×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Everything You Know About Password-Stealing Is Wrong

timothy posted about a year ago | from the but-password-stealing-is-wrong dept.

Crime 195

isoloisti writes "An article by some Microsofties in the latest issue of Computing Now magazine claims we have got passwords all wrong. When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss. Stealing passwords is easy, but getting money out is very hard. Passwords are not the bottleneck in cyber-crime and replacing them with something stronger won't reduce losses. The article concludes that banks have no interest in shifting liability to consumers, and that the switch to financially-motivated cyber-crime is good news, not bad. Article is online at computer.org site (hard-to-read multipage format) or as PDF from Microsoft Research."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

195 comments

The hell it doesn't cost consumers! (5, Informative)

Anonymous Coward | about a year ago | (#42870835)

When money is stolen, consumers are reimbursed for stolen funds and it is money mules, not banks or retail customers, who end up with the loss.

I had my identity stolen years ago by a guy who managed to run up a bunch of charges on my bank credit card (still don't know how he got the numbers). And, while the bank did reimburse me for the stolen money, they most certainly DIDN'T reimburse me for over $200 in bounced check charges that came after he cleaned out my account, or the hit that my credit rating took after a bunch of companies reported me as a deadbeat for passing bad checks and missing automated billing deadlines. Yeah, just TRY repairing your credit rating after something like that and tell me that consumers don't take a hit for identity theft.

Re:The hell it doesn't cost consumers! (3, Insightful)

gl4ss (559668) | about a year ago | (#42870915)

I bet he ran it up way more than 200$.

now if you were a money mule you'd be hit with paying for 4950$ you transferred for some guy in ghana.

Re:The hell it doesn't cost consumers! (5, Informative)

Anonymous Coward | about a year ago | (#42871099)

They also don't reimburse the cost retailers have to pay for each fraudulent transaction.

Re:The hell it doesn't cost consumers! (5, Insightful)

Culture20 (968837) | about a year ago | (#42871115)

Not only that, but your reimbursement had to come from somewhere, and it's not the CEO's pocket. It's everyone else's pockets in increased fees.

Re:The hell it doesn't cost consumers! (5, Insightful)

SilverJets (131916) | about a year ago | (#42871169)

Not only that, but your reimbursement had to come from somewhere, and it's not the CEO's pocket. It's everyone else's pockets in increased fees.

THIS.

As well as increased insurance costs. The authors of the article are rather dense if they honestly think that the costs of reimbursement are not passed down to consumers.

Re:The hell it doesn't cost consumers! (5, Insightful)

Anonymous Coward | about a year ago | (#42871349)

That's exactly what TFA says. Banks like the fear of lost passwords, because they can use that fear to their (profitable) advantage:

"When perceived risk is greater than actual risk it can be protable to absorb the risk and charge for it. Rental car companies are not merely willing, but anxious to accept liability for any damage to the car for $35 a day; various companies aggressively market identity theft protection for $12 a month. Banks enjoy a huge information advantage over consumers: they know how much fraud costs them, while consumers merely hear horror stories of cyber-crime losses. Passing liability to consumers...would seem to be wasting a protable opportunity."

Re:The hell it doesn't cost consumers! (2, Funny)

S.O.B. (136083) | about a year ago | (#42872075)

That's exactly what TFA says. Banks like the fear of lost passwords, because they can use that fear to their (profitable) advantage:

"When perceived risk is greater than actual risk it can be protable to absorb the risk and charge for it. Rental car companies are not merely willing, but anxious to accept liability for any damage to the car for $35 a day; various companies aggressively market identity theft protection for $12 a month. Banks enjoy a huge information advantage over consumers: they know how much fraud costs them, while consumers merely hear horror stories of cyber-crime losses. Passing liability to consumers...would seem to be wasting a protable opportunity."

Protable? WTF is protable?

How can you possibly introduce a spelling mistake...TWICE...with a cut/paste?

Re:The hell it doesn't cost consumers! (5, Informative)

Intropy (2009018) | about a year ago | (#42871637)

FTA:

"Thus, in the US, individual consumers are largely insulated from the direct financial consequences of credential theft..." (emphasis in original)

"While 'we all pay for cyber-crime' is true in a general sense, it is not the case that individual users face grave financial risk."

They're pretty clear that they are discussing risk of catastrophic loss to a single individual rather than increased shared costs.

Re:The hell it doesn't cost consumers! (3, Interesting)

blueg3 (192743) | about a year ago | (#42871445)

That's addressed right in the summary. The banks generally manage to get their money back from one of the intermediates used to transfer the money out in the first place. It's those suckers that eat the majority of the loss.

