Getting bank card PIN from phone/wallet theft?

soundb0y said:
Any idea if they could have been sophisticated enough to try and take her prints from the locker and somehow use that to open her phone? Or is that beyond reason?

Hate it when stories like this come out but don't include a big part of how.
Click to expand...
Unless she's running an old iPhone it won't have a FPS
 
Malevolence said:
Have a look at what billy_tables says in this thread

Reddit - Dive into anything

www.reddit.com www.reddit.com
Click to expand...
Oooffff, wtf. If true then that is seriously terrible security from santander.

Billy's method, which he claims to have tested on his account: put the sim in a new phone and download the santander app then apparently it lets you do forgot my 'personal id' using details from say a driving licence you may have nicked in a wallet. Then 'forgot my password' which will send a verification code to the phone number of the phone which you are currently using. Voila.

Surely even using email verification rather than / as well as text message, and requiring extra checks if you're using a new device would be some pretty simple changes which would avoid this particular vulnerability.
 
Hahaha what the hell?!

Personal ID
This may be referred to as your Customer ID or Personal ID.

If you are still using your 16-digit card number as your ID, you may change this to an easier to remember ID once you have logged on.
Click to expand...

Santander Online Banking

retail.santander.co.uk retail.santander.co.uk



So you have the card = personal ID

Or if they've changed the personal ID you can do forgotten personal ID process - https://retail.santander.co.uk/RESCUK_NS_ENS/ChannelDriver.ssobto?dse_operationName=mainReaccess

Which only seems to need D.O.B and post code, which as @cheesefest says would be on driving license. Then you've got personal ID,

Then to reset online banking you seemingly just need personal ID and access to SMS for mobile number. There's no additional checks after that - https://retail.santander.co.uk/olb/app/reset/#/pid
 
Are the other banks apps have similar security issues with their apps? Needs a third layer of security.

One security thing I hate companies use is mothers maiden name. Why?
. Siblings share the same MMN
. As well as children from your mother’s
sister(s)
. Single mothers usually change their children’s surnames to their own. So answer is their surname!
. Can get this from the internet easily.

Also place of birth is not a good security option either esp to those who have families who never moved and live in the same city/town as they were born in.
 
The Media reporting has been really terrible... They made it sound like it was essentially a case of santander paying her off to be quiet, but actually there is a pretty massive security hole, and readi g the twitter thread they were very slow to act on her information even after reporting it to them, twice trying to ring her stolen mobile before blocking the card!

I bet there's more to this failure of access control at the gym too - either some kind of insider assistance or poorly thought out design...
 
What are Virgin Active lockers locked with? A key? A personal padlock? Fingerprint?

When I go to my gym, we use lockers which put a pound coin in the back which when unlocks, pound cones out at the bottom. Keep key safety pinned onto t-shirt.

Padlocked can be cut with cutters.
 
Dangerous Dave said:
once you have the phone pin you can access security on the phone to add a new face/finger print then once added use the newly added details to access the banking app where some banks do allow you to access your current pin.
Click to expand...

This wouldn't necessarily work - depending on the banking app/phone at least.

When I've changed the biometrics on my phone (Huawei P30 Pro) - e.g. added a new fingerprint, most of the apps I had set up to use it forced me to re-enter my credentials and re-confirm that I wanted to use fingerprint authentication, I presume for exactly this reason.

Perhaps a flaw in the Santander app that it doesn't do this? Or an Apple/iPhone thing?
 
GreatAuk said:
Then 'forgot my password' which will send a verification code to the phone number of the phone which you are currently using. Voila.
Click to expand...
Hm. I’m not sure about this bit. How does the Santander app know the phone number of the new SIM card you just put in? Surely they would just message your number in file (also problematic if phone is 100% in the thief’s control)
 
Haggisman said:
Perhaps a flaw in the Santander app that it doesn't do this? Or an Apple/iPhone thing?
Click to expand...
A seemingly valid hack was described in earlier post .. courtesy of transplanting the sim.

would be interesting to see the Which report
www.which.co.uk

Banking security put to the test: could your bank be doing more to stop fraud? - Which? News

A Which? Money investigation has identified weaknesses in some banks' online and mobile banking security, which could be exploited by criminals
www.which.co.uk www.which.co.uk
All banks must now carry out extra checks known as 'strong customer authentication' to verify your identity. As part of these checks some banks send security codes by SMS, but we want them to stop doing so because messages can be hijacked by cybercriminals through Sim-swap attacks.
Click to expand...
www.which.co.uk

Sim-swap fraud: how criminals hijack your number to get into your bank accounts - Which? News

Reports of Sim-swap fraud have gone up by 400% in five years
www.which.co.uk www.which.co.uk
prior art.
e: not exactly same kind of sim swap - but similar implication
 
Scam said:
Hm. I’m not sure about this bit. How does the Santander app know the phone number of the new SIM card you just put in? Surely they would just message your number in file (also problematic if phone is 100% in the thief’s control)
Click to expand...
If you have taken the sim out of the original phone and out it in your new phone then your new phone will now have the same number that they have on file.
 
GreatAuk said:
Oooffff, wtf. If true then that is seriously terrible security from santander.

Billy's method, which he claims to have tested on his account: put the sim in a new phone and download the santander app then apparently it lets you do forgot my 'personal id' using details from say a driving licence you may have nicked in a wallet. Then 'forgot my password' which will send a verification code to the phone number of the phone which you are currently using. Voila.

Surely even using email verification rather than / as well as text message, and requiring extra checks if you're using a new device would be some pretty simple changes which would avoid this particular vulnerability.
Click to expand...

Yep, I tested it yesterday with my Satander account and had found my ID, reset the password and got on to the app to view my PIN in under 5 minutes. All you need is the SIM card, bank card and ID with date of birth on, which presumably, were stolen along with her phone. Pretty shocking security wise! It never occurred to me before and I was wondering how they'd got around the iPhone lock/biometrics etc.
 
You must log in or register to reply here.
Back
Top Bottom