Dec 20, 2020 9:00 AM

A Massive Fraud Operation Stole Millions From Online Bank Accounts

The crooks used emulators to mimic the phones of more than 16,000 customers whose mobile bank accounts had been compromised.

Image may contain Light Flare Couch Furniture Human Person and Lighting

Researchers from IBM Trusteer say they’ve uncovered a massive fraud operation that used a network of mobile device emulators to drain millions of dollars from online bank accounts in a matter of days.

The scale of the operation was unlike anything the researchers have seen before. In one case, crooks used about 20 emulators to mimic more than 16,000 phones belonging to customers whose mobile bank accounts had been compromised. In a separate case, a single emulator was able to spoof more than 8,100 devices.

The thieves then entered usernames and passwords into banking apps running on the emulators and initiated fraudulent money orders that siphoned funds out of the compromised accounts. Emulators are used by legitimate developers and researchers to test how apps run on a variety of different mobile devices.

To bypass protections banks use to block such attacks, the crooks used device identifiers corresponding to each compromised account holder and spoofed GPS locations the device was known to use. The device IDs were likely obtained from the holders’ hacked devices, although in some cases, the fraudsters gave the appearance that they were customers who were accessing their accounts from new phones. The attackers were also able to bypass multi-factor authentication by accessing SMS messages.

Automating Fraud

“This mobile fraud operation managed to automate the process of accessing accounts, initiating a transaction, receiving and stealing a second factor (SMS in this case), and in many cases using those codes to complete illicit transactions,” IBM Trusteer researchers Shachar Gritzman and Limor Kessem wrote in a post. “The data sources, scripts, and customized applications the gang created flowed in one automated process which provided speed that allowed them to rob millions of dollars from each victimized bank within a matter of days.”

Each time the crooks successfully drained an account, they would retire the spoofed device that accessed the account and replace it with a new device. The attackers also cycled through devices in the event that they were rejected by a bank’s anti fraud system. Over time, IBM Trusteer saw the operators launch distinct attack legs. After one was over, the attackers would shut down the operation, wipe data traces, and begin a new one.

The researchers believe that bank accounts were compromised using either malware or phishing attacks. The IBM Trusteer report doesn’t explain how the crooks managed to steal SMS messages and device IDs. The banks were located in the US and Europe.

To monitor the progress of operations in real time, the crooks intercepted communications between the spoofed devices and the banks’ application servers. The attackers also used logs and screenshots to track the operation over time. As the operation progressed, the researchers saw the attack techniques evolve as the crooks learned from previous mistakes.

The operation raises the usual security advice about using strong passwords, learning how to spot phishing scams, and keeping devices free of malware. It would be nice if banks provided multi factor authentication through a medium other than SMS, but few financial institutions do. People should review their bank statements at least once a month to look for fraudulent transactions.

This story originally appeared on Ars Technica.