Brian Krebs of the Washington Post stated the Financial Services Information Sharing and Analysis Center had indicated Eastern European cyber gangs are stealing millions from small to medium businesses through online banking fraud. Unfortunately, many of the victims fail to report the crime out of fear that they won't be able to recover losses from their bank. The victims suffered from malicious software being planted on company owned Microsoft Windows PCs, which allowed fraudsters to obtain sensitive online bank information. The fraudsters then wire money to accomplices in the United States who then wire the money to the fraudsters overseas. The fraudsters’ use of the ACH network has become of critical concern because of the lack of controls it employs. For example, if I conduct a large fraudulent transaction with a credit card then a red flag will pop up, but if I did the same transaction with an ACH payment it would go undetected.
In a dramatic example, Dwelling House Savings and Loan Association failed after cyberthieves siphoned off $3 million in an ACH scam.
Showing posts with label cybercriminals. Show all posts
Showing posts with label cybercriminals. Show all posts
Wednesday, September 23, 2009
Friday, June 12, 2009
Finding Real Value in a Stolen Card
Criminals are obtaining more tools to sort through the massive amount of card data to determine which cards are good and bad. Several commercial sites have sprung up that offer services to cybercriminals to check balances and limits on cards. They even offer volume discount! It’s estimated by experts that about 25,000 debit and credit cards are checked daily. These sites provide valuable information to the crooks and the only obstacles are the ability to read Russian and pay with virtual currencies, such as Webmoney.
How can they do this?
Well, many of these sites are able to hack the credit card payment networks to conduct “pre-authorization requests”. As you know the preauth places a temporary hold on the account, to make sure there is enough money to pay the bill. This happens all the time from restaurants to hotels. The cybercriminal have no intent on settling the transaction, they just want to see how much money is available on the card.
The cybercriminals also have designed their sites to check the cards using legitimate high jacked merchant account numbers and using unrelated merchant names. There have been incidents where merchants have complained to state governments about customers calling saying, “I didn’t buy that! Why are you charging me?” However, the state has been unable to do anything because the merchants have not experienced any financial loss. The accounts are changed frequently and the criminals bank on companies using different financial processing systems that don’t share data.
How can they do this?
Well, many of these sites are able to hack the credit card payment networks to conduct “pre-authorization requests”. As you know the preauth places a temporary hold on the account, to make sure there is enough money to pay the bill. This happens all the time from restaurants to hotels. The cybercriminal have no intent on settling the transaction, they just want to see how much money is available on the card.
The cybercriminals also have designed their sites to check the cards using legitimate high jacked merchant account numbers and using unrelated merchant names. There have been incidents where merchants have complained to state governments about customers calling saying, “I didn’t buy that! Why are you charging me?” However, the state has been unable to do anything because the merchants have not experienced any financial loss. The accounts are changed frequently and the criminals bank on companies using different financial processing systems that don’t share data.
Subscribe to:
Posts (Atom)
