article thumbnail

Recycle Your Phone, Sure, But Maybe Not Your Number

Krebs on Security

New research shows how fraudsters can abuse wireless provider websites to identify available, recycled mobile numbers that allow password resets at a range of email providers and financial services online. “The moderate to high hit rates of our testing methods indicate that most recycled numbers are vulnerable to these attacks.

Mobile 339
article thumbnail

Scary Fraud Ensues When ID Theft & Usury Collide

Krebs on Security

27 — Thanksgiving Day weekend — Jim got a series of rapid-fire emails from MSF saying they’ve received his loan application, that they’d approved it, and that the funds requested were now available at the bank account specified in his MSF profile. Then on Nov. Take a look at that 546.56 A portion of the Jan.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Would You Have Fallen for This Phone Scam?

Krebs on Security

You may have heard that today’s phone fraudsters like to use use caller ID spoofing services to make their scam calls seem more believable. “After we figured out what was going on, we were left asking ourselves how the crooks had obtained her last three transactions without breaking into her account online. .

Scams 355
article thumbnail

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Krebs on Security

Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself. Department of Defense. USDoD’s InfraGard sales thread on Breached.

Hacking 359
article thumbnail

Disneyland Malware Team: It’s a Puny World After All

Krebs on Security

financial services firm Ameriprise uses the domain ameriprise.com; the Disneyland Team’s domain for Ameriprise customers is [link] [brackets added to defang the domain], which displays in the browser URL bar as ? .” It also has other options for stalling victims whilst their accounts are drained. Bank customers.

Malware 257
article thumbnail

The Rise of One-Time Password Interception Bots

Krebs on Security

The idea is that even if the user’s password gets stolen, the attacker still can’t access the user’s account without that second factor — i.e. without access to the victim’s mobile device or phone number. The OTP interception service featured earlier this year — Otp[.]agency

Passwords 311
article thumbnail

Who’s Behind the ‘Web Listings’ Mail Scam?

Krebs on Security

A Twitter account for Web Listings Inc. has posts dating back to 2010, and points to even more Web Listings domains, including weblistingsinc.org. At some point, each of these domains changes the owner’s name from James Madison to “ Mark Carter.” Image: Better Business Bureau.

Scams 250