident after one of the banks reported a sharp increase in the number of calls to its customers from fraudsters who knew about the balances of funds in the accounts, follows from the letter. As a result, the following was found:
- The scammers made phone calls to the IVR (interactive voice menu) system, spoofing the customers' phone numbers. When they called from the client's number, they asked the system for information on the balances of funds on the clients' cards, entering the last four digits of the numbers of these bank cards.
- After that, the scammers, using social engineering methods (psychological methods aimed at deceiving customers), called their victims, posing as bank employees. As the letter says, “to overcome the barrier of mistrust and successfully apply other methods of social engineering,” they used information on cash balances.
- The clients' phone numbers and the numbers of their bank cards were compromised and circulated on the Internet. The source of this data has not been unequivocally established, however, according to the Central Bank, the fraudsters could have obtained it from the client base of the Joom marketplace, which was previously in the public domain, follows from the letter.