Remote Banking Fraud (RBS)

[Адвокат]

Fraud with Remote Banking Services (RBS).

The risk of becoming a victim of fraud is determined by many factors:

* Reliability and security of RBS software;
* a mechanism for storing and changing electronic keys for access to the remote banking system and user login / password;
* the level of security of the personal computer from which banking operations are carried out;
* organizational procedures for conducting banking operations through the RB system in the organization.

Principle of fraud
The theft of funds can be carried out both by your internal employees, and by absolutely no people to your company. And this is the first question that needs to be answered by our specialists.

In most cases, the compromise of electronic keys occurs with the help of malware that penetrates the Internet. This code detects that the PC is working with the RB system, and copies the keys and user name / password, and then transfers this information to the attackers. In addition, there may be cases when the transfer of funds is carried out directly from the victim’s PC using remote administration software, also installed by fraudsters via the Internet.

Storing keys on a computer’s hard drive or an unprotected external medium (floppy disk, USB-Flash drive) greatly simplifies obtaining unauthorized access to them. As a rule, a company learns that money was stolen from its account, after the money passed through several accounts of legal entities and individuals and was successfully cashed. At the same time, the attackers make every effort to destroy evidence of their criminal activity and prevent the victim company from accessing accounts. For this, various methods are used to disable a personal computer from which the keys and user name / password were stolen. DDoS attacks on bank servers and Internet gateways of the victim company are also often used to make it difficult to access accounts through the RB system.

What are scammers?
A criminal group engaged in fraudulent transactions through the RB system is a well-organized group of individuals, including virus writers, malware distributors, and payment and cash-out specialists. These individuals may be located in different cities and even countries, but they all leave traces of their illegal activities by which they can be identified and held accountable.

If you find that money has disappeared from the account of your organization: you need to call the hotline as soon as possible and report the incident.

At each stage of the preparation and conduct of a fraudulent operation, material evidence remains on the basis of which the search for criminals is possible. Electronic evidence is short-lived and requires special care at the time of collection and analysis, so as not to destroy the data important for the investigation and ensure their legal significance. Therefore, their prompt collection by competent specialists is so important.

Correct and timely collection of evidence - 50% of the success of the investigation!
The analysis of the collected evidence allows you to identify the persons involved in the crime and choose the most promising course of the investigation of the incident. During the investigation, the following sources of information are collected and analyzed:
* Hard disk image of a potentially compromised computer;
* logs of network activity of the firewall and proxy server of the company;
* logs of network activity of the company’s provider;
* logs of work with the RB system;
* instances of malware detected on the hard drive and in the company’s network;
* holders of electronic keys to the RB;
* organizational procedures for the storage and use of storage media with electronic keys to the RB;
* data collected on active network equipment during a DDoS attack, if any;
* the way of "withdrawal" of funds.

 

[Адвокат]

CENTRAL BANK OF THE RUSSIAN FEDERATION

LETTER
dated December 7, 2007 N 197-T

ABOUT RISKS AT REMOTE BANK SERVICES

The Bank of Russia notes that recently in the Russian segment of the Internet, network attacks on websites and servers (hereinafter referred to as resources) of credit organizations, as well as attempts to illegally obtain personal information of users of remote banking systems (hereinafter referred to as “RBS”) (passwords, secret keys) have become more frequent encryption tools and analogues of handwritten signatures, PIN codes and bank card numbers, as well as personal data of their owner).

The most common are distributed denial of service attacks, in which a large number of computers (from several hundred to hundreds of thousands), the software of which are previously specially remotely modified by persons attempting to illegally obtain personal information of users of remote banking systems, at the command of these persons begin to simultaneously send massive requests to the attacked resource, seriously disrupting or completely blocking its work. At the same time, the owner of the resource, as a rule, cannot restore the working capacity of the resource on its own, without the help of an Internet provider. The duration of the attacks can be several days, during which it becomes impossible for the RBS of many clients of a credit organization, which can cause direct damage to this organization and its customers.

