An unprecedented wave of online bank fraud is hitting Britain • Hacker News Board

Re: An unprecedented wave of online bank fraud is hitting Britain

#171

Post by denton-scratch » Thu, Oct 14, 2021, 5:19 PM UTC

swutas wrote: post #153

mysterypie wrote: post #68

What's always missing from stories like this is how the crooks get the money out. Considering that all Western governments have achieved total surveillance on our banking and made it impossible to have anonymous bank accounts, I'd like to see a detailed analysis about why they can't follow the money and see who gets it. Every scenario I can think of seems like it should be either traceable or actionable. Scenario 1:…

It's well documented that a lot of this money goes out of the country by transferring it to a 'mule' with a bank account in the UK, who think they are doing something innocuous. They transfer it to the scammers either via cryptocurrency (basically untraceable) or previously, via an international money transfer service such as Western Union. The latter is also pretty much untraceable. You can pick up money anywhere in…

> doing something innocuous. They transfer it to the scammers either via cryptocurrency

Whoah. Do you mean there are people that think cryptocurrency is "inoccuous"? I mean, I know there are inoccuous uses; but if someone "official" tells you to use a cryptocurrency account, that is very definitely occuous.

Re: An unprecedented wave of online bank fraud is hitting Britain

#172

Post by burnished » Thu, Oct 14, 2021, 5:19 PM UTC

BiteCode_dev wrote: post #60

ajsnigrutin wrote: post #58

Earlier quoted context omitted.

Bank phone numbers should be written on the back of credit/debit cards (and in a lot of countries, they are). "A fraudulent transaction has been detected on your credit card no. *1234, please call the number written on the back of your card", and you're done.

Unless the fraudulent transaction is due to the fact you just lost your credit card.

The important part is that you are able to look up/personally verify that you are contacting the correct people. If I lose my card I can still look up the right number on my banks website. Because you cannot confidently identify a caller it is better for the customer to reach out using more easily verified information.

Re: An unprecedented wave of online bank fraud is hitting Britain

#173

Post by bluGill » Thu, Oct 14, 2021, 5:24 PM UTC

Mountain_Skies wrote: post #164

easton wrote: post #117

Earlier quoted context omitted.

Not all US credit card companies are like this. I specifically remember a few years ago that my Mom got a call from AMEX about some fraud on her card, to which she responded “I never get calls from you, how do I know this is real?”. They said no problem, just hang up and call the number on the back of your card. I believe some banks even skip the call entirely, and just prompt you to call the number on the card.

A weird one that happened to me a few years ago was when I ordered about $100 worth of products from banggood, my phone rang within seconds of the purchase going through. The display on my phone showed it to be a bank I never heard of. When I did a search, it turned out to be a small bank with about a dozen branches in a state hundreds of miles away. The voicemail however was from my bank's fraud department informing…

Most banks don't do their own everything. A few seemingly little banks (often in the middle of nowhere) take on different tasks. It could well be that when you called "your bank" the other bank was originating the call and the person at your bank didn't know how the backend was really wired.

Re: An unprecedented wave of online bank fraud is hitting Britain

#174

Post by MichaelZuo » Thu, Oct 14, 2021, 5:28 PM UTC

lazide wrote: post #163

mnw21cam wrote: post #148

Earlier quoted context omitted.

Well, the point isn't that my bank wouldn't "leak" my details - I certainly don't trust them that far. So it's absolutely possible for a random person to get my phone number from the bank. But if a random person were to phone me and tell me that my bank gave them my phone number to be helpful, I'd be calling that out as a lie.

If someone spoofs the banks number on caller ID (trivial), knows all your security question answers, the bank you bank with, and your number - very few people are NOT going to fall for some kind of attack there correct?

How could they figure out the internal account number without hacking into the bank in the first place? I’m fairly certain there’s no way to derive the account number from a debit card number or any of the info you mentioned.

Re: An unprecedented wave of online bank fraud is hitting Britain

#175

Post by denton-scratch » Thu, Oct 14, 2021, 5:29 PM UTC

robotmay wrote: post #23

dazc wrote: post #18

Earlier quoted context omitted.

'Maybe our curious mix of laziness, stupidity, superiority complex, and greed combine to make us the perfect targets.' Or, maybe, our good manners?

Hah yes I was trying to think of a way of describing that - our inability to be rude to people, or speak up about something that seems wrong. That should certainly be added to the list.

> our inability to be rude to people

I don't seem to find that hard at all. And I meet many strangers that are rude (not all of them foreigners).

It's true that brits hate complaining in restaurants. I don't think I've ever complained in a restaurant, despite my innate rudeness. But I find it very hard to keep my cool, when I've just listened to 30 minutes of hold music, and the person that picks up is an unhelpful numpty.

Re: An unprecedented wave of online bank fraud is hitting Britain

#176

Post by MichaelZuo » Thu, Oct 14, 2021, 5:35 PM UTC

robinson-wall wrote: post #134

q1w2 wrote: post #128

Earlier quoted context omitted.

Acting as a mule for money laundering is a crime. They are criminals. They might be young, but the majority of them know they are doing something wrong.

I'm not suggesting they aren't criminals. But there is a spectrum of criminality and I am suggesting they are considerably less so than the leaders of the fraud ring. These ads are deliberately designed to prey on the desperate, unfortunate or the technically illiterate. Some of them probably know exactly what they're doing and I have no sympathy, but some of them probably fall into the same category as people fallin…

Isn’t that true for all types of crime?

In the worst cases the accepted practice can be as severe as locking them up and throw the key away, even if it was totally unintentional.

Like a drunk driver plowing into a group of school children, or a ship captain that sinks a cruise ship while distracted.

Having extra scrutiny imposed on future banking activity is a minor punishment for a minor crime.

Re: An unprecedented wave of online bank fraud is hitting Britain

#177

Post by denton-scratch » Thu, Oct 14, 2021, 5:37 PM UTC

dboreham wrote: post #89

mdp2021 wrote: post #65

Earlier quoted context omitted.

You do not use caller number review websites? In some cultures, most callers (private individuals) would not start speaking themselves before hearing a sign of presence from the other side: you filter out auto-diallers, but also contacts you did not have in your address book.

In the US the criminals forge the ANI so it looks like a legit number, e.g a local business. We just never answer the phone. Real people can leave voice-mail.

I'm familiar with this custom. Unfortunately, I've adopted the habit of not leaving voicemail (if I'm determined, I talk gibberish until the callee picks up).

And I haven't listened to recorded VMs for years. Way back when, I actually bought a machine for answering phone-calls. I have no idea what I was thinking :-)

Re: An unprecedented wave of online bank fraud is hitting Britain

#178

Post by denton-scratch » Thu, Oct 14, 2021, 5:45 PM UTC

rsync wrote: post #154

When I make a mortgage payment at usbank, I am redirected through two additional third party domains that have no obvious connection to either usbank or banking in general. They are training their users to get phished.

Oh, Mastercard and Visa do this systematically. You get redirected to a site whose name I can't remember, that has no apparent relationship with either Visa or Mastercard, that asks you to input some piece of personal info.

I've sometimes aborted purchase transactions with significant value on being confronted by that challenge.

It's a bit like handing your card to a teller, inputting your pin, and then the teller passing you on to some rando asking personal questions.

Re: An unprecedented wave of online bank fraud is hitting Britain

#179

Post by denton-scratch » Thu, Oct 14, 2021, 5:47 PM UTC

happyflower wrote: post #33

Why can a 78-year old widow's life savings be managed through an online bank system? Bring back local branch offices where people have to manage their high-risk accounts in-person.

Sure; and bring back bank charges for in-credit accounts.

Re: An unprecedented wave of online bank fraud is hitting Britain

#180

Post by mvc » Thu, Oct 14, 2021, 5:51 PM UTC

avianlyric wrote: post #51

Nextgrid wrote: post #21

Earlier quoted context omitted.

> Maybe all payments take 2 weeks to settle I'm not sure how that would help with regards to APP fraud. APP fraud is possible because scammers are successfully able to social-engineer people into sending their money away despite the various warnings (including on the payments UI in bank apps, or - in the US where this scam uses gift cards - to not tell the cashier or the bank what you're buying the gift cards for). I…

> I would expect the same social-engineering to be able to convince the user to not raise the alarm during the 2 week cooldown period. It would be interesting to test this. Having read through a number of APP fraud cases, including victim statements. One persistent theme is that the pressure cooker environment that scammers create to get victims to send money is very effective as getting them to ignore warning signs.…

Haha I wonder if you've read my case. I was scammed out of 100k this year.

The scammer had control of my solicitor's email and timed the attack perfectly so I was absolutely convinced I was sending money to the right place.

Didn't realize until a few days later when the solicitor called me wondering where the money was. The two week thing might have helped us but the scammer would probably just time their attack differently. Although it would increase the time they have to keep the fish on a hook.