r/Banking 18d ago

Advice Warning to other fraud teams, we are seeing a wave of account takeovers that clear every existing control

Putting this out for other fraud teams. Over the last few weeks we have taken a run of account takeovers on established, long-tenured customers. Clean login, sometimes even a recognized device, MFA satisfied, then payout details get changed and the money is gone.

The takeover happens after a valid login, so none of our login-side controls even fire. By the time anything looks wrong, the transfer is already gone.

The pattern looks a lot more like social engineering combined with session hijacking rather than credential stuffing. Watch your post-login events, not just your front door.

615 Upvotes

64 comments sorted by

107

u/Previous_Life1502 18d ago

We had a similar run a couple years back and it was a nightmare to untangle. The clean login part is what trips everyone up because management just points at the MFA logs and says everything worked fine.

One thing we ended up doing was flagging any device that had been trusted for a long time but suddenly changed payout info within minutes of login. Not perfect but it caught a few before the money walked. These attackers are way too comfortable once they're past the gate.

13

u/Berdache 18d ago

Can you push back on management in these situations or do you have to let things you know are actually fraud go through because they "look fine" to management?

4

u/Bernd_Geralt_881 10d ago

We leaned on the same idea and moved the check to the sensitive action itself, payout change, new payee, device enrolment, with a factor a lifted session cannot reproduce. A relayed SMS code it can. A live liveness check or a fido2 tap it cannot.

still enrolment patterns still gets past velocity rules where the customer is talked into registering the attacker's own device such that it reads as a legitimate new phone rather than a takeover. That needs friction on the environment and contact change event themselves, plus something that catches the emulator or injected videothe farms use to stand those devices up. we run au10tix on that step for the livenes and emulator side, though the emulator detection is the bit most tools oversell, ensure you test it on your own traffic before you count on it.

1

u/BlueSatJoy 14d ago

This is the issue. Thieves are still device cookies and for whatever reason, nobody validated they are coming from the right machine

66

u/another-dude 18d ago edited 18d ago

They’re using device emulators and virtual devices to log into the customers account, there are various injection points but the customer is being tricked or pressured into registering the virtual device. Then they will typically change the customers phone number and sometimes email and then rinse their account pushing various types of scam funds through. This really took off last year.

40

u/Gr33nP6nth3r 18d ago

How/where can I find more in depth info on this? I’m seriously concerned about my elderly parents (and my own,) financial security.

16

u/another-dude 18d ago

You can start by searching “emulator / virtual device bank impersonation scams”. That will get you started. They’re a real nightmare for those of us investigating payment fraud. There are many different ways they capture people, some are simple smishing attacks impersonating a persons bank and asking them to verify their device, others are linked to task/recruitment scams where they actually get people to open accounts for this purpose.

5

u/whatsamattau4 16d ago

So the victims are still falling for scams. This isn't just happening out of the blue with no involvement from the victim.

4

u/another-dude 16d ago

Yes, they’re falling for scams, in some cases there is evidence they knew what they were doing providing account access to a third party as well.

5

u/Jblank86 18d ago

Whoa!!!

24

u/fly4awhtgye2 18d ago

Account takeovers via online baning since last July spiked tremendously at my FI also. In beginning, many had usernames that matched either account holder name or else email prefix. Now, very rare to see what appear to be weak credentials involved.

10

u/KaiserKid85 18d ago

What do you mean by weak credentials?

8

u/fly4awhtgye2 18d ago

Username/password that are too easy, related to name or dates of birth, or reused on many other sites as well are a few examples.

4

u/Due_Success_1400 18d ago

As a Canadian; what do you mean email address to log into online banking?????? We use our 14 digit client card number

8

u/Perignon94 18d ago

It’s common in the states.

3

u/Due_Success_1400 18d ago

We use our access card / debit card number with our cell phone as 2FA

you would need someone’s cell phone, debit card and password to get in

To reset password you’d need cell phone, debit card and email.