In connection with the foregoing, the Bank of Russia considers it appropriate to recommend credit organizations to include in the agreements concluded with Internet providers the obligations of the parties to take measures aimed at promptly restoring the functioning of the resource in case of emergency situations, as well as responsibility for untimely fulfillment of such obligations.

When attempting to illegally obtain personal information of users of RB systems, clients of credit organizations are sent e-mail messages that, under some pretexts (technical re-equipment of the organization, updating or reconciling the databases of a credit institution, etc.), are invited to enter from the computer keyboard the indicated codes in the fields of screen forms during simulated sessions of information interaction with a credit institution (for example, through a duplicate of its website). At the same time, malicious programs can be transferred to the client’s computer from the website, which are computer viruses or “bookmarks” that perform hidden functions in the background that are associated with the illegal receipt of personal information of users of remote banking systems.

There are cases of unlawful receipt of bank card details when conducting transactions through ATMs. At the same time, overhead devices are used on the keyboard to enter a PIN code or on a device for receiving cards at an ATM, as well as "fake" ATMs specially adapted for this purpose, which are illegally installed, as a rule, in places that are not controlled by credit organizations and do not differ in appearance from ATMs used for banking services of clients of credit organizations.

Bank card details illegally obtained in various ways are used to make fake bank cards that partially (so-called "white plastic") or completely imitate authentic ones. When used in ATMs, fake bank cards provide their holders with all the possibilities of genuine bank cards.

In order to illegally obtain personal information of users of remote banking systems, interested parties also use various options for telephone fraud. In particular, there have been cases of fraudsters sending SMS messages to credit institution customers about the need to call phone numbers that do not actually belong to these organizations. There are also calls to customers with a message from auto-informants about the provision of bank products and services with a proposal to press certain keys on the phone to confirm agreement to purchase them, etc. Thus, the bank’s customers are encouraged to come into contact with fraudsters, the purpose of which may include obtaining confidential client information (for example, bank card number and PIN code).

In connection with the above, the Bank of Russia draws the attention of credit organizations to the need to disseminate warning information for its customers, including using representative offices on the Internet (websites), about possible cases of unlawful receipt of personal information of users of remote banking systems. It is advisable to include such information on the description of officially used methods and means of information interaction with customers, as well as descriptions of methods of illegally obtaining personal identification codes of customers, information on bank cards, and safety measures that must be observed by customers using remote banking systems. As such measures, credit organizations could, for example, recommend to customers:

- exclude the possibility of unlawful receipt of personal information of users of remote banking systems (not to transfer to unauthorized persons);

- carry out operations using ATMs installed in safe places (in state institutions, bank divisions, large shopping complexes, hotels, airports, etc.);

- do not use bank cards in trade and service organizations that are not credible;

- when making operations with a bank card without using ATMs, do not let it out of sight;

- do not use devices that require entering a PIN code to access the room where the ATM is located;

- do not use a PIN code when ordering goods or services by phone / fax or via the Internet;

- if possible, provided by a credit institution, use the details of a one-time card (the so-called "virtual card") to pay for goods or services via the Internet;

- use the SMS notification service about transactions performed using RB (if it is possible to receive such a service);

- carry out information interaction with a credit institution only using communication tools (mobile and landline telephones, faxes, interactive websites / portals, regular and electronic mail, etc.), the details of which are specified in the documents received directly from the credit institution.
This letter is to be published in the Bulletin of the Bank of Russia.
Bring the contents of this letter to credit organizations.

