PayPal - or your bank, or Amazon, or whoever - actually did just text you a code. Now the bot, on the phone, says that to complete this “security verification” or whatever, just enter the code they just sent you via text. When the call starts, the bot enters the target’s email address and password on the site, which results in the site sending a 2FA code via SMS to the victim. Let’s say the crooks know (or just guess) your email address and password for the service they’re targeting - quite possibly because the email/password combination appeared in one of the many major data leaks in recent years. The bot triggers an actual 2FA code to be sent to the victim. Cox has a recording of one such bot in his report. That these bots sound obviously robotic is a feature, not a bug.
We’ve normalized talking to robots on the phone, and these bots are taking advantage of that. But a lot of legitimate voice-driven phone systems sound like bots. There’s no uncanny valley here - the bots are clearly bots. So the Caller ID the victim sees might say something like “PayPal Inc.” or “Bank of America”. The bot calls you, the victim, using a faked Caller ID. Letting them log in or authorize cash transfers. To trick victims into giving up their multi-factor authenticationĬodes or one-time passwords (OTPs) for all sorts of services, Type of bot that drastically streamlines the process for hackers You may now hang up,” the voice said.īut this call was actually from a hacker. “Don’t worry if any payment has been charged to your account: we AfterĮntering a string of six digits, the voice said, “Thank you, yourĪccount has been secured and this request has been blocked.” Texts users a code in order to protect their account. Sent your mobile device now,” the voice said. “In order to secure your account, please enter the code we have Tried to use my PayPal account to spend $58.82, according to theĪutomated voice on the line. The call came from PayPal’s fraud prevention system. ‘The Booming Underground Market for Bots That Steal Your 2FA Codes’ ★įascinating report from Joseph Cox for Motherboard:
0 kommentar(er)
