Reply to thread

Message: <blockquote data-quote="NEMISIS" data-source="post: 30945660" data-attributes="member: 494668">pretty much yes. there are some other practicle tricks to get both login otp and transaction otp from the user.User goes to the fake site > Enter credentials > triggers the attacker to login with credentials > user gets the otp > submits the otp > attacker gets the otp but the take site take a long time to submit the otp/keep showing the loading screen (this is a deliberate by the attacker) > attacker login with the otp > immediately start a transaction( usually a new transaction otp says this is for a transaction, so most likely the attacker can add his account as a registered account in the portal *more details at the end of the post) > the the fake site says your otp is incorrect and submit the new otp sent (the new otp is the transaction or new account add otp) > user submits it and game over. other thing is some banking apps does not allow login from two different locations(two login sessions), if an attacker take over an account and keep using it, the real user has no way of login to the account until the attacker logs out. I think banks have disabled multiple login attempts as a security mechanism, but it could work in favor of the attacker. *more details at the end of the postabout this. Attacker never gets the money in to his own account. Attacker always has few contacts with shops (usually sellers from clarified sites, or facebook market place) they already have account numbers of some shops or sellers, and attacker transfer the money to those clueless sellers, they will send the item to the attacker. or there could be another layer (like a drop-shipping the item to someone else). It is very hard to track down the real attcker.</blockquote>

Verification: Payakata winadi keeyak tibeda?

Top Bottom