First Deputy Chairman of the Bank of Russia G.G. MELIKYAN

 

[Адвокат]

Memo to the user of the remote banking system
Recently, attempts to illegally obtain users' personal information (passwords, secret keys of encryption tools and hand-written signature analogues) of remote banking systems (hereinafter - RBS) have become more frequent in the Russian segment of the Internet network.
In order to prevent theft of personal information of users, we recommend that you observe the following precautions when using remote banking systems.
1. Timely update the operating system and the software used to work on the Internet (browsers - Explorer, Opera, Firefox; email clients - Outlook, The Bat, Thunderbird, etc.).
2. When working with e-mail, do not open letters and files attached to them received from unknown senders, do not follow the links contained in such letters.
3. Install and regularly update anti-virus software on your computer (Kaspersky Anti-Virus, Norton Antivirus, Avast).
4. Antivirus software must be running continuously from the moment the computer boots. A full weekly scan of your computer for viruses is recommended.
5. Use firewalls, allowing access only to trusted Internet resources and only to trusted applications.
6. When using the Internet, do not agree to install any additional programs from sites unknown to you.
7. On the computer used to work in the RB system, there should be no accounts (users) with empty passwords. When choosing a password for an account, try to make it difficult.
8. Eliminate the possibility of unlawful obtaining of personal information of users of remote banking systems - do not transfer key carriers, logins and access passwords to unauthorized persons.
9. The system should not request a separate input of key data for “verification” and other unusual functions. Use of the key only for its intended purpose at the time of signing the documents.
10. In case of compromise or suspicion of compromise, the signature key should be replaced immediately. The event considered as a compromise of a key can be a loss of a key carrier (even with subsequent detection), as well as the dismissal or change of persons allowed to these keys.
11. Carry out information interaction with the Bank only using communication tools (landlines, interactive Web sites / portals, e-mail), the details of which are specified in documents received directly from the Bank.
Please note that in the case of using the RB system from public computers (library, Internet cafe), the risk of theft and subsequent unlawful use of the secret signature key and other authentication information (name / password) significantly increases.
contact the Bank immediately if the following situations arise:
• An unauthorized expenditure transaction was found in your statement.
• A key medium with a private signature key or a computer on which the Bank-Client system was installed is lost or stolen.
• Your RBS system does not work for unknown reasons.

 

[Адвокат]

Memo on security measures when working with electronic banking (Russian experience)
Recently, attempts to illegally obtain personal information of users of remote banking systems (hereinafter - RBS) have become more frequent on the Internet: logins, passwords, secret keys of encryption tools and analogues of handwritten signature of payment card PIN codes and so on. To counter this phenomenon, security specialists created a special safety note for customers using electronic services of the bank.
Know those who may carry out unlawful actions
An analysis of identified attempts and cases of embezzlement of funds from the settlement accounts of bank customers, conducted by the Central Bank of the Russian Federation together with authorized bodies, showed that theft is carried out:
* Responsible employees of clients who had access to secret keys of electronic digital signature (EDS) of the organization. As a rule, these are laid-off managers, accountants and their deputies, IT employees, as well as co-owners of organizations.
* Regular IT employees of clients who had technical access to media with private keys of electronic digital signature, as well as access to computers from which they worked in the RB system.
* Abnormal, IT-call specialists who serve the computers of clients from which they worked on the RB system, including specialists who carry out preventive maintenance and connecting to the Internet, install, update and configure accounting, legal information programs and other software .
* Intruders, by infecting clients' computers via the Internet with malware. Using the flaws and vulnerabilities of the system and application software (including: not updated or missing anti-virus protection, filtering network traffic, etc.), clients and attackers infect client computers with Trojan programs, followed by remote theft of the client’s EDS private keys, usernames and passwords.

Know the methods and techniques of cheating
Messages are sent to customers of credit organizations via e-mail systems in which, under any pretext (technical re-equipment, updating or reconciliation of credit institution databases, etc.), it is suggested to enter the indicated codes into the fields of on-screen forms during simulated information sessions using a computer keyboard interaction with a credit institution, for example, through a duplicate of the bank’s website. At the same time, malicious programs that are computer viruses or “bookmarks” can be transferred to the Client’s computer from this Web site, performing hidden functions in the background that are associated with the unlawful receipt of personal information of users of remote banking systems.

