5 ms·

Hindsight? When I test our app, I don't use my CC, I ask the company for one or for mock data that would pass through the production system. I would never use m

Hindsight? When I test our app, I don't use my CC, I ask the company for one or for mock data that would pass through the production system. I would never use my personal information to tie my personal finances to my employer for a work task. That's just setting yourself up for problems like your friend found.

0cf8612b2e1e 3y ago
Considering how much personal data you have to give to a legitimate employer, seems like the scammers just invoked a lot of unnecessary effort in making the applicant fill out the loan paperwork themselves.
- ShittyKickflips 3y ago
  Difference might be in voluntarily making bank account and applying for loan and impersonating person. One might be punishable as criminal offence, other as minor scam (not sure about proper legal terms). Also in certain jurisdictions it makes sense as different police units investigating certain crimes and scammers might be connected.
pflenker 3y ago
The trick here was that of course my friend did not use her own sensitive bank information to ask for the loan - she asked for test data, and the company provided her with data. What she did not realize is that the data they fed her were things she had created in her own name earlier in the scam. For example, she opened a bank account in her own name quite early, after some trust was built. The data she used for that didn’t seem that sensitive to her, and she made sure the account was not a paid one and so on. And she was right - that account in itself was not what screwed her over. Days to weeks, and dozens of assignments, later when she applied for the loan, the test data they provided to her upon her request were partly from that opening of a bank account. So from her perspective it was a competely new flow to test for an existing customer - the bank - with test data provided. They even changed the login data a bit so that it looked like a different account. Since this was framed to der as a test as close to reality as possible it didn’t seem off that the „test account“ showed her her own name. From the perspective of the bank it was an existing, verified customer applying for a loan. This was a really, really clever bit of social engineering.
- ithkuil 3y ago
  I don't understand. What prevented the scammers from just performing all the same operations she performed using the data they had about her? They could have her run some gateway on her laptop so all network access would appear to come from her IP address. Is there some offline interaction that is required to open an account?
  - dylan604 3y ago
    plausible deniability? why commit the crime yourself when you can have someone else do it for you? also, the loan would probably only be offered to a US citizen while the scammers were most likely not. after reading about it, it sounds like a pretty good operation
    - chatmasta 3y ago
      Also if the bank requires any KYC process, she'll probably go through with it thinking that it's part of the "external test."
  - kqr 3y ago
    Maybe specifically to make it more shameful to make it less likely to be reported?
    - dclowd9901 3y ago
      What makes it even _less_ likely is not bringing in a third party at all. I too do not understand the angle here vs the crooks just doing it themselves.
      - _xivi 3y ago
        If you don't bring any 3rd party, that mean more direct exposure for yourself
  - chefandy 3y ago
    For the same reason people who steal credit card numbers sell them rather than use them, why illegal drug distributors don't sell to users directly, and mob bosses don't rob people: They can probably do the same thing at the same time with multiple people, and it reduces their risk exposure. If 10 different people open up a bank account with stolen credentials, the bank has to detect fraud 10 different times. If one person opens up 10 bank accounts with stolen credentials, they're way more likely to catch onto a subtle pattern.
riizade 3y ago
Same. Expedia asked me to test production ticket booking flows using my personal credit card. It was a flow where you can use a special code to book a refundable ticket. I asked what happened if I forgot to refund it in time, or if something went wrong. "Don't forget!" I asked for a corporate card to test with and was denied. I refused to ever input my personal card. I think the team lead said I could use his, but I refused to use anyone's actual, real card. I was young at the time, and I'm glad I saw the red flags quickly enough and left.
williamcotton 3y ago
You probably don’t need ask anyone as I’ve found these almost always work in practice: https://developers.bluesnap.com/reference/test-credit-cards https://developers.bluesnap.com/reference/test-credit-cards

0cf8612b2e1e 3y ago

Considering how much personal data you have to give to a legitimate employer, seems like the scammers just invoked a lot of unnecessary effort in making the applicant fill out the loan paperwork themselves.

ShittyKickflips 3y ago
Difference might be in voluntarily making bank account and applying for loan and impersonating person. One might be punishable as criminal offence, other as minor scam (not sure about proper legal terms). Also in certain jurisdictions it makes sense as different police units investigating certain crimes and scammers might be connected.

pflenker 3y ago

The trick here was that of course my friend did not use her own sensitive bank information to ask for the loan - she asked for test data, and the company provided her with data. What she did not realize is that the data they fed her were things she had created in her own name earlier in the scam. For example, she opened a bank account in her own name quite early, after some trust was built. The data she used for that didn’t seem that sensitive to her, and she made sure the account was not a paid one and so on. And she was right - that account in itself was not what screwed her over. Days to weeks, and dozens of assignments, later when she applied for the loan, the test data they provided to her upon her request were partly from that opening of a bank account. So from her perspective it was a competely new flow to test for an existing customer - the bank - with test data provided. They even changed the login data a bit so that it looked like a different account. Since this was framed to der as a test as close to reality as possible it didn’t seem off that the „test account“ showed her her own name. From the perspective of the bank it was an existing, verified customer applying for a loan. This was a really, really clever bit of social engineering.

ithkuil 3y ago
I don't understand. What prevented the scammers from just performing all the same operations she performed using the data they had about her? They could have her run some gateway on her laptop so all network access would appear to come from her IP address. Is there some offline interaction that is required to open an account?
- dylan604 3y ago
  plausible deniability? why commit the crime yourself when you can have someone else do it for you? also, the loan would probably only be offered to a US citizen while the scammers were most likely not. after reading about it, it sounds like a pretty good operation
  - chatmasta 3y ago
    Also if the bank requires any KYC process, she'll probably go through with it thinking that it's part of the "external test."
- kqr 3y ago
  Maybe specifically to make it more shameful to make it less likely to be reported?
  - dclowd9901 3y ago
    What makes it even _less_ likely is not bringing in a third party at all. I too do not understand the angle here vs the crooks just doing it themselves.
    - _xivi 3y ago
      If you don't bring any 3rd party, that mean more direct exposure for yourself
- chefandy 3y ago
  For the same reason people who steal credit card numbers sell them rather than use them, why illegal drug distributors don't sell to users directly, and mob bosses don't rob people: They can probably do the same thing at the same time with multiple people, and it reduces their risk exposure. If 10 different people open up a bank account with stolen credentials, the bank has to detect fraud 10 different times. If one person opens up 10 bank accounts with stolen credentials, they're way more likely to catch onto a subtle pattern.

riizade 3y ago

Same. Expedia asked me to test production ticket booking flows using my personal credit card. It was a flow where you can use a special code to book a refundable ticket. I asked what happened if I forgot to refund it in time, or if something went wrong. "Don't forget!" I asked for a corporate card to test with and was denied. I refused to ever input my personal card. I think the team lead said I could use his, but I refused to use anyone's actual, real card. I was young at the time, and I'm glad I saw the red flags quickly enough and left.

williamcotton 3y ago

You probably don’t need ask anyone as I’ve found these almost always work in practice: https://developers.bluesnap.com/reference/test-credit-cards https://developers.bluesnap.com/reference/test-credit-cards