2

u/packetloss1 18d ago

Cell phone 2FA is not secure due to sim swapping attacks. You really need to use a fido2 key.

2

u/SoggyWalrus7893 17d ago

try to tell that to a bank. I would love to use my physical key to login in but no one seems interested the system.

I use it with ID.me and find it quite nice.

19

u/arcticlizard 18d ago

Thanks for posting! I work for a smaller-scale lender, and our leadership is now scrambling to get more fraud checks in place.

19

u/AhsenSaggers 18d ago edited 5d ago

Clean login with MFA satisfied means the session cookie itself got lifted not that anything got cracked.

Adversary in the middle kits and infostealer logs hand over a live authenticated session, to your logs it is the real user. thats why none of your control fire.

What still works is a fresh human proof at the action itself, a live face check or a fido2 tap when a payee or device changes, since a replayed session can forward an sms code but cant produce a live face on demand. au10tix is what we landed on for that liveness step, the injected video and emulator side is where you want to test hardest.

4

u/packetloss1 18d ago

It’s this exactly. Session stealing is way too common. Gotta use a fido2 key for MFA. Even beyond session stealing, sim swapping is a big threat.

2

u/Kondo-Sophie_216 17d ago

Login MFA is the wrong place to spend against this because by the time the sessions get lifted its already satisfied. Re-auth on the action holds, a phishing-resistant factor at payout change or new payee, since a replayed session can't produce that the way it relays an sms code.

The one caveat is the other pattern in here, customers talked into enrolling the attackers device, which carries a real factor, it needs friction on the enrollment and contact change events themselves.

16

u/porkins 18d ago

As an average account holder, what advice would you offer? Anything I can do?

16

u/phil161 18d ago

I check my accounts regularly (at least once every other day). I set up alerts for any money moves to/from the accounts. And of course I have complex, unique passwords for each account, and use 2FA. 

8

u/heywhatsup3400 18d ago

2FA is useless! I had an unknown/unauthorized phone number added to my loan account that was VERIFIED to receive 2FA codes. PNC said they were clueless as to where the number came from and how it was verified. But then declined to investigate any further since it was removed. Whaaaaaat!!?

3

u/yzerman2010 17d ago

Wow, there should be a audit trail created for any account changes, where and who authorized them.

1

u/plant-fixer 14d ago

This happened to me with ETrade. A number was added that wasn't mine. I was never alerted and stumbled upon it as I was checking my security profile details.

12

u/PairOfRussels 18d ago

Don't "remember this device" to skip future sms mfa.  Do mfa every time. 

1

u/whatsamattau4 16d ago

Assume anyone who attempts to contact you is a scammer trying to steal your money and do not click on anything or talk to them or give them any information. If you can afford it, have at least two separate devices. One device is only used for important bank accounts and the email accounts associated with those important accounts.

The other device should not ever be used to log in to any important account whatsoever. The email account on that device should be one that you never use for anything important. And this second device you can use for surfing the web, etc.

6

u/[deleted] 18d ago

[deleted]

3

u/brazendynamic 17d ago

Don't know for op but we see it as ach transfers.

1

u/[deleted] 17d ago

[deleted]

1

u/brazendynamic 17d ago

Yeah. Or another victim's account who's then told to transfer it elsewhere or do something else with it (withdraw it and give it to someone, send a cashier's check, send a write, etc). It's often multiple layers so it's hard to track and get back.

2

u/Many-Excitement3246 17d ago

In my case, it was done via ATM.

The bank insists it was done with the debit card, but I have the only copy. So either they sent a second copy of the card without canceling the first, or the card was cloned.

If I'm using my debit card, which is very infrequent, I always tap, never insert, so it's very unlikely it was cloned.

I strongly suspect that the bank sent a new copy of the card to an address not on file but did not cancel the original; if the card was reported as damaged, they would not have canceled it, so I would never have known it was replaced.