Fraudsters seek to obtain bank card details when their owners conduct transactions through ATMs. In this case, the following are used: camouflaged mini-video cameras, overhead devices on the keyboard for entering a PIN code and on devices for receiving cards at an ATM, as well as "fake" ATMs specially adapted for this purpose, which are illegally installed, as a rule, in uncontrolled credit organizations of places and externally do not differ from ATMs used for RBS of clients of credit organizations.

To obtain confidential information, attackers use various options for telephone fraud. There are many cases of fraudsters sending SMS messages to credit institution customers about the need to call phone numbers that do not actually belong to these organizations. There are also calls to Clients with a message from an auto-informant about the provision of Bank products and services with an offer to press certain keys on the phone to confirm consent to purchase them, etc. Thus, the Bank's customers are provoked to make contact with fraudsters, the purpose of which may be to obtain confidential client information (for example, personal data, logins and passwords for entering the RB system, bank card numbers and PIN-code).

In all these cases, fraudsters, having seized EDS keys and Means of Access to the Client's RB system, on their behalf send various payments to the Bank to various individuals and legal entities.

Bank card details illegally obtained in various ways are used to make fake bank cards, partially (so-called “white plastic”) or completely imitating genuine ones. When used in ATMs, fake bank cards provide their holders with all the possibilities of genuine bank cards.

After the Bank has transferred to you the Means of Access to the RB system (login / password, session keys) and digital signature keys (EDS), the confidentiality of the received data completely depends on how responsibly you will treat their use and storage.
Know the ways and precautions

To reduce the risk of unauthorized access to the RB system, we recommend that you use the following precautions:
* Ensure the security of cards with logins and passwords and cards with session keys, as well as media with digital signature keys used in remote banking systems.
* Eliminate the possibility of unlawful obtaining of personal information of users of remote banking systems - do not transfer key carriers, logins and access passwords to unauthorized persons.
* Store the card with logins and passwords separately from the card with session keys in places that exclude unauthorized access to them.

In case of compromise or suspicion of compromise, immediately replace the login and password for access to the RB system and the signature key. As an event considered as a compromise of access means and a key, there may be a suspicion that access means became known to intruders, loss of media with key information (even with subsequent detection), dismissal or change of persons authorized to these keys.

Use only external media (floppy disks or flash drives) to store EDS keys, and not your computer’s hard / network drives. At the same time, the owner of such an external medium must store it in conditions that exclude third parties access to it (for example, use a personal safe for storage).

Do not use media with digital signature keys for any other purposes (in particular, do not store any other information on them).

Remove media with EDS keys from the computer every time after their use (that is, media with EDS keys should be in the computer only at the time of signing) - even if the RBS system continues to work, the media should be removed from the computer immediately after signing documents.

Do not allow (even for a short time) storage media with EDS keys, logins, passwords and session keys in the public domain (for example, on the table) at a time when they are not in the zone of "direct visibility" - if necessary, leave the workplace places, place the media in a secure place (for example, in a personal safe).

Do not pass EDS keys and do not give the login and password of access from the RBS system to anyone, including IT specialists, to check the operation of the system, settings for interaction with the Bank, etc. If such checks are necessary, the owner of the digital signature is required to personally enter the login and password and connect the medium with the digital signature keys to the computer.
Do not allow the use of simple passwords (123456, qwerty, etc.) - use various complex combinations of letters (including in different registers) and numbers that are not arranged "in a row" on the keyboard.
Do not assign a password used in the RBS system in any other systems and services.
Perform regular (at least 1 time per month) change of passwords used in the RBS system.

