Phishing and malware meet cheque fraud
Posted on 24 April 2012.
Bookmark and Share
Trusteer recently uncovered a scam in an underground forum that shows how data obtained through phishing and malware attacks can be used to make one of the oldest forms of fraud – cheque forging – even harder to prevent.

The scam involves a criminal selling pre-printed cheques linked to corporate bank accounts in the USA, UK and China.

The criminal is selling falsified bank cheques made with specialized printing equipment, ink and paper. For $5 each, he/she will supply cheques that use stolen credentials (e.g. bank account) provided by the buyer.

However, to purchase cheques that use stolen credentials supplied by the counterfeiter the cost is $50 – a tenfold increase. This is a clear indicator that stolen credentials are a key enabler of cheque fraud.

Cheque data fields include personal information (e.g. name, address and phone) and financial information (e.g. bank account, routing code and cheque number). To obtain all the required data fraudsters typically need to get their hands on a physical or scanned version of a real cheque in circulation.

Many banking web sites provide access to scanned versions of paid and received cheques. Online banking login credentials obtained through malware and phishing attacks can easily be used by fraudsters to access a victim’s account and collect all the required information to commit cheque fraud. In addition, before using the cheques, fraudsters could potentially ensure account balance is sufficient to approve the transaction.

The criminal recommends using the cheques to buy products in retail stores rather than trying to redeem them for cash. Buyers are also encouraged to carry fake identification cards that match the stolen credentials on the cheque. The cheque counterfeiter offers to provide these as well.

“This is the latest example of the how criminals can use malware and phishing techniques to make traditional physical fraud schemes more effective,” said Trusteer’s CTO Amit Klein.

“This “cross-channel” approach is helping fraudsters stay one step ahead of even the most sophisticated fraud detection systems deployed online and in the brick and mortar world. It is also creating a new generation of Frank Abagnale’s that are not even required to come up with their own fraud scams.”





Spotlight

Security pros and government failing to collaborate

Posted on 17 April 2014.  |  More effective collaboration between government and the information security industry is crucial to protecting organizations from future cyber threats. More work needs to be done to strengthen government’s position as a source of information on potential threats.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Apr 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //