Awas, Beredar Aplikasi Peretas Berkedok Undangan Pernikahan

CNN Indonesia

30 Jan 202311:39

Summary

TLDRThe script discusses a new digital banking scam involving fraudsters using fake wedding invitations sent via WhatsApp to trick victims into downloading malware that intercepts SMS OTPs, facilitating the transfer of mobile banking accounts to the fraudsters. It highlights the importance of public awareness against clicking suspicious links and installing apps from outside the Play Store. The conversation also touches on the need for banks to strengthen security measures, including the implementation of 'What you have' verification methods to prevent unauthorized account transfers.

Takeaways

📲 The script discusses a new mode of banking crime involving digital deception through WhatsApp invitations to weddings, aiming to compromise mobile banking security.
🔒 The criminals require an SMS OTP (One-Time Password) to transfer the victim's mobile banking account to their own account, highlighting the importance of OTP security.
🚫 It is advised not to click on suspicious links or install applications from outside the Play Store, as this could inadvertently grant SMS access to fraudsters.
🔄 The script mentions that the criminals have shifted their tactics from using courier packages to wedding invitations and then to BPJS (Indonesian Health Insurance) bills to trick victims into revealing their OTP.
🤖 The term 'sniffing' is clarified as stealing transactions that pass through communication channels like WhatsApp or the internet, which is different from the current method of SMS forwarding.
🛡️ The need for additional security measures beyond OTP is emphasized, suggesting the use of 'What you have' verification methods, such as requiring a physical item like an ATM card.
👥 The script points out that the data stolen in 2022 has likely spread among fraudsters, indicating that social engineering and profiling of potential victims are common tactics.
🔑 It is suggested that if one's data has been compromised, they should immediately change their mobile banking passwords and PINs to prevent unauthorized access.
🏦 The banking institutions are urged to improve their security systems and consider implementing 'What you have' verification for account transfers to prevent fraud.
📈 There is a call for the OJK (Indonesian Financial Services Authority) to standardize and enforce better security measures for mobile banking services.
🌐 The script highlights the low level of cybersecurity literacy among the general public in Indonesia and the need for better protection and awareness.

Q & A

What is the new method of banking crime discussed in the script?
-The new method of banking crime discussed involves scammers using digital invitations, such as for a wedding, sent via WhatsApp to hack into mobile banking accounts.
How do scammers obtain the SMS OTP needed for transferring mobile banking accounts?
-Scammers send files in Android package or APK format to trick victims into installing applications that forward SMS OTPs to the scammers' devices, allowing them to transfer the banking accounts.
What is the difference between the new scam method and traditional phishing attacks?
-The new scam method is an evolution of phishing where scammers no longer need to send packages or pretend to be couriers; they use digital invitations and other social engineering tactics to trick victims into providing their OTPs.
Is this new scam method considered 'sniffing' or 'RAT' (Remote Access Trojan)?
-No, this method is not considered sniffing or RAT. It is categorized as SMS forwarding, which is less sophisticated but still effective in stealing banking information.
What additional security measures are recommended for banks to prevent such scams?
-Banks are recommended to implement 'What you have' verification methods, such as requiring a physical visit to an ATM or bank with an ATM card or ID for any account number changes, to supplement the OTP security.
Why is the OTP via SMS considered the weakest form of OTP security?
-The OTP via SMS is considered the weakest because it involves a third party and can be intercepted by malicious applications designed to format or steal SMS messages.
What is the role of social engineering in this new scam method?
-Social engineering plays a significant role as scammers impersonate banks or other institutions to trick victims into filling out forms that collect their user IDs, passwords, and PINs.
How can the public protect themselves from falling victim to this scam?
-The public should be cautious about clicking on links or installing apps from outside the Play Store, and always verify requests for OTPs and app permissions before granting them.
What is the importance of 'What you have' verification in the context of mobile banking security?
-'What you have' verification, such as requiring a physical token or card, adds an extra layer of security by ensuring that the person attempting the transaction has a unique, non-transferable item in their possession.
What actions should individuals take if they suspect their banking information has been compromised?
-Individuals should immediately change their passwords and PINs for mobile banking and consider changing their mobile banking accounts if they are unsure of the security measures in place by their bank.
What is the role of the financial regulatory authority in addressing this new scam method?
-The financial regulatory authority, such as OJK in Indonesia, should standardize and enforce strict security measures, including 'What you have' verification, to ensure the safety of mobile banking transactions.

Outlines

00:00

🔒 New Digital Banking Fraud Tactics

The paragraph discusses the emergence of a new method of digital banking fraud involving the use of wedding invitations sent via WhatsApp as a means to compromise mobile banking systems. The fraudsters aim to intercept SMS OTPs to transfer the victim's mobile banking account to their own account. The speaker, an expert in cybersecurity and digital forensics, warns the public not to easily click on suspicious links or install apps from outside the Play Store, as these actions could inadvertently grant the fraudsters access to their banking details. The paragraph also touches on the importance of not just relying on SMS OTP for security, but also using additional authentication methods such as user ID, password, and PIN for transferring accounts.

05:00

📲 Countermeasures Against Mobile Banking Fraud

This paragraph delves into the importance of improving the security measures of mobile banking systems. It highlights the need for banks to implement 'What you have' authentication methods, such as requiring the physical presence of an ATM card or personal identification documents when transferring mobile banking to a new device. The speaker suggests that this would prevent fraudsters from taking over accounts, even if they have the necessary credentials and SMS OTP. The paragraph also calls for the standardization of security measures by regulatory bodies and urges the public to be cautious about installing apps and granting SMS access to unknown applications.

