The Online Banking Fraud That Wasn't
from the this-is-weird dept
Anyone have any idea what’s happening here? Apparently, someone set up a website that sounded – in every way – like it was a scam to get user’s bank account info. There was an email that directed people to a website, asking them to change their PIN. It sent them to a website that was not associated with the bank, but (here’s the odd part), that site then just loaded the actual bank website in a full frame on the page. Thus, the page looked exactly like the bank’s website because it was the bank’s website. The online thing that was noticeably different was the URL was the URL of the “scammer”. So, either, this was an incredibly poorly thought out scam, or there’s more to it than was explained in this article.
Comments on “The Online Banking Fraud That Wasn't”
Give it a little thought and you'll figure it out
Its easy enough to make an intermediate page that the form submits to, that page could then record the pin in a database along with the rest of the customers data and forward the customer directly to the bank. That way, the customer feels safe and isnt worrying about being defrauded because clearly, they got to the banks site so nothing must have gone wrong. You made the name lame mistake he was counting on the dupe customers to make. Bravo.
Re: Give it a little thought and you'll figure it
Right. That’s what I was wondering if it was possible to do. I didn’t make the mistake… I wasn’t sure, which is why I was asking.
Re: Give it a little thought and you'll figure it
You also made a mistake – the user was not given a form to fill out and then redirected. They were just given an URL that contained the banks web site within a frame. Frames are loaded by the browser, not by the remote site so any pin subsequently would not have been sent to the phantom web site.
What I suspect this person was doing was researching how susceptable people are to this kind of social engineering. The question is whether they were researching for legitimate reasons or illegitimate reasons – like a subsequent exploit that did capture a PIN.
Re: Re: Give it a little thought and you'll figure it
It’s possible, with a bit of clever JavaScript, to load another site in a frame and automatically intercept or redirect any form data. This way, the site looks perfectly legitimate to the user, and might even still work like it should, but in the meantime your account information has been stolen secretly.
A pretty clever tactic, if you ask me. It’d be even better if you could find a way to rewrite the displayed URL in such a way that it looks the same as the official site’s URL. This is a much harder prospect; barring security holes, I don’t think any browsers will let you do this.