Rewterz Threat Advisory – Malicious Callers Spoofing Bank Numbers

This is an advisory on attempts of obtaining card information of clients spoofing a bank’s number.

IMPACT:  NORMAL

PUBLISH DATE: 23-06-2018

OVERVIEW

A member has reported a suspicious call to a client, attempting to social engineer their credit card information. The bad  actor spoofed the main number of the organization to appear credible to the client.

Spoofing or faking an identity is used to trick users into releasing sensitive information in order to gain access to their bank account, computer system or to steal personal credentials like passwords.

Social Engineering involves psychologically manipulating people to produce sensitive and confidential information.

 BACKGROUND INFORMATION

Earlier this week, a member reported that their client had received a call from someone spoofing the main telephone number of the bank. In an attempt to obtain credit card information of the client, the caller used social engineering to convince the client about their authenticity.

The member reports that no sensitive information was provided to the caller.

IMPACT ANALYSIS

Too many cases of spoofing are being reported worldwide. Spoofing is not illegal if an organization wants to use the same number for all lines they’re using. When involved in unlawful activities like faking an identity to gain access to confidential information, spoofing is illegal.

Mostly, it is used to fake a bank’s identity for theft from bank accounts. Millions of dollars have been compromised and stolen from bank accounts using spoofing.

It can also be used to ruin the reputation of a person or an organization.

RESOLVE

As many experts reveal, there’s no specific solution to telephone-number spoofing or  Caller-ID spoofing. It can be dodged with awareness and quick judgement.

It is important for clients to understand that most organizations won’t call a client asking for personal information or sensitive information, as they should already be having that information.

Tips against spoofing

• Be sure to always log out of all the accounts when not actively using them. This will prevent irrelevant people from sneaking into your personal information and credentials.

• When a caller sounds fishy on the phone and asks for confidential information, tell them that you’ll return the call. When you call the number, it’ll be directed to the original owner of the number rather than the fake caller. Then you can inquire about the call you received.

If you think you are a victim of a cyber-security attack. Immediately send an email to info@rewterz.com for a rapid response.