10:01

🚨 Public Awareness and Long-term Protection Strategies

The final paragraph emphasizes the need for public awareness about the potential spread of personal data and banking information among fraudsters. It advises individuals to change their mobile banking passwords and PINs as a precautionary measure if they suspect their data may have been compromised. Additionally, it recommends considering changing the mobile banking provider to one that requires 'What you have' verification for phone number changes. The speaker also calls on banks and the government to implement robust security measures and urges the public to be vigilant about their digital security.

Mindmap

Keywords

💡Cybersecurity

Cybersecurity refers to the practice of protecting internet-connected systems, including hardware, software, and data, from attack, damage, or unauthorized access. In the video, cybersecurity is a central theme, as the discussion revolves around the threats posed by digital banking fraud and the importance of safeguarding personal information and financial transactions.

💡Mobile Banking

Mobile banking is a service that allows users to conduct financial transactions remotely using a mobile device. In the context of the video, mobile banking is highlighted as a target for cybercriminals who exploit vulnerabilities to gain unauthorized access to users' accounts, emphasizing the need for robust security measures.

💡Phishing

Phishing is a type of online scam where criminals send seemingly legitimate emails or messages to trick recipients into providing sensitive information, such as login credentials or financial data. The video discusses a phishing evolution where criminals use various tactics, including fake wedding invitations or BPJS bills, to obtain SMS OTPs for mobile banking account takeover.

💡SMS OTP

SMS OTP stands for Short Message Service One-Time Password. It is a security measure used to verify a user's identity during transactions or account access. The script mentions that criminals are targeting SMS OTPs to facilitate the unauthorized transfer of funds from victims' mobile banking accounts.

💡APK

APK is the file format used to distribute and install applications on the Android operating system. In the video, it is mentioned that criminals send APK files disguised as legitimate updates or notifications, which, when installed, can give them access to the user's SMS and potentially their mobile banking credentials.

💡Social Engineering

Social engineering is the manipulation of individuals into divulging confidential information or performing certain actions. The video describes how cybercriminals use social engineering to trick people into filling out forms or installing malicious apps, which can lead to the theft of their mobile banking credentials.

💡Data Breach

A data breach occurs when unauthorized individuals gain access to sensitive information. The script refers to a past data breach incident in 2022, indicating that the stolen data might be used by criminals for social engineering and other fraudulent activities.

💡Two-Factor Authentication (2FA)

Two-factor authentication is a security process that requires users to provide two different authentication factors to verify their identity. The video suggests that while OTP is a form of 2FA, it may not be sufficient on its own, and additional security measures, such as 'What you have' verification, should be implemented by banks.

💡Cyber Forensics

Cyber forensics is the field of collecting, analyzing, and preserving digital evidence in order to investigate cybercrimes. The video features an expert in cyber security and forensics, who discusses the methods and implications of the digital banking fraud schemes mentioned.

💡Remote Access Trojan (RAT)

A Remote Access Trojan is a type of malware that gives the attacker unauthorized remote access to a victim's device. The video clarifies that the current fraud schemes in Indonesia have not yet escalated to the level of using RATs, but rather involve SMS forwarding, which is a less sophisticated but still dangerous method.

💡What You Have (WYH)

What You Have refers to a form of two-factor authentication that requires the user to possess a physical item, such as an ATM card or a mobile device, to complete a transaction or change settings. The video recommends that banks implement WYH verification to prevent unauthorized account takeovers, even if criminals have access to OTPs and other credentials.

Highlights

New modus operandi in banking crime involving digital deception through a wedding invitation via WhatsApp to hack mobile banking.

Cybersecurity and forensics expert discusses the increasing trend of online crimes, particularly in the banking sector, with reported cases reaching 45,000.

The evolution of phishing techniques now includes the use of Android package or APK files to steal SMS OTP for transferring mobile banking accounts.

Scammers are now using various social engineering tactics such as fake wedding invitations and BPJS bills to trick victims into providing SMS OTP.

The importance of public awareness against clicking and installing suspicious requests or APKs outside the Play Store.

The role of SMS forwarding in recent banking frauds, emphasizing that it's not sniffing or remote access Trojan attacks.

The necessity for additional security measures beyond SMS OTP, such as user ID, password, and transaction PIN, to secure mobile banking transfers.

Indication that the data breach from 2022 has led to the spread of sensitive banking information among fraudsters.

The use of social engineering by cybercriminals to analyze the behavior and habits of potential victims to craft targeted attacks.

The recommendation for banks to implement stronger security protocols, including 'What you have' verification methods like requiring a visit to an ATM or bank branch for account changes.

The call for standardization by regulatory bodies like OJK to enforce better security measures for mobile banking.

The suggestion for users to change their mobile banking passwords and PINs if they suspect their data may have been compromised.

The potential long-term protection measures for users, including changing mobile banking accounts and ensuring banks have robust verification processes in place.

The discussion on the limitations of SMS-based OTP as the weakest form of OTP due to potential interception by third parties.

The comparison of different OTP methods, highlighting the security levels of token-based, authenticator app-based, and SMS-based OTPs.

The emphasis on the importance of 'What you have' verification, such as possession of an ATM card or ID, as a crucial security measure.

The expert's advice for banks and the government to improve security measures and the literacy of cyber activities among the public.