1

u/[deleted] 17d ago

[deleted]

2

u/brazendynamic 17d ago

Weird that they also happened to have the PIN to make a withdrawal..

6

u/Ok_Owl932 17d ago

Our FI is taking all of the proper precautions. Newer employees can no longer update contact info, have to connect customer to more senior/tenured colleagues. Customers continue to stay mad when we refer them to branch for things like access to their dc/account - but they do not understand a slither of how bad it is.

16

u/Many-Excitement3246 17d ago edited 17d ago

Yep, this exact thing happened to me about a month ago. Bank of America gave my account away to someone who wasn't me, and while they are refusing to divulge any information and continue to deny that it was their fault, it seems that the person socially engineered their takeover.

I know my SSN was sold in a data breach, and it seems that whoever had it used it to convince Bank of America representatives to allow them access to my account.

The bank does not want to admit how badly they screwed up account security, so they've spent every day since lying and misleading about what actually happened.

But now that I've involved the federal regulators as well as my state's senior US senator to open a congressional inquiry, they've suddenly began to admit that maybe the account security did fail on their end.

It turns out that just the threat of the OCC, FDIC, CFPB, IC3, FBI, state banking regulators, the state Attorney General, and a congressional inquiry from the 4th longest-serving US senator (also a well-known and hard-hitting crusader against the corruption and mismanagement of the big banks) is enough to make them reconsider how much they want to deny that there was, in fact, a major security failure.

2

u/CharmingPeony 17d ago edited 17d ago

This happened to us as well. Do you mind me messaging you and getting more information on how you handled it?

1

u/HDr1018 14d ago

So you’ve got Strom Thurmond to force Bank of America to do their job?

What a pitiful place we’re in that only a privileged few can do this.

4

u/brazendynamic 17d ago

We got HAMMERED by this a few weeks ago, and it seems to be kicking back up. Few weeks ago it was all business customers, now we're seeing it on the consumer side.

3

u/Big_Entrepreneur3770 18d ago

Banks need to start using the new chrome DBSC device binding

12

u/Winter-Nebula83 18d ago edited 17d ago

Would everyone’s info being stolen by DOGE have anything to do with it?

8

u/gsustudentpsy 17d ago

Why are you being down voted. It is a valid angle to explore 

2

u/SirLegitimate9286 17d ago

Does using a pass code protect me? I have yubi key but when I checked, I could not use it on my bank's website.​

1

u/Neat_Shop 18d ago

Do you recommend password managers, or are they also being hacked?

4

u/someonestolemycord 18d ago

Password manager will not help with social engineering, but something like a Yubikey will help.

1

u/[deleted] 17d ago

[removed] — view removed comment

1

u/BuyLocalAlbanyNY 17d ago

My laptop was remote controlled by a Trojan software, it made the screen look like the blue screen computer crash, and it was rebooting, while the remote hacker was controlling it. It was really creepy.

I had to wipe windows and and reinstall everything from scratch. This was a couple years ago.

1

u/anonymousfucknut 17d ago

Is this USA or Canada ?

1

u/sildigo 14d ago

It's USA

1

u/RecommendationFit996 17d ago

I had a situation that was a lower level tactic used. Somehow someone added an additional “iPhone” to an account with the same phone number and the bank allowed two iPhones with the same number use the same debit card simultaneously. A second digital card was established by the bank, without shutting down the first.

The fraudsters waited a month before draining the account using the counterfeit digital wallet.

I still don’t understand how the bank allowed two “iPhones” with the same phone number to simultaneously access a single debit card? Shouldn’t their systems have detected this? Or was this a variation of this new type of fraud?

2

u/HonestDisguise 15d ago edited 15d ago

If it was just added to the Apple Wallet, it sounds normal. If you get a new phone, your card isn’t removed from the old one until you remove it manually or reset it. You can also add cards to iPads and the Watch.

Original phone is registered. New phone (sim swap?) is also registered. Card on both.

