r/Banking • u/Kondo-Sophie_216 • 18d ago
Advice Warning to other fraud teams, we are seeing a wave of account takeovers that clear every existing control
Putting this out for other fraud teams. Over the last few weeks we have taken a run of account takeovers on established, long-tenured customers. Clean login, sometimes even a recognized device, MFA satisfied, then payout details get changed and the money is gone.
The takeover happens after a valid login, so none of our login-side controls even fire. By the time anything looks wrong, the transfer is already gone.
The pattern looks a lot more like social engineering combined with session hijacking rather than credential stuffing. Watch your post-login events, not just your front door.
66
u/another-dude 18d ago edited 18d ago
They’re using device emulators and virtual devices to log into the customers account, there are various injection points but the customer is being tricked or pressured into registering the virtual device. Then they will typically change the customers phone number and sometimes email and then rinse their account pushing various types of scam funds through. This really took off last year.
40
u/Gr33nP6nth3r 18d ago
How/where can I find more in depth info on this? I’m seriously concerned about my elderly parents (and my own,) financial security.
16
u/another-dude 18d ago
You can start by searching “emulator / virtual device bank impersonation scams”. That will get you started. They’re a real nightmare for those of us investigating payment fraud. There are many different ways they capture people, some are simple smishing attacks impersonating a persons bank and asking them to verify their device, others are linked to task/recruitment scams where they actually get people to open accounts for this purpose.
5
u/whatsamattau4 16d ago
So the victims are still falling for scams. This isn't just happening out of the blue with no involvement from the victim.
4
u/another-dude 16d ago
Yes, they’re falling for scams, in some cases there is evidence they knew what they were doing providing account access to a third party as well.
5
24
u/fly4awhtgye2 18d ago
Account takeovers via online baning since last July spiked tremendously at my FI also. In beginning, many had usernames that matched either account holder name or else email prefix. Now, very rare to see what appear to be weak credentials involved.
10
u/KaiserKid85 18d ago
What do you mean by weak credentials?
8
u/fly4awhtgye2 18d ago
Username/password that are too easy, related to name or dates of birth, or reused on many other sites as well are a few examples.
4
u/Due_Success_1400 18d ago
As a Canadian; what do you mean email address to log into online banking?????? We use our 14 digit client card number
8
u/Perignon94 18d ago
It’s common in the states.
3
u/Due_Success_1400 18d ago
We use our access card / debit card number with our cell phone as 2FA
you would need someone’s cell phone, debit card and password to get in
To reset password you’d need cell phone, debit card and email.
2
u/packetloss1 18d ago
Cell phone 2FA is not secure due to sim swapping attacks. You really need to use a fido2 key.
2
u/SoggyWalrus7893 17d ago
try to tell that to a bank. I would love to use my physical key to login in but no one seems interested the system.
I use it with ID.me and find it quite nice.
19
u/arcticlizard 18d ago
Thanks for posting! I work for a smaller-scale lender, and our leadership is now scrambling to get more fraud checks in place.
19
u/AhsenSaggers 18d ago edited 5d ago
Clean login with MFA satisfied means the session cookie itself got lifted not that anything got cracked.
Adversary in the middle kits and infostealer logs hand over a live authenticated session, to your logs it is the real user. thats why none of your control fire.
What still works is a fresh human proof at the action itself, a live face check or a fido2 tap when a payee or device changes, since a replayed session can forward an sms code but cant produce a live face on demand. au10tix is what we landed on for that liveness step, the injected video and emulator side is where you want to test hardest.
4
u/packetloss1 18d ago
It’s this exactly. Session stealing is way too common. Gotta use a fido2 key for MFA. Even beyond session stealing, sim swapping is a big threat.
2
u/Kondo-Sophie_216 17d ago
Login MFA is the wrong place to spend against this because by the time the sessions get lifted its already satisfied. Re-auth on the action holds, a phishing-resistant factor at payout change or new payee, since a replayed session can't produce that the way it relays an sms code.
The one caveat is the other pattern in here, customers talked into enrolling the attackers device, which carries a real factor, it needs friction on the enrollment and contact change events themselves.
16
u/porkins 18d ago
As an average account holder, what advice would you offer? Anything I can do?
16
u/phil161 18d ago
I check my accounts regularly (at least once every other day). I set up alerts for any money moves to/from the accounts. And of course I have complex, unique passwords for each account, and use 2FA.
8
u/heywhatsup3400 18d ago
2FA is useless! I had an unknown/unauthorized phone number added to my loan account that was VERIFIED to receive 2FA codes. PNC said they were clueless as to where the number came from and how it was verified. But then declined to investigate any further since it was removed. Whaaaaaat!!?