Re:The hell it doesn't cost consumers! (5, Informative)

Anonymous Coward | about a year ago | (#42871173)

Yes, you do have to fight those things, because among other reasons, the banks deliberately do choose to keep the bounced check charging people out of the fraud reporting loop, so you have to find somebody to knock the heads together and get the information shared. And even then, your liability is controlled by state law, so that limit is up to them anyway.

Your credit rating, however, you can repair, by disputing those false charges. And if the credit rating company mishandles that, you can get some serious money out of them.

Re:The hell it doesn't cost consumers! (5, Informative)

ragefan (267937) | about a year ago | (#42871885)

Clearly, you missed the 60 Minutes report this week about Credit Rating companies and their dispute process (source [cbsnews.com] ).

In a nutshell, your dispute is never sent to someone who will approve it, and you basically have to sue them to fix it. Its a multi-year case and you better be well documented.

Re:The hell it doesn't cost consumers! (5, Insightful)

thePowerOfGrayskull (905905) | about a year ago | (#42872069)

I've disputed several inaccuracies on my credit report, and had most of them removed without further fight.

I'm not saying 60 minutes is full of shit, but ...

60 minutes is in the business of selling scare stories. A little bit of cherry picking goes a long way.

Re:The hell it doesn't cost consumers! (4, Informative)

Anonymous Coward | about a year ago | (#42871191)

From TFA: "This does not mean, however, that password-stealing is a minor problem. The indirect costs of cyber-crime almost certainly dwarf the direct losses by orders of magnitude. While password-stealing victims are spared direct losses, they may spend considerable time and energy resolving the mess."

Re:The hell it doesn't cost consumers! (5, Informative)

blueg3 (192743) | about a year ago | (#42871485)

Either your bank sucks or you didn't browbeat them enough. They should reverse the bounced-check charges resulting from the stolen money.

You need to dispute the results of identity theft on your credit rating. If the rating agencies refuse to fix it, you can sue the pants off them.

Of course, this is a lot of trouble and it sucks pretty hard. TFA actually agrees with you on this.

Dump the Visa/MC-debit! (3, Interesting)

sirwired (27582) | about a year ago | (#42872003)

It sounds like you had a Visa-branded debit card, not a credit card. Visa/MC Debit cards serve no use other than to enrich the bank, the merchant fees are much higher than PIN-debit. And, as you have learned, if a thief gets a hold of your number, your bank account is empty and your bills bouncing while you argue with the bank.

It's far better to get a credit card and simply pay off the bill every month. That way, if it gets emptied, you argue with the bank about THEIR money. (With a Visa/MC Debit, you argue with the bank about YOUR money. Guess which dispute gets more attention?

And yes, the bank should have paid up the bounced check fees... might as well dump this loser of a bank entirely and sign up with a Credit Union.

Re:Dump the Visa/MC-debit! (4, Insightful)

whoever57 (658626) | about a year ago | (#42872145)

Visa/MC Debit cards serve no use other than to enrich the bank

There is another reason for these cards: to avoid the legally-mandated consumer protection that exists for credit cards.

Banking passwords are overrated (4, Interesting)

damn_registrars (1103043) | about a year ago | (#42870903)

It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts, but not for their personal accounts on their own computers. They really need to think about what value those passwords have to other people - in particular what could someone else do with those passwords if they had them?

I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts. I have seen some where you can set up bill payments, but that was a chore and would not be useful for trying to pull money out quickly. Most online banking systems intentionally do not even give full account or routing numbers to logged in users, and I've never seen one give out SSN or DOB either.

On the other hand, people keep a lot of personal information on their PCs. If you can get their personal user names and passwords you could get a lot more useful information on them. A lot of users likely have their SSN and DOB in their browser cache somewhere, and almost everyone has their address somewhere in there.

Re:Banking passwords are overrated (5, Informative)

way2trivial (601132) | about a year ago | (#42870985)

online banking- mine pulls up full images of check faces... which does include routing & account #'s

Re:Banking passwords are overrated (3, Funny)

interkin3tic (1469267) | about a year ago | (#42871025)

It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts

And do you see people coming up with such passwords often?

Most online banking systems intentionally do not even give full account or routing numbers to logged in users, and I've never seen one give out SSN or DOB either.

Hmm... you're familiar with most banking online systems?

You almost had me convinced to make a super easy bank password. Nice try, identity thief!

Re:Banking passwords are overrated (5, Informative)

SJHillman (1966756) | about a year ago | (#42871029)

I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.

If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.