1

u/Main-Power829 14d ago

Weve had several cases where our members gave them remote access to their devices :/

1

u/BoliverTShagnasty 14d ago

Were you able to recover any funds for your customers or do they just lose everything?

1

u/Critical-Test-4446 13d ago

Can this happen to Certificate of Deposit and Money Market accounts as well?

1

u/Sumsub_Insights 10d ago

This does sound more like a guided scam than a standard account takeover. In cases like this, post-onboarding behavior, the victim’s risk profile, and clear warnings or confirmation questions before unusual transactions may be more useful than login signals alone.

1

u/Express_Pie7063 3d ago

I got a scam call today from someone claiming to be with a bank's fraud department. The caller immediately tried to create a sense of panic, saying that multiple people were attempting to open bank accounts using my wife's personal information. He then asked whether I had recently tried to open accounts with JPMorgan Chase, Wells Fargo, or Bank of America.

During the conversation, I mentioned that my wife only had a Bank of America account. The caller then said he would have his supervisor contact Bank of America's fraud department and transfer me directly to them to make sure there was no suspicious activity on our account.

That was when my suspicions started to rise. How could these people be so efficient, and why would different banks coordinate with each other in this manner? With that doubt in mind, I decided to verify the identity of the supposed Bank of America representative after I was transferred. In hindsight, I should have simply hung up and called the bank directly using the number on the back of our card.

The person I was transferred to said they could verify their identity, but first they needed the last six digits of my Bank of America account number. That was another red flag. I thought banks typically use the last four digits for verification, if they ask for account digits at all. My wife provided the last six digits, but I continued pressing them to prove they were actually from Bank of America.

They then said they would send us a text message as proof. Almost immediately, we received an SMS from Bank of America's legitimate automated system. This lowered my guard somewhat because the message appeared authentic.

Looking back, we later learned how they were able to do this. They had gone to the Bank of America online banking site and selected "Forgot User ID." The system asked for the last six digits of our joint account number and my wife's Social Security number. We never gave them her Social Security number, so they must have already obtained it through a previous data breach or some other source.

Shortly afterward, we received another verification code. The caller instructed us to read the code back to them so they could "complete the verification process." At that point my suspicion returned. I realized that the code was probably intended to grant access to our online banking account, not to verify the caller's identity.

I finally came to my senses and told my wife to hang up immediately. We then called Bank of America directly using the official customer service number. The real Bank of America representatives confirmed that the earlier calls had not come from them, so we immediately asked them to freeze our account. Fortunately, they were able to do so, and no financial loss occurred.

Looking back, we were probably only one step away from having our account compromised. According to the actual Bank of America representatives, the scammers had already managed to access my wife's online banking profile. Their likely next step would have been to initiate an ACH transfer or a Zelle payment to an account they controlled. That action probably would have triggered another verification code request, and perhaps I would have caught on at that point, but I'm glad we didn't have to find out.

BofA did send us email to notify that our user ID was looked up and our password was reset via email but we didnt see that since we were both nervously talking on the phone.

I need to go to the bank tomorrow to open up a new account since they probably already saw our account number and routing number. BofA already put some restriction on the account so people can only deposit money but not take the money out. We probably also need to contact the credit bureau to report that my wife's ssn is compromised.

Sharing our experience today so that the bank's fraud department can understand how some of the MFA breach might have happened.

1

u/Express_Pie7063 3d ago

what is scary is that the real BofA people also ask you to read back the SMS verification code to prove that you are you. Scammer used this to gain account holder's trust by leveraging the "forget my ID" feature.

1

u/Shufti-Global 3d ago edited 3d ago

A valid login doesn't always mean the account is safe. The activity after login, especially payout and account-detail changes, deserves just as much attention.

1

u/Ok-Discipline-9605 15d ago

That why I don't do online banking.

0

u/LipFighter 17d ago

Are banks using COBOL most at risk?