4 ms·
Well, specifically, it seems like the ONLY thing that was not compromised in this particular scam was the SMS. The scammer must have known before: 1) the vict
by jaclaz 4y ago
Well, specifically, it seems like the ONLY thing that was not compromised in this particular scam was the SMS.
The scammer must have known before:
1) the victim's telephone number
2) the victim's Login AND Password (or Pin) to the bank website
What the scammer didn't manage to do was to intercept/mitm/whatever the SMS and thus needed the victim to read it aloud.
Or is US bank website access different from here (EU, Italy)?
Here to access the website you need to input login, password then request an SMS code for the authentication, and later you need to request an SMS code to validate any transaction.
- quercusa 4y agoIt's possible they had enough information on the victim to impersonate her to bank customer service to get the password changed.
- jaclaz 4y agoSure, which still means that they managed to get the password. But they neeeded anyway the login (here it is a customer number, usually). I was referencing the parent post because - like everyone else - is talking about SMS interception as one of the major flaws in the authentication process, the way this scam has been carried seems instead to make it (the SMS code) the only thing that would have stopped it (if the victim hadn't revealed it, several times).