Voice phishing campaign hits customers at dozens of banks

Cybercriminals used a combination of SMS and voice phishing techniques to obtain debit card details from bank customers

Cybercriminals stole debit card information from customers of dozens of financial institutions in a phishing campaign that combined rogue text messages and with VoIP calls.

The vishing -- voice phishing -- campaign was discovered by researchers from cybercrime intelligence firm PhishLabs while investigating a recent attack against customers of an unnamed midsize bank.

The bank's customers had received text messages claiming their debit cards had been deactivated and instructing them to call a phone number. An IVR (Interactive Voice Response) system set up at that number asked callers to input their debit card and PIN numbers in order to reactivate the cards, John LaCour, the founder and CEO of PhishLabs said Tuesday in a blog post.

"PhishLabs investigated the attack and uncovered a cache of stolen payment card data belonging to customers of dozens of financial institutions," LaCour said. "Based on analysis of the recovered cache, we estimate the vishing crew responsible for the attack has stolen the data of 250 cards per day in this vishing campaign."

The researchers believe the attacks are being carried out by a group of cybercriminals from Eastern Europe and that they might be running since October 2013, when one of the rogue phone numbers started being used.

"The withdrawal limit on ATM cards are typically $300 per day," LaCour said. "Using the recently investigated attack as an example, $75,000 can be lost each day of the attack if the stolen cards are used in an ATM cash-out operation."

Attackers shouldn't normally be able to clone a card using only the card number and PIN because they cannot obtain the CVV1 (Card Validation Value) or CVC1 (Card Validation Code) that are encoded on the card's magnetic stripe and are typically used for authentication.

"Unfortunately, some card issuers and payment processors do not authenticate the CVV1/CVC1 code," LaCour said. "This allows vishing crews, cash-out gangs and other fraudsters to create payment cards using stolen card data and use those cards to directly withdraw funds."

But even in cases where cloning the card is not possible, cybercriminals can still use card details obtained through vishing to perform card-not-present transactions online or over the phone.

According to LaCour, attackers install their IVR software on hacked servers and route calls to it from compromised VoIP servers. They use free text-to-speech tools to generate the IVR interactive messages and email-to-SMS gateways to send out text messages to thousands of users.

"Targeted companies often encounter difficulties when attempting to mitigate vishing attacks," LaCour said. "It can take weeks for an organization to navigate the structures of telecom providers, carriers, and service providers and effectively shut down the phone numbers used to scam customers."

The PhishLabs blog post includes recommendations for both financial institutions and mobile carriers. These include: making sure CVV1/CVC1 is encoded on cards and validated by payment processors; always calling customers from a phone number that's printed on the back of the card; working with telecom companies to understand their technical and anti-fraud procedures; training customer support personnel to handle vishing reports and putting a response plan in place that involves customer notification.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securitydata breachAccess control and authenticationscamsPhishLabsIdentity fraud / theftdata protectionprivacyfraud

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?