Attackers have found a way to use the active collection of biometric data from citizens for their own purposes. Kommersant writes about this with reference to the episodes of fraud recorded in the SDM Bank.
How does biometrics help scammers?
Attackers use the reception of biometric data conducted by the Central Bank to achieve their goals. Due to the fact that many bank customers are aware of the collection of biometrics, fraudsters, disguised as representatives of financial institutions, can obtain the information they need to steal funds. The scheme looks like this:
- The fraudster makes a call to the victim by changing the phone number to the one belonging to the bank.
- In the future, the attacker explains that at the moment it is possible to submit biometric data (voice) remotely - during a telephone conversation.
- After that, the victim is asked to name 3 digits on the back of the card, as well as to dictate the code that comes to her in an SMS message (to approve the transfer of funds).
In order to create more credibility, the e-mail of the bank customer can also be used.
The information obtained in this way is sufficient to steal funds from the victim's account. At the same time, fraudsters in their work often copy the manner of communication of bank operators, which allows them to quickly gain confidence. In the background, in order to create a reliable environment, the typical "noise" of the call center can be turned on. To make the process look more realistic, victims are asked to clearly articulate the numbers, ostensibly for better recording quality.
Promotional video:
How do scammers use the received data to steal funds?
To quickly use the data received from the victim, the attackers can work together: the first receives information, the second simultaneously talks with a real bank operator, using numbers to carry out operations.
At the same time, cybercriminals often inform the client of the bank that in the near future fraudsters may allow him with a warning about the danger of the operation he is performing (fraudsters mean bank employees who have recorded suspicious actions thanks to the anti-fraud system).
The fight against fraudsters is complicated by the fact that not all clients of financial institutions know that a phone number can be spoofed.
Experts believe that in this type of fraud, an important role was played by the dissemination of information that bank customers in offices are asked to dictate certain numbers in order to submit biometrics. When communicating with cybercriminals, most of the victims did not attach importance to the fact that the transfer of information from an SMS message could turn into money theft.
Forewarned - armed
The first cases of fraud with "collection of biometrics" were recorded at SDM Bank. Despite this, representatives of a financial institution are confident that a client of any credit institution can become a victim of malefactors.
According to experts, banks should warn their customers about the schemes developed by fraudsters. For this purpose, it is recommended to make SMS-mailings and notify users on the websites of financial institutions.
In order to enhance the level of security, customers are also advised to notify banks about fraudulent attempts, as in this case the company can take appropriate action immediately. At the same time, it is noted that attackers can also use instant messengers.
In particular, the speed of response depends on the interaction of banks with mobile operators. The latter should contribute to blocking channels that were used by fraudsters.
Evgeniya Likhodey
