In June 2019, hackers accessed approximately 98,000 PayID data after using multiple online bank accounts to conduct over 600,000 PayID lookups over the course of six weeks, allegedly by simply entering phone numbers in sequential order.
Although there are reports of a leaked memo pointing the finger at US-based fraudsters, it is unclear who was to blame.
The exact motivation is unknown, but in the underground economy, any personal information is valuable. In this scenario, the information may be used as part of a more sophisticated phishing scheme to steal additional information from account holders.
While this appears to be a very simple attack involving nothing more complex than trial and error, the PayID system appears to have missed a significant number of lookups – an average of 14,000 per account – or the pace at which they were carried out.
To offer an example, imagine going to your bank 14,000 times and each time handing over a new piece of identification.
This large number of searches may have raised serious security concerns. Although it’s understandable if legitimate users need a couple of tries to enter the correct number, no one should need thousands.
Adding lookup limits and identifying this as a highly abnormal activity should have been a simple security measure. However, neither the bank in question nor NPP Australia had put in place systems to detect or prevent this type of fraud.
After a security breach of this magnitude, banks are likely to take immediate action to prevent it from happening again. But two months later, it happened again.
A total of 92,000 PayIDs were exposed in August of this year. The violation was claimed to have occurred inside the networks of a financial institution linked to the NPP Australia systems in this case. Users’ full names, BSBs, and account numbers were allegedly exposed in this breach, which is concerning.
Customers were quickly reassured by banks that transactions could not be completed as a result of this. However, it provided cybercriminals with even more useful knowledge, allowing for more phishing opportunities.
Though impacted customers have been notified, the only way to eliminate the risk is to discontinue using PayID. This is easy to do, but it eliminates the comfort aspect for the majority of bank customers.
Read: Facebook Data Breach – What Happened And Why It’s Hard To Know If Your Data Was Leaked
What’s the real risk?
The risk can seem minor because the system allows transfers into accounts rather than allowing withdrawals from them. Many in the banking industry have dismissed it as such. However, there is a greater danger.
Phishing is a type of cybercrime in which victims are duped into divulging personal information through persuasive emails or SMS messages. Unfortunately, there have already been examples of this with PayID.
The method depicted above isn’t especially advanced. Consider a more personalized email message that includes examples of personally identifiable information (PayID, full name) or, as in the case of the most recent breach, BSB, and account number.
With the right branding and soothing words from your bank, an unsuspecting consumer could easily be persuaded to “log in to change your PayID for security reasons.” A few minutes of machine imagination will yield compelling results.
The picture below was generated to demonstrate how simple this process is. Although it has genuine branding, the “login” button could easily be set to redirect visitors to a website that steals login credentials.
With nearly half of households having at least A$10,000 in savings, cybercriminals have a strong incentive to target our bank accounts, according to the ME Household Financial Comfort Study. It just takes a few people to fall victim to a phishing attack to make the whole thing worthwhile.
While bank customers can only do so much as think twice before responding to messages, the banks hold real control. These security breaches may have been avoided simply by being aware of suspicious patterns of conduct.
Financial companies are used to looking for suspicious trends in credit card purchases, so this isn’t new ground for them. Perhaps now is the time to extend these same principles to other scenarios in order to better protect Australia’s banking customers.
