Criminal data trade

 

Image from Pixabay

I can't stand injustice. That feeling is reinforced if financial gain is the motive for injustice, and if it deliberately affects people who are particularly vulnerable to it. Because I don’t work in law enforcement, my resources to do something about it are limited. At least my keyboard allows me to write on it, in the hope that it will save some people from harm.

Recently I heard the story of an elderly couple who had gone to the bank with their son to arrange a power of attorney. That took place in a building of concrete and steel, sitting opposite a bank employee. A day or so later, the old gentleman received a call from someone at the bank, and the call referred to his visit to the bank branch with his son. Something was wrong with their bank cards, someone from the bank would come and pick them up. They already had those people’s address, of course. “I should cut the passes, right?” “ No no, that would make them useless to the police. Just put them in an envelope from the bank. And give us the pin code so we can check it.”

Because the story seemed so plausible with all the information the criminals had, the man believed it and gave his PIN. But he did see a tiny red flag when he was told not to cut the passes. On a different phone he called his son, who was supposedly talking to another bank employee. However, the son knew nothing about it, and also immediately realized that it was not right. He urged his father not to hand over the passes and to keep the door tightly closed. In addition, the police were called.

As mentioned, the son was called with another phone; the receiver of the first phone was still on the table, so the criminal probably overheard the other call. The police therefore found nothing suspicious in the neighborhood where these people live. They told the people that such criminals are usually close by when they call – then they can strike before the victim changes his mind. Because no actual transfer had taken place, the police were done. A few days later they called again, but that was by accident: they actually wanted to speak to other people, with whom the criminals had unfortunately succeeded.

Of course our near-victims had their cards blocked and replaced with new ones. Because else, imagine that they had been shoplifted in the supermarket the next day - the criminals could still have plundered their bank account, after all, they knew the PINs. Of course, the new cards also have new PINs (otherwise the same problem persists). It is also wise not to leave more money in your current account than is necessary to pay the bills and groceries for that month. Money that is in the savings account cannot be withdrawn from an ATM – not even by a bank card thief (disclaimer: that’s how it works in the Netherlands; I don’t know if this is true elsewhere in the world). Unfortunately, for many elderly people who do not have a computer or smartphone, this is easier said than done: we youngsters easily drag money from our current account to the corresponding savings account and back. It was therefore a sensible choice of the above elderly people to enlist their son for their banking concerns.

Information is worth a lot of money. If you know that someone has been to a certain place at a certain time, and you know where to sell that kind of information, it can make you some nice pocket money. You just have to be in a place where you can access the requested information. Or… you make sure that you end up in such a place yourself. Or even better: a criminal organization places you as a pawn in an organization. That's called infiltration. The more valuable the information, the more attractive it is to have a chap in the right places. They are even largely self-sufficient - after all, they earn a salary. I hope that the bank from this story will be able to expose the mole.

The more convincing a lie is, and the more pieces of the puzzle fit together, the sooner we fall for it. I'm gullible by nature (because I want to be positive so badly), but professionally I'm suspicious. This creates some interesting – and sometimes annoying – tension. I must maintain my suspicion active without losing my faith in the good. You can help me with that by sharing stories like the above with people in your area, especially with those who are vulnerable. Let them learn from other people's experiences and thus considerably narrow the playing field of the criminals. Whether you tell the story yourself or send a link to this blog, I don't really care. But please do share.

There will be no Security (b)log next week.

 

And in the big bad world…

• you need to adjust your 2FA for Twitter before March 20th.
• the NSA offers advice for securing home networks.
• European civil servants are also no longer allowed to use tiktok .
• researchers warn of a whole new class of vulnerabilities in Apple gear.
• Amsterdam police have arrested three young ransomware criminals.
• one of the arrested men was active for DIVD, a renowned security organization.
• SMEs receive help in choosing ICT suppliers.
• far-reaching European legislation for IoT devices is being prepared.