Santander fraud help!

matty_544

Santander will always give the money bck as soon as a transaction is marked as potential fraud. However after they investigate, deem it wasnt fraudulent, they can and will take the money bck. Obviously they wont take it bck if the investigation results in fraudulent activity.

Happened to me last week.

Alex11223

matty_544 wrote: »

Santander will always give the money bck as soon as a transaction is marked as potential fraud. However after they investigate, deem it wasnt fraudulent, they can and will take the money bck. Obviously they wont take it bck if the investigation results in fraudulent activity.

Happened to me last week.

In an email sent to me, the woman said my login details where in fact compromised.

I can confirm that I have deleted the compromised internet banking details from your account.

Anyway, I will be waiting for their investigation to finish before buying anything, just in case.

zerog

Santander will change your OTP number over the phone, as long as you can pass the security questions and tell them the old number. This is the only way to do it if your SIM has expired / you lost your PAYG phone etc.

Installing Trusteer Rapport is the fastest way to get your internet banking details compromised.

Alex11223

zerog wrote: »

Santander will change your OTP number over the phone, as long as you can pass the security questions and tell them the old number. This is the only way to do it if your SIM has expired / you lost your PAYG phone etc.

Installing Trusteer Rapport is the fastest way to get your internet banking details compromised.

Ahh, that make sense. They would need to do that for lost or stolen phones.

And how-so? This woman is pretty insistent on me installing it, and I'm sure she won't send me out new details without it..
How is it a faster way to get compromised, due to the fact it makes you stick out? It's a security app, what could you be protecting, etc.

hush-hush

It sounds to me like a couple social engineering attacks that went unnoticed:

1) A S.E. attack to someone in order to get your personal information (could be to yourself).
2) A S.E. attack to Santander in order to get the malicious phone number in your account, authenticating themselves using your personal information.

I don't think you are ultimately responsible for this as Santander clearly failed when they authorized someone that's not you to change information in your account.

Alex11223

hush-hush wrote: »

It sounds to me like a couple social engineering attacks that went unnoticed:

1) A S.E. attack to someone in order to get your personal information (could be to yourself).
2) A S.E. attack to Santander in order to get the malicious phone number in your account, authenticating themselves using your personal information.

I don't think you are ultimately responsible for this as Santander clearly failed when they authorized someone that's not you to change information in your account.

A social engineering attack does sound most plausible at the moment.

Archi_Bald

hush-hush wrote: »

It sounds to me like a couple social engineering attacks that went unnoticed

Alex11223 wrote: »

A social engineering attack does sound most plausible at the moment.

Excuse my ignorance, but what is a social engineering attack, and how do you recognise, and more importantly, avoid one?

Alex11223

Archi_Bald wrote: »

Excuse my ignorance, but what is a social engineering attack, and how do you recognise, and more importantly, avoid one?

A social engineering attack is where someone uses information to lie or deceive to get something. Like in this situation, a person could of had the answer to my security questions, all they had to do was ring up Santander and say "I'm xxxxx and I have lost my phone and got a new number, can you add it please?" and Santander will believe it's me when though its not, due to the fact he has this information.

To avoid one, make sure you keep your information to yourself. Check regularly that nothing suspicious is going on inside your account(do not rely on the bank to say they have a xxx colour flag on your account).

teffers

Archi_Bald wrote: »

Excuse my ignorance, but what is a social engineering attack, and how do you recognise, and more importantly, avoid one?

Using social engineering to compromise details is using the way many people act online (sharing important data such as birthdates, family connections - names etc) to then use that information to guess credentials for sites such as banking / shopping etc.

It's amazing the information people freely give out whilst not really taking any real care who might be reading it (now or a year down the line).

Not suggesting this is what happened with you Alex - just glad you got your money back.

Archi_Bald

This seems to mean that a social engineering attack effectively is that you gave someone your login details. Not sure what I can say to this.