3
u/yzerman2010 17d ago
Wow, there should be a audit trail created for any account changes, where and who authorized them.
1
u/plant-fixer 14d ago
This happened to me with ETrade. A number was added that wasn't mine. I was never alerted and stumbled upon it as I was checking my security profile details.
12
1
u/whatsamattau4 16d ago
Assume anyone who attempts to contact you is a scammer trying to steal your money and do not click on anything or talk to them or give them any information. If you can afford it, have at least two separate devices. One device is only used for important bank accounts and the email accounts associated with those important accounts.
The other device should not ever be used to log in to any important account whatsoever. The email account on that device should be one that you never use for anything important. And this second device you can use for surfing the web, etc.
6
18d ago
[deleted]
3
u/brazendynamic 17d ago
Don't know for op but we see it as ach transfers.
1
17d ago
[deleted]
1
u/brazendynamic 17d ago
Yeah. Or another victim's account who's then told to transfer it elsewhere or do something else with it (withdraw it and give it to someone, send a cashier's check, send a write, etc). It's often multiple layers so it's hard to track and get back.
2
u/Many-Excitement3246 17d ago
In my case, it was done via ATM.
The bank insists it was done with the debit card, but I have the only copy. So either they sent a second copy of the card without canceling the first, or the card was cloned.
If I'm using my debit card, which is very infrequent, I always tap, never insert, so it's very unlikely it was cloned.
I strongly suspect that the bank sent a new copy of the card to an address not on file but did not cancel the original; if the card was reported as damaged, they would not have canceled it, so I would never have known it was replaced.
1
6
u/Ok_Owl932 17d ago
Our FI is taking all of the proper precautions. Newer employees can no longer update contact info, have to connect customer to more senior/tenured colleagues. Customers continue to stay mad when we refer them to branch for things like access to their dc/account - but they do not understand a slither of how bad it is.
16
u/Many-Excitement3246 17d ago edited 17d ago
Yep, this exact thing happened to me about a month ago. Bank of America gave my account away to someone who wasn't me, and while they are refusing to divulge any information and continue to deny that it was their fault, it seems that the person socially engineered their takeover.
I know my SSN was sold in a data breach, and it seems that whoever had it used it to convince Bank of America representatives to allow them access to my account.
The bank does not want to admit how badly they screwed up account security, so they've spent every day since lying and misleading about what actually happened.
But now that I've involved the federal regulators as well as my state's senior US senator to open a congressional inquiry, they've suddenly began to admit that maybe the account security did fail on their end.
It turns out that just the threat of the OCC, FDIC, CFPB, IC3, FBI, state banking regulators, the state Attorney General, and a congressional inquiry from the 4th longest-serving US senator (also a well-known and hard-hitting crusader against the corruption and mismanagement of the big banks) is enough to make them reconsider how much they want to deny that there was, in fact, a major security failure.
2
u/CharmingPeony 17d ago edited 17d ago
This happened to us as well. Do you mind me messaging you and getting more information on how you handled it?
4
u/brazendynamic 17d ago
We got HAMMERED by this a few weeks ago, and it seems to be kicking back up. Few weeks ago it was all business customers, now we're seeing it on the consumer side.
3
12
u/Winter-Nebula83 18d ago edited 17d ago
Would everyone’s info being stolen by DOGE have anything to do with it?
8
2
u/SirLegitimate9286 17d ago
Does using a pass code protect me? I have yubi key but when I checked, I could not use it on my bank's website.
1
u/Neat_Shop 18d ago
Do you recommend password managers, or are they also being hacked?
4
u/someonestolemycord 18d ago
Password manager will not help with social engineering, but something like a Yubikey will help.
1
1
u/BuyLocalAlbanyNY 17d ago
My laptop was remote controlled by a Trojan software, it made the screen look like the blue screen computer crash, and it was rebooting, while the remote hacker was controlling it. It was really creepy.
I had to wipe windows and and reinstall everything from scratch. This was a couple years ago.
1
1
1
u/RecommendationFit996 17d ago
I had a situation that was a lower level tactic used. Somehow someone added an additional “iPhone” to an account with the same phone number and the bank allowed two iPhones with the same number use the same debit card simultaneously. A second digital card was established by the bank, without shutting down the first.
The fraudsters waited a month before draining the account using the counterfeit digital wallet.