Re:Banking passwords are overrated (4, Informative)

Chrisq (894406) | about a year ago | (#42871127)

I have accounts with First Niagara (they acquired my HSBC account), ING Direct (recently acquired by CapitalOne) and Ally Banks. I frequently move money between them through the web interface - real easy to set up, you just need to be able to log in to both accounts you're transferring between. Furthermore, my girlfriend has an account with Keybank and we transfer money from her account to mine about once a month to cover living expenses (I pay for almost everything up front, she pays me her share monthly). All I needed from her to set it up was her password.

If I get your banking login info, I can probably get a good chunk of your money before you realize it. Fortunately, many banks offer email alerts for transfers over X amount or if another account has been added. However, if you target someone who doesn't check their balance or email more than once or twice a week, you can probably get away with it before they know it's happening.

Same here in the UK. With FasterPayments [fasterpayments.org.uk] I can transfer money from a NationWide account to a Braclays or a Coop within minutes. My Brother in Law used this recently when his daughter didn't have enough money to buy a train ticket home from uni, she was in the station, called, he transferred the money and she withdrew it from the CashPoint (ATM) a minute later.

Re:Banking passwords are overrated (1)

s7uar7 (746699) | about a year ago | (#42871725)

With NatWest I have to use a card reader and my PIN to set up a new payee online. Someone who broke into my account could pay my credit card bill or transfer money to my brother but would find it hard to actually gt their hands on my cash.

Re:Banking passwords are overrated (2)

Chrisq (894406) | about a year ago | (#42871761)

With NatWest I have to use a card reader and my PIN to set up a new payee online. Someone who broke into my account could pay my credit card bill or transfer money to my brother but would find it hard to actually gt their hands on my cash.

Its same with Nationwide and Coop. YBS uses a confirmation by phone system, where a an automated call tells you a number that you need to enter on their site.

Re:Banking passwords are overrated (1)

Lumpy (12016) | about a year ago | (#42871217)

We are safer here in the USA. our banks REFUSE to do that. Unless you pay them $50.00 as a fee to do it.

Re:Banking passwords are overrated (3, Funny)

pixelpusher220 (529617) | about a year ago | (#42871499)

yeah, the guy stealing your money would totally balk at spending $50 bucks of your money to do that ;-)

r00t (0)

Anonymous Coward | about a year ago | (#42871261)

Thanks for the info...

Re:Banking passwords are overrated (0)

Anonymous Coward | about a year ago | (#42871381)

Isn't this protected with a security device? Every bank I have or had an online account with sent me such a device. Insert bankcard, insert challenge number from webby, give card pin and than you get the number to unlock your account.
Every transaction you need to auth again.

If banks don't supply these I'd say it's their own responsibility if customer's accounts get plundered.

Re:Banking passwords are overrated (1)

SJHillman (1966756) | about a year ago | (#42871641)

I just have to put in my username, password and some sort of online PIN or security question for each account. As far as I'm aware, only one of my banks even offers any sort of additional security like you describe.

Re:Banking passwords are overrated (1)

ub3r n3u7r4l1st (1388939) | about a year ago | (#42871803)

It is a pseudo-random number generator devices. In the U.S. , I have seen two financial companies doing it: E*TRADE and Blizzard Entertainment.

Re:Banking passwords are overrated (1)

Anonymous Coward | about a year ago | (#42871547)

yah, and all that is completely reversible. at worst, they'd know where the moneh went (assuming destination immediately took all the cash out).

Re:Banking passwords are overrated (1)

SuperHighImpact (463360) | about a year ago | (#42872291)

If I understand the article correctly, banks are not worried about these transactions because it's traceable and can easily be reversed. If your girlfriend said the transfer was fraudulent, then the bank would simply take the money back from your account (yes, they can still do that even though it's with a different bank). If you had already withdrawn the money from your account, then you'd be looking at a negative balance and probably lots of fees and charges on top of that.

Now, if you could initiate a western union transfer from your girlfriend's account, then it would become a serious risk.

Re:Banking passwords are overrated (3, Informative)

thue (121682) | about a year ago | (#42871051)

> Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts.

Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.

At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?

Re:Banking passwords are overrated (1)

SJHillman (1966756) | about a year ago | (#42871077)

Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.

Re:Banking passwords are overrated (5, Informative)

Geoffrey.landis (926948) | about a year ago | (#42871973)

Huh? Just go to "transfer money", write the account number of the receiver and the amount, and off the money goes.
At least that is how it works here in Denmark. Very handy, too. Is the US still using personal paper checks?

The article is talking about irreversible and untraceable money transfer. If the bank has been given "the account number of the receiver and the amount", it is neither irreversible nor untraceable. When the person defrauded complains to the bank, they reverse the transfer.

