4 ms·

I suppose it depends if it's worse than reported currently, but it seems to me that with only 600 accounts losing an average of ~$800 each (and I'm going to go

I suppose it depends if it's worse than reported currently, but it seems to me that with only 600 accounts losing an average of ~$800 each (and I'm going to go out on a limb and assume the users had poor password security), the fast detection and the immediate action to lock it down, there was a good and effective response by the companies attacked

johnisgood 2y ago
How could they really use the money anyways even if they transfer it to another account? I don't know how one could get away with it. Follow the money!
- rmm 2y ago
  Our company was scammed (invoice scam) and talking to police it’s actually easy. They transfer it to another local bank account (normally stolen), then immediately transfer it overseas. At that point it’s more or less gone.
  - johnisgood 2y ago
    Damn, and there is nothing to be done after the transfer to overseas? They would be able to figure out who the perpetrator is, right?
    - bluGill 2y ago
      Depends on what country it goes to. Transfer to major first world countries and the money is still easy to trace. Transfer to Russia and you can't trace it
      - johnisgood 2y ago
        Interesting, thank you. I thought authorities or Governments would work together, but perhaps not.
        anonym29 2y ago
        Geopolitics are still in play. Why would a country that has been hammered with "Western" sanctions, and is effectively engaged in a proxy war against the "West" cooperate with the "West" when it comes to law enforcement? * Australia is part of the "West" here - ironic from a strictly geographic perspective
        syrgian 2y ago
        Can't the Western government strongarm the receiving bank by threatening to kick them out of SEPA/ACH/Fediwire?
        bluGill 2y ago
        There is only so much you can do - you kick them out for everything and thus further cutoff the country and that in turn means you have less influence in the future.
        nilamo 2y ago
        Something so major (global finances), over an issue so minor (fraud on an individual basis)? Serious organizations don't play games like that.
        johnisgood 2y ago
        That is true. I wonder though, if Russian citizens do this in the US, then there is not going to be anything done about it? What if it is an American citizen? I do not expect them to be able to spend it in the US (but I may be wrong). Would they just go to Russia or somewhere else and then use the money from those bank accounts overseas and start a new life, or what? I am just trying to imagine the scenario. I have watched The Wolf of Wall Street which was quite good. I wonder how it would usually go today, and how people get away with it, because one would think today it is not easy to get away with it. I imagine if I were to scam someone, I would get in legal troubles here, in Hungary, even if I were to send it to a bank account somewhere else in another country, is this an incorrect assumption? I am going off-topic here, because Australia is in question here, so perhaps replace my use of "US" with Australia and "American" with "Australian".
    - firefax 2y ago
      >Damn, and there is nothing to be done after the transfer to overseas? You can file an MLAT request https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty But it's a complex, time consuming process usually only done in cases of terrorism or espionage, not run of the mill fraud.
- blitzar 2y ago
  For most people (pre retirement age) the funds are locked in a trust they can barely access themselves. I presume (big if) that those that lost money were retired and payment details for their monthly income was changed to pay to the bad guys accounts.
  - worthless-trash 2y ago
    This was exactly my thoughts, how exactly can the 'bad guys' access it, when people who may need it cant ?
    - blitzar 2y ago
      It is still really bad - (again if it was the case) monitoring very simple things like "# of changed payment" instructions could detect this sort of fraud quickly, or at worst speedbumping the time to change payment instructions. Pre self service on the internet call centers / mail in processors would have noticed if a large % of customers changed their payment details over a few days.
Cyphase 2y ago
> it seems to me that with only 600 accounts losing an average of ~$800 each From the article: > AustralianSuper, the country's largest fund managing A$365 billion for 3.5 million members, said that up to 600 member passwords had been stolen to access accounts and attempt fraud. > Four AustralianSuper members had a combined A$500,000 drained from their balances and transferred to other accounts that did not belong to them, according to the source, who was not authorised to speak publicly about the matter. It's not completely clear if 600 passwords were "stolen" but only four accounts had any money transferred, or if there are more accounts at that fund that had money transferred. And that's just one fund. > Rest Super, the default industry pension fund for retail workers, with A$93 billion of assets under management, said it suffered an attack that impacted around 20,000 accounts, or around 1% of its 2 million members.
- taberiand 2y ago
  Oh you're right, I misread. That's much worse for those 4 people but still not too bad (so far)

johnisgood 2y ago

How could they really use the money anyways even if they transfer it to another account? I don't know how one could get away with it. Follow the money!

