The cyber crime problem
As more consumers use the Internet to complete financial transactions, the threat of various forms of cyber crime is likewise increasing. Those forms include identity theft, bank account hijacks, ATM skimming, POS data thefts, and credit/debit card account theft. Victims of financial cyber crime are often financially wiped out and in the US alone, cyber crime is estimated to cost the economy billions of dollars annually.
Here are three of the most common ways that cyber criminals steal money from unsuspecting victims in the online or mobile environments:
- Cell phones & tweets – mobile banking, primarily from use of mobile phones, provides ample opportunity for cyber criminals to commit fraud. The most common way is by use of what’s called man-in-the-middle attacks against mobile phones using a variation of ZeuS malware. The malware is installed on the phone through a link imbedded in a malicious text message, and then the user is instructed to enter their complete mobile information. Because financial institutions sometimes use text messaging to verify that online transactions are initiated by a legitimate user, the infected mobile phones forward messages to the criminal, thwarting the bank’s two-factor authentication. Cyber criminals also use iPhone applications by sending malicious links to a website containing a new banking Trojan. Once installed, the Trojan disables Windows Task Manager and notifications from Windows Security Center to avoid detection. When the victim opens their online banking account or makes a credit card purchase, personal information is sent to the criminal in an encrypted file. The cyber criminal then completes a number of wire transfers, stealing the victim’s money;
- Bank account hijacking -under this method, an employee who usually manages the bank accounts of a company is targeted with a phishing email that contains an infected file or a link to an infected website. Once the employee opens the attachment or navigates to the website, malware is installed on the employee’s computer which includes a key logging program that retrieves the company’s online banking information. The cyber criminal then uses the company information to transfer funds to his or her bank account (often located overseas). The FBI has reported several cases of this form of bank account hijacking, including the loss by a school in New York of $3 million; and
- Point-of-Sale (POS) and ATM skimming – here, cyber criminals use skimming devices that are either attached to an ATM or POS machine, or are operated wirelessly using blue tooth devices. The skimmers are used to collect card numbers and PIN codes from victims. The data is then sold to third parties over the Internet and often used to make fake credit or debit cards overseas. The fake cards are then used to make fraudulent purchases or withdraw funds. In the latest reiteration of this type of fraud, credit and debit card information from customers at gas station pumps were recently stolen wirelessly with the use of skimmers that were attached to the inside of gas pumps. In the POS environment, restaurants are often targeted by criminals who use wireless programs to “sniff’ financial transactional details during live POS payment transactions. They then use the POS information to create duplicate credit or debit cards from which they transfer funds.
Protecting yourself
According to a study conducted by Symantec, 32% of mobile phone users use their phone to access the Internet and over 5% of them have already been the victim of some form of cyber crime. Surprisingly, 70% of mobile phone users do not password-protect their devices and only 46% download applications from sites they trust.