Photo credit: www.businessinsider.com
Rising Threat of Account Takeover Scams: A Personal Account
Account takeover scams are increasingly affecting individuals, including those with expertise in the finance sector. A former executive from Mastercard recounted her close encounter with losing a substantial sum to such a scam.
Catherine Woneis, who was previously the vice president of CipherTrace, a Mastercard service specializing in securing cryptocurrency transactions, revealed that she nearly lost $100,000 when cybercriminals hacked into her real estate agent’s email account.
Account takeover fraud occurs when criminals gain unauthorized access to personal accounts such as social media, email, or banking sites. Typically, this is achieved either through stolen credentials obtained from the dark web or via social engineering techniques that trick individuals into revealing their passwords. Once criminals have access, they can initiate unauthorized transactions, draining victims of their hard-earned money.
The prevalence of such scams has surged dramatically, with a 354% increase reported in 2023, leading to losses amounting to a staggering $13 billion, as detailed in a report by the AI fraud detection service Sift Science.
In Woneis’s situation, the scammers employed a method known as “credential stuffing,” utilizing automated bots to test multiple username and password combinations until they successfully accessed the real estate agent’s email. Using information gleaned from this compromised email, the fraudsters posed as a title company involved in Woneis’s property transaction, contacting her with a request for an “accelerated” payment.
Woneis emphasized that urgency is a common tactic used by scammers. “They try to implement some time pressure,” she noted. Upon receiving the email, she checked the sender’s address and observed an additional appended address. Misinterpreting it as part of an automated system from the legitimate company, she didn’t raise any alarms.
The scammers provided wire instructions that closely mimicked those typically issued by the actual title company. “They had the exact typography, the same letterhead—and everything looked authentic,” Woneis remarked. However, the wire instructions included a fake phone number and email, and incorrect banking details.
Fortunately, Woneis chose to verify the authenticity of the instructions by contacting the phone number from her prior communications with the title company. She quickly learned that the banking information provided was indeed fraudulent. “Had I been in a rush and called the phone number on the form, they would have guided me into believing it was legitimate, potentially leading to a wire fraud situation,” she reflected.
If the transaction had proceeded, Woneis would have faced a loss of nearly $100,000.
Now, with a new position at a cybersecurity firm called Fingerprint, Woneis is involved in developing solutions to counteract the increasing threat of account takeovers. She highlighted the importance of utilizing algorithms to analyze the geographical location of website visitors (particularly when they use VPNs) and systems that can detect automated login attempts.
For those who suspect their online accounts may be compromised, Woneis advises taking swift action: change all usernames and passwords, enable two-factor authentication for sensitive accounts, and report any fraudulent activities through the FTC fraud reporting website.
Source
www.businessinsider.com