PayID Data Breaches Show Australia’s Banks Need To Be More Vigilant To Hacking


The Cape Peninsula University of Technology, Rhodes University, Stellenbosch University, and the Universities of Cape Town, Johannesburg, Kwa-Zulu Natal, Pretoria, and South Africa are among the eight universities that have contributed to the Conversation. The University of the Witwatersrand and the University of the Western Cape, as well as the African Population and Health Research Centre and the Nigerian Academy of Science, are hosting the conference. The Bill and Melinda Gates Foundation is a Strategic Partner of the Bill and Melinda Gates Foundation.

A safe with the door blown open comes to mind when we think of a bank robbery. However, nowadays, it’s more likely to imagine criminals gaining online access to our bank accounts from another world. Balaclavas and shotguns are no longer needed by bank robbers.

Customers in Australia have long had access to easy ways to move funds through their banks. However, human error is common when it comes to understanding and entering BSB and account numbers. Enter your PayID.

Customers may link their bank account to their mobile phone number or email address using PayID. They may then easily give this information to others, allowing them to collect payments in a more convenient manner.

It can only be used to receive payments, not send them out. As a result, you might believe it’s a less appealing target for hackers. But this isn’t always the case.

PayID, which was launched in February 2018 by New Payments Platform Australia, a 13-bank alliance, is said to be open to more than 52 million account holders at almost all major financial institutions. By February 2019, more than 2.5 million PayID identifiers had been developed, and more than A$75 billion in transactions had been processed.

When making a payment with a PayID cell phone number, the full name of the account holder is shown, allowing the individual making the payment to double-check that they are sending it to the correct PayID account.

Shortly after the service launched, Twitter users pointed out that this means you can type in random phone numbers and the account holder’s name will appear if the number has been connected to a PayID account – kind of like a reverse phone book.

The next day, on February 17, 2018, NPP Australia issued a media release acknowledging the problem but largely dismissing users’ concerns:

This isn’t necessarily comforting for bank customers whose information was made public. And recent events indicate that the underlying issues are still present.

Recommended: Seven (7) Steps How To Build Your Own Brand From Scratch

Better luck next time?

In June 2019, hackers accessed approximately 98,000 PayID data after using multiple online bank accounts to conduct over 600,000 PayID lookups over the course of six weeks, allegedly by simply entering phone numbers in sequential order.

Although there are reports of a leaked memo pointing the finger at US-based fraudsters, it is unclear who was to blame.

The exact motivation is unknown, but in the underground economy, any personal information is valuable. In this scenario, the information may be used as part of a more sophisticated phishing scheme to steal additional information from account holders.

While this appears to be a very simple attack involving nothing more complex than trial and error, the PayID system appears to have missed a significant number of lookups – an average of 14,000 per account – or the pace at which they were carried out.

To offer an example, imagine going to your bank 14,000 times and each time handing over a new piece of identification.

This large number of searches may have raised serious security concerns. Although it’s understandable if legitimate users need a couple of tries to enter the correct number, no one should need thousands.

Adding lookup limits and identifying this as a highly abnormal activity should have been a simple security measure. However, neither the bank in question nor NPP Australia had put in place systems to detect or prevent this type of fraud.

After a security breach of this magnitude, banks are likely to take immediate action to prevent it from happening again. But two months later, it happened again.

A total of 92,000 PayIDs were exposed in August of this year. The violation was claimed to have occurred inside the networks of a financial institution linked to the NPP Australia systems in this case. Users’ full names, BSBs, and account numbers were allegedly exposed in this breach, which is concerning.

Customers were quickly reassured by banks that transactions could not be completed as a result of this. However, it provided cybercriminals with even more useful knowledge, allowing for more phishing opportunities.

Though impacted customers have been notified, the only way to eliminate the risk is to discontinue using PayID. This is easy to do, but it eliminates the comfort aspect for the majority of bank customers.

Read: Facebook Data Breach – What Happened And Why It’s Hard To Know If Your Data Was Leaked

What’s the real risk?

The risk can seem minor because the system allows transfers into accounts rather than allowing withdrawals from them. Many in the banking industry have dismissed it as such. However, there is a greater danger.

Phishing is a type of cybercrime in which victims are duped into divulging personal information through persuasive emails or SMS messages. Unfortunately, there have already been examples of this with PayID.

The method depicted above isn’t especially advanced. Consider a more personalized email message that includes examples of personally identifiable information (PayID, full name) or, as in the case of the most recent breach, BSB, and account number.

With the right branding and soothing words from your bank, an unsuspecting consumer could easily be persuaded to “log in to change your PayID for security reasons.” A few minutes of machine imagination will yield compelling results.

The picture below was generated to demonstrate how simple this process is. Although it has genuine branding, the “login” button could easily be set to redirect visitors to a website that steals login credentials.

With nearly half of households having at least A$10,000 in savings, cybercriminals have a strong incentive to target our bank accounts, according to the ME Household Financial Comfort Study. It just takes a few people to fall victim to a phishing attack to make the whole thing worthwhile.

While bank customers can only do so much as think twice before responding to messages, the banks hold real control. These security breaches may have been avoided simply by being aware of suspicious patterns of conduct.

Financial companies are used to looking for suspicious trends in credit card purchases, so this isn’t new ground for them. Perhaps now is the time to extend these same principles to other scenarios in order to better protect Australia’s banking customers.

Facebook Comments Box


Please enter your comment!
Please enter your name here