We recommend that you immediately change your password and regenerate EDS keys (using the appropriate capabilities of the RB system) or contact the Bank for re-issuance of Access Means and EDS keys in the following cases:
* Upon dismissal of an employee who had access to EDS keys.
* In case of any suspicion of compromising (copying) EDS keys and / or Access Means.
* In case of detection of any malicious programs on the computer used to work in the RB system.
If an incident has occurred, and there is a need for intervention by the competent authorities, it is necessary to preserve as much evidence as possible that will help during the investigation. For this purpose, do not restart the computer from which the operations with the RB were performed, but only de-energize it until the time of the forensic examination. Save all possible logs from firewalls, proxies, gateways, etc. that could be involved in the incident and are able to shed light on how it went.
Contact the Ministry of Internal Affairs with a statement and attach the collected information to it.
On the computer from which the work with the RB system is carried out:
Make sure that you get to the genuine website of your bank, and not to the duplicate site, which was made by scammers and can provide a full copy of this bank's website. In order not to become a victim of fraudsters, use the direct address of the Bank's website. Try to avoid going to our Bank’s website using a link from a third-party website.

The Internet address of the RBS system must strictly correspond to the specified address in the service contract. If a change is found in the address bar, you must immediately terminate the communication session and contact the bank technical support service by phone or send an e-mail message.

The RBS system should not request a separate input of key data for “verification” and other unusual functions. Use the key only for its intended purpose at the time of signing the documents.

When using the Internet, do not agree to install any additional programs from sites unknown to you.

Ensure timely (whenever possible, automatic, using Windows Update) download and install all the latest updates from Microsoft, as well as regular updates of other system and application software as new versions appear (browsers - Explorer, Opera, Firefox; email clients - Outlook, The Bat, Thunderbird, etc.).

When working with e-mail, do not open emails and files attached to them received from unknown senders, do not follow the links contained in such emails.

Use anti-virus protection tools (Kaspersky Anti-Virus, Norton Antivirus, Avast), while ensuring regular updating of anti-virus databases, as well as a weekly full anti-virus scan. Antivirus software must be running continuously from the moment the computer boots.
Use specialized security software:
* personal firewalls (Personal Firewall),
* Anti-spyware software (Anti-Malware software) and other specialized software,
* used to ensure information security.
When setting up a firewall, allow access only to trusted Internet resources and only to trusted applications.

Attention! The Bank does not recommend using the dbo system from public computers (library, Internet cafe) and draws your attention to the fact that the risk of theft and subsequent unlawful use of the secret signature key and other authentication information (name / password) increases significantly.
When carrying out operations using payment cards
Carry out transactions using ATMs installed in safe places (in government agencies, bank divisions, large shopping complexes, hotels, airports, etc.)
When using an ATM, carefully inspect the card reader before entering the card: it should not contain any foreign objects. In case of suspicion, DO NOT use this ATM and inform the bank (the bank phone should be on the ATM screen or on stickers)
Feel free to ask to move at least a meter of a person standing nearby.
Do not use bank cards in trade and service organizations that are not credible.
When making operations with a bank card without using ATMs, do not let it out of sight.
Do not use devices that require entering a PIN code to access the room where the ATM is located.
In no case do not store the PIN code next to the card (for example, in a wallet), and especially do not put it on the card. When entering the PIN code, cover the keyboard with your hand.
Do not use the PIN code when ordering goods or services by phone / fax or via the Internet.

In case of loss / theft of the card, Immediately notify the bank support service (the phone should be on the back of the card, so when you receive the card, copy it (for example, in a notebook or cell phone)).
Use the SMS notification service about transactions performed using RB.

Attention! Carry out information interaction with the Bank only using means of communication (mobile and landline telephones, faxes, interactive websites / portals, regular and electronic mail, etc.), the details of which are specified in documents received directly from the Bank.

We draw your attention to the fact that:
The Bank does not request information from customers about their personal data, payment card numbers, and does not send out e-mails asking them to send EDS keys and / or a password to the RB system.
If you received such a “dubious” letter, SMS message on behalf of our Bank, a request for any confidential information or EDS / password keys used in the RB system, you should immediately inform the Bank Customer Service Center about this.
* Source: ATM

 

[Матушкин Андрей Николаевич]

Thank!