rmm 2y ago
Our company was scammed (invoice scam) and talking to police it’s actually easy. They transfer it to another local bank account (normally stolen), then immediately transfer it overseas. At that point it’s more or less gone.
- johnisgood 2y ago
  Damn, and there is nothing to be done after the transfer to overseas? They would be able to figure out who the perpetrator is, right?
  - bluGill 2y ago
    Depends on what country it goes to. Transfer to major first world countries and the money is still easy to trace. Transfer to Russia and you can't trace it
    - johnisgood 2y ago
      Interesting, thank you. I thought authorities or Governments would work together, but perhaps not.
      - anonym29 2y ago
        Geopolitics are still in play. Why would a country that has been hammered with "Western" sanctions, and is effectively engaged in a proxy war against the "West" cooperate with the "West" when it comes to law enforcement? * Australia is part of the "West" here - ironic from a strictly geographic perspective
        syrgian 2y ago
        Can't the Western government strongarm the receiving bank by threatening to kick them out of SEPA/ACH/Fediwire?
        bluGill 2y ago
        There is only so much you can do - you kick them out for everything and thus further cutoff the country and that in turn means you have less influence in the future.
        nilamo 2y ago
        Something so major (global finances), over an issue so minor (fraud on an individual basis)? Serious organizations don't play games like that.
        johnisgood 2y ago
        That is true. I wonder though, if Russian citizens do this in the US, then there is not going to be anything done about it? What if it is an American citizen? I do not expect them to be able to spend it in the US (but I may be wrong). Would they just go to Russia or somewhere else and then use the money from those bank accounts overseas and start a new life, or what? I am just trying to imagine the scenario. I have watched The Wolf of Wall Street which was quite good. I wonder how it would usually go today, and how people get away with it, because one would think today it is not easy to get away with it. I imagine if I were to scam someone, I would get in legal troubles here, in Hungary, even if I were to send it to a bank account somewhere else in another country, is this an incorrect assumption? I am going off-topic here, because Australia is in question here, so perhaps replace my use of "US" with Australia and "American" with "Australian".
  - firefax 2y ago
    >Damn, and there is nothing to be done after the transfer to overseas? You can file an MLAT request https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty But it's a complex, time consuming process usually only done in cases of terrorism or espionage, not run of the mill fraud.
blitzar 2y ago
For most people (pre retirement age) the funds are locked in a trust they can barely access themselves. I presume (big if) that those that lost money were retired and payment details for their monthly income was changed to pay to the bad guys accounts.
- worthless-trash 2y ago
  This was exactly my thoughts, how exactly can the 'bad guys' access it, when people who may need it cant ?
  - blitzar 2y ago
    It is still really bad - (again if it was the case) monitoring very simple things like "# of changed payment" instructions could detect this sort of fraud quickly, or at worst speedbumping the time to change payment instructions. Pre self service on the internet call centers / mail in processors would have noticed if a large % of customers changed their payment details over a few days.

Cyphase 2y ago

> it seems to me that with only 600 accounts losing an average of ~$800 each From the article: > AustralianSuper, the country's largest fund managing A$365 billion for 3.5 million members, said that up to 600 member passwords had been stolen to access accounts and attempt fraud. > Four AustralianSuper members had a combined A$500,000 drained from their balances and transferred to other accounts that did not belong to them, according to the source, who was not authorised to speak publicly about the matter. It's not completely clear if 600 passwords were "stolen" but only four accounts had any money transferred, or if there are more accounts at that fund that had money transferred. And that's just one fund. > Rest Super, the default industry pension fund for retail workers, with A$93 billion of assets under management, said it suffered an attack that impacted around 20,000 accounts, or around 1% of its 2 million members.

taberiand 2y ago
Oh you're right, I misread. That's much worse for those 4 people but still not too bad (so far)