The Online Banking Fraud That Wasn't

from the this-is-weird dept

Anyone have any idea what’s happening here? Apparently, someone set up a website that sounded – in every way – like it was a scam to get user’s bank account info. There was an email that directed people to a website, asking them to change their PIN. It sent them to a website that was not associated with the bank, but (here’s the odd part), that site then just loaded the actual bank website in a full frame on the page. Thus, the page looked exactly like the bank’s website because it was the bank’s website. The online thing that was noticeably different was the URL was the URL of the “scammer”. So, either, this was an incredibly poorly thought out scam, or there’s more to it than was explained in this article.

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “The Online Banking Fraud That Wasn't”

Subscribe: RSS Leave a comment
Bob Jase (user link) says:

Give it a little thought and you'll figure it out

Its easy enough to make an intermediate page that the form submits to, that page could then record the pin in a database along with the rest of the customers data and forward the customer directly to the bank. That way, the customer feels safe and isnt worrying about being defrauded because clearly, they got to the banks site so nothing must have gone wrong. You made the name lame mistake he was counting on the dupe customers to make. Bravo.

Nuwanda says:

Re: Give it a little thought and you'll figure it

You also made a mistake – the user was not given a form to fill out and then redirected. They were just given an URL that contained the banks web site within a frame. Frames are loaded by the browser, not by the remote site so any pin subsequently would not have been sent to the phantom web site.

What I suspect this person was doing was researching how susceptable people are to this kind of social engineering. The question is whether they were researching for legitimate reasons or illegitimate reasons – like a subsequent exploit that did capture a PIN.

wonko (user link) says:

Re: Re: Give it a little thought and you'll figure it

It’s possible, with a bit of clever JavaScript, to load another site in a frame and automatically intercept or redirect any form data. This way, the site looks perfectly legitimate to the user, and might even still work like it should, but in the meantime your account information has been stolen secretly.

A pretty clever tactic, if you ask me. It’d be even better if you could find a way to rewrite the displayed URL in such a way that it looks the same as the official site’s URL. This is a much harder prospect; barring security holes, I don’t think any browsers will let you do this.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...