Man in middle attack - Banking forum

ChiefGrasscutter

Another example of what appears to be a man in the middle attack: Natwest in this case
-It's been put on an update at the end of page 1 and onto page 2 of this thread below- should be a new thread really.......
https://forums.moneysavingexpert.com/discussion/3184434

Directed to fake login site - which required them to enter details into and use a card reader.
Don't know about the Natwest system, but something somewhere seems a bit odd to me: you have to have physical possession of the card/chip surely as well as the PIN code to create a new payee.

Ximian

Doesn't look like a Man in the Middle attack, looks like it was a redirection to a phishing site that appeared to look like the NatWest site but the victim was asked to use the card reader to log in. This process was probably then used to create a new payee and send money to that account.

To set up a new payee you do need the card reader and the physical card (and PIN) and a challenge-response system is used. The site probably created the challenge-response which automated creation of a payee and the cash amount to be paid.

dixiebb

yep, ensure all your anti-virus and anti-malware definitions are up-to-date; and most importantly have your wits about you. these are getting real nasty now, and using ever more 'sophisticated' techniques.