Credit card

Security breaches are become a common thing these days. They hit the front page only when the size or importance of the breach become huge. The recent security breach at the Global Payments made its way to the front page for the oblivious reason, which is nothing but the size of the breach.

Initially the size of the breach is estimated to be 10 million, later it identified as 1.5 million credit cards are affected. Even a security breach of 1.5 million credit cards is not a good news for any credit card holder.You and I are possible victims of this security breach. Visa has issued the following statement about the breach

.Visa Inc. is aware of a potential data compromise incident at a third party entity affecting card account information from all major card brands. There has been no breach of Visa systems, including its core processing network VisaNet.

Visa has provided payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring and, if needed, reissuing cards.

It.s important for U.S. Visa consumer cardholders to know they are protected against fraudulent purchases with Visa.s zero liability fraud protection policy, which exceeds federal safeguards. As always, Visa encourages cardholders to regularly monitor their accounts and to notify their issuing financial institution promptly of any unusual activity. Additional consumer security tips are available at www.VisaSecuritySense.com.

Every business that handles payment card information is expected to protect the security and privacy of their customers. financial information by adhering to the highest data protection standards. Visa also supports advanced security layers such as encryption, tokenization and dynamic authentication through EMV chip technology to further protect sensitive account information and minimize the impact of data compromises..

Global Payments said in a statement that while enough data was taken from each account to make fraudulent transactions, the cardholders. .names, addresses and social security numbers were not obtained by the criminals,. which may limit how the stolen data can be used.

How did it impact Global Payments

Trading has now been halted in Global Payments. stock. The stock has fallen down by 9% before that.
The card company removed Global Payments from its list of .approved. processors Sunday, a move that doesn.t prevent vendors who use the payment processor from making Visa transactions, but may damage the processor.s reputation among its customers.
VISA strips PCI Compliance status from Global Payments
Penalties would be imposed on Global Payments in due course of time.

It is rumoured that the breach includes card numbers and track data. As per the PCI compliance requirements, the track data should not be stored. If it is not being stored, as they used to be PCI compliant, how is that a hacker obtain the same? Web based transactions never uses track data and the only possible area of compromise is the POS based transactions. As they are not expected to store the track data, the only possible way is to obtain the same during transmission. Now the other catch, PCI demands encryption for transmission when data is transmitted over public networks.

It would be interesting to see how the attackers got this data, if the rumour turns to be true.

In the recent days, we have seen many emails claiming to be from your bank and asking you to provide the user name, password, ATM Number PIN etc… First of all let me emphasize the fact that these are fake emails. Banks or any other responsible companies will never ask for these details of yours for any reason.

Let me reiterate that never ever respond to such emails. Do not click on the links in these emails as this will lead to fake sites. Entering your online banking username and password to these fake sites will make an attacker to take control of your account and withdraw all the money you have in your account. This scam is normally known as Phishing

I will post another post on the phishing later. In this post, I would like to emphasize the money mule scam which is the hidden side of the phishing.

Extract from Wikipedia about money mules

“Money mule is a person who transfers money and reships high value goods that have been fraudulently obtained in one country, usually via the internet, to another country, usually where the perpetrator of the fraud lives.
The need for money mules arises because while a criminal in a developing country can obtain the credit card numbers, bank account numbers, passwords and other financial details of a victim living in the first world via the internet through techniques such as malware and phishing, turning those details into money usable in the criminal’s own country can be difficult. Many businesses will refuse to transfer money or ship goods to certain countries where there is a high likelihood that the transaction is fraudulent. The criminal therefore recruits a money mule in the victim’s country who will receive money transfers and merchandise and resend them to the criminal in return for a commission”

There are various stages where people are recruited as money mules

First stage is to advertise the job vacancies, usually the work from home scheme. The advertisements will appear in major employment portals and job sites as well as free classifieds sites offering stay at home positions such as financial representative, Fund manager, regional assistant etc… Occasionally these recruitment drive will have well defined company websites which will boost the trust of the person applying for these kind of jobs.

Typical responsibilities of a mule is to transfer the money which is coming into his/her account to an account of the so called company. The mule might have been informed that these transactions are genuine transactions and to fast track these transaction the company needs a financial representative.

Below is a sample email of a typical mule recruitment

We are a small Software Development Company. The company based in Ukraine but at this time we open new office in Bulgaria. We.ve earned ourselves a reputation of a reliable and trustworthy partner working successfully with a number of West European and North American copmanies and providing them with reliable softwaredevelopment services in financial, telecom and media sectors.

Unfortunately we are currently facing some difficulties with receiving payments for our services. It usually takes us 10-30 days to receive a payment from your country and such delays are harmful to uor business.We do not have so much time to accept every wire transfer and we can’t accept cashier.s checks or money orders as well. That.s why we are currently looking for partners in your country to help us accept and process these payments faster.If you are looking for a chance to make an additional profit you can become our representative in your country. As our representative you will receive 8% of every deal we conduct. Your job will be accepting funds in the form of wire transfers and check payments and forwarding them to us. ……

Looking forward to hearing from you.
Sincerely,
Kerri Knight
Director of Electronics

How true it is; isn’t it?

So the end to end actions are like this. Attacker gets a users online banking account using phishing or viruses. Then they recruit the money mules and gets the bank account details of the mule. Once it is done, then they will use the online banking details of the user obtained through phishing (not the mule) to login to the banking site and transfer the money to Mule’s account. Mule believes it as the financial transaction from the parent companies customer and transfers the money after deducting the commission normally through western union or similar service.

So far everything is cool. Now the real problem happens for the mule. The bank’s customer who lost the money registers the compliant with the banks / police. Investigation will show that the money is transferred to the Mule’s account. Mule is caught and asked to pay the money back in full and/or face legal consequences.

This post is gone beyond the length what I have thought, so let me stop here.

The three things you should remember and if possible follow are given below.

Never ever click through some links in email to access your online banking
Always be cautious about the additional income jobs and never be a carrier for the money.
Always run an antivirus on your PC and update it.

Global Payments breach.initial review

How did it impact Global Payments

Money Mules