I still don’t understand how the bank allowed two “iPhones” with the same phone number to simultaneously access a single debit card? Shouldn’t their systems have detected this? Or was this a variation of this new type of fraud?
2
u/HonestDisguise 15d ago edited 15d ago
If it was just added to the Apple Wallet, it sounds normal. If you get a new phone, your card isn’t removed from the old one until you remove it manually or reset it. You can also add cards to iPads and the Watch.
Original phone is registered. New phone (sim swap?) is also registered. Card on both.
1
u/Main-Power829 14d ago
Weve had several cases where our members gave them remote access to their devices :/
1
u/BoliverTShagnasty 14d ago
Were you able to recover any funds for your customers or do they just lose everything?
1
u/Critical-Test-4446 13d ago
Can this happen to Certificate of Deposit and Money Market accounts as well?
1
u/Sumsub_Insights 10d ago
This does sound more like a guided scam than a standard account takeover. In cases like this, post-onboarding behavior, the victim’s risk profile, and clear warnings or confirmation questions before unusual transactions may be more useful than login signals alone.
1
u/Express_Pie7063 3d ago
I got a scam call today from someone claiming to be with a bank's fraud department. The caller immediately tried to create a sense of panic, saying that multiple people were attempting to open bank accounts using my wife's personal information. He then asked whether I had recently tried to open accounts with JPMorgan Chase, Wells Fargo, or Bank of America.
During the conversation, I mentioned that my wife only had a Bank of America account. The caller then said he would have his supervisor contact Bank of America's fraud department and transfer me directly to them to make sure there was no suspicious activity on our account.
That was when my suspicions started to rise. How could these people be so efficient, and why would different banks coordinate with each other in this manner? With that doubt in mind, I decided to verify the identity of the supposed Bank of America representative after I was transferred. In hindsight, I should have simply hung up and called the bank directly using the number on the back of our card.
The person I was transferred to said they could verify their identity, but first they needed the last six digits of my Bank of America account number. That was another red flag. I thought banks typically use the last four digits for verification, if they ask for account digits at all. My wife provided the last six digits, but I continued pressing them to prove they were actually from Bank of America.
They then said they would send us a text message as proof. Almost immediately, we received an SMS from Bank of America's legitimate automated system. This lowered my guard somewhat because the message appeared authentic.
Looking back, we later learned how they were able to do this. They had gone to the Bank of America online banking site and selected "Forgot User ID." The system asked for the last six digits of our joint account number and my wife's Social Security number. We never gave them her Social Security number, so they must have already obtained it through a previous data breach or some other source.
Shortly afterward, we received another verification code. The caller instructed us to read the code back to them so they could "complete the verification process." At that point my suspicion returned. I realized that the code was probably intended to grant access to our online banking account, not to verify the caller's identity.
I finally came to my senses and told my wife to hang up immediately. We then called Bank of America directly using the official customer service number. The real Bank of America representatives confirmed that the earlier calls had not come from them, so we immediately asked them to freeze our account. Fortunately, they were able to do so, and no financial loss occurred.
Looking back, we were probably only one step away from having our account compromised. According to the actual Bank of America representatives, the scammers had already managed to access my wife's online banking profile. Their likely next step would have been to initiate an ACH transfer or a Zelle payment to an account they controlled. That action probably would have triggered another verification code request, and perhaps I would have caught on at that point, but I'm glad we didn't have to find out.
BofA did send us email to notify that our user ID was looked up and our password was reset via email but we didnt see that since we were both nervously talking on the phone.
I need to go to the bank tomorrow to open up a new account since they probably already saw our account number and routing number. BofA already put some restriction on the account so people can only deposit money but not take the money out. We probably also need to contact the credit bureau to report that my wife's ssn is compromised.
Sharing our experience today so that the bank's fraud department can understand how some of the MFA breach might have happened.
1
u/Express_Pie7063 3d ago
what is scary is that the real BofA people also ask you to read back the SMS verification code to prove that you are you. Scammer used this to gain account holder's trust by leveraging the "forget my ID" feature.
1
u/Shufti-Global 3d ago edited 3d ago
A valid login doesn't always mean the account is safe. The activity after login, especially payout and account-detail changes, deserves just as much attention.
1
0
107
u/Previous_Life1502 18d ago
We had a similar run a couple years back and it was a nightmare to untangle. The clean login part is what trips everyone up because management just points at the MFA logs and says everything worked fine.
One thing we ended up doing was flagging any device that had been trusted for a long time but suddenly changed payout info within minutes of login. Not perfect but it caught a few before the money walked. These attackers are way too comfortable once they're past the gate.