Thus, the thief needs a mule, a person with an account that can be used to accept the transferred money and turn it (somehow) into untraceable cash.

Some banks, like ING Direct, even allow you to transfer money between two phones if you have their app installed. Steal someone's phone, find they have their passwords saved, install the app on your phone and transfer away.

Transfer to whom? To steal money by such a transfer you need to make an irreversible transfer to an untraceable account. (If it's not irreversible, they just take the money back; if it's not untraceable, they come after you and put you in jail.) The whole point of the article is that this process, making a transfer that the bank can't reverse and sending the money to an account that the law can't trace, is much more difficult than the process of stealing passwords.

Re:Banking passwords are overrated (1)

SJHillman (1966756) | about a year ago | (#42872071)

This would be Step 1 - getting control of the money. Once you have control of the money, then you can worry about moving it to an untraceable, irreversible account or withdrawing it as cash. Step 1 is merely the most difficult to do.

Re:Banking passwords are overrated (1)

vlm (69642) | about a year ago | (#42871181)

and off the money goes.

off the money goes really Fing slowly. There is no technical reason why a credit card payment can't be posted as fast as a charge, for example, in minutes at most. I get an alert when I make a credit card charge and the alerts usually arrive in minutes at most. However, intentionally... probably... my bank's bill pay system takes an absolute minimum of one business day to process a bill pay (sometimes more) and they send email alerts to me both when its set up and on the morning of the actual day of the transfer (at least one day in the future) when it could still be reversed. So if someone broke in and tried to send my whole account to dice.com or whatever, I would have instant warning someone is screwing around and at least 24 hours to prevent the transfer.

I use the word "bank" but its actually a local credit union. Maybe some weird credit union reg paid for by banks that CUs must not do instant payments, who knows.

Re:Banking passwords are overrated (3, Interesting)

SJHillman (1966756) | about a year ago | (#42871313)

Most financial institutions do batch processing, not real-time processing. Your average bank will do all of the deposits first, around 3pm each business day, and then do all withdrawals. That's the main reason most transactions take a minimum of one business day.

Re:Banking passwords are overrated (1)

balsy2001 (941953) | about a year ago | (#42871201)

This is how it works in the US too. The poster just hasn't seen or noticed it (I would go with noticed it). But there is a difference between transferring funds and wiring funds. I can do as you describe and it will take a few days for the money to get from one account to the other. If you wire funds it is basically immediate and the money is gone.

Re:Banking passwords are overrated (2)

Gorobei (127755) | about a year ago | (#42871873)

This is how it works in the US too. The poster just hasn't seen or noticed it (I would go with noticed it). But there is a difference between transferring funds and wiring funds. I can do as you describe and it will take a few days for the money to get from one account to the other. If you wire funds it is basically immediate and the money is gone.

Note the there is a difference between "making funds available to an account," and "actually having money in an account." Checks vs wire transfers have different speeds at which funds become available, but the actual "having the money for sure" can take an open ended amount of time (60 days or more, worse case.) So even if $100K is wired into your account, you can spend it, and next week find you owe the bank $100K because the wire transfer was later rejected.

The "funds on hold" time period for checks is the result of two banks needing to agree money is to be transferred between them (I present check from bank A to bank B, bank B needs to assert bank A will honor the check.) This ensures the amount of bank deposits in the system reflects reality rather than people kiting checks for ever larger amounts to each other.

This is orthogonal to your ability to withdraw money from your account because it has a positive balance. That's a convenience your retail bank affords you. You're on the hook if the funds you relied on don't materialize on time.

Re:Banking passwords are overrated (1)

balsy2001 (941953) | about a year ago | (#42872119)

The non-transfers I was talking about are not checks, just electronic transfers between accounts at different banks (but I guess they may be treated that way and pass through the ACH, I am not a banker so Ill trust you if you say it is the same). I really thought when I wired funds they were gone. The last time I closed on a mortgage my bank asked my like 10 times if I was sure the account was correct and if I really wanted to wire 22K to them because it couldn't be reversed.

Re:Banking passwords are overrated (1)

Lehk228 (705449) | about a year ago | (#42871087)

Bank of america has the routing numbers available in online banking and bill pay can be set to send a check to an arbitrary name/address

Re:Banking passwords are overrated (2, Interesting)

Anonymous Coward | about a year ago | (#42871111)

I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts. I have seen some where you can set up bill payments, but that was a chore and would not be useful for trying to pull money out quickly.

I was curious, so I checked the services offered by Wells Fargo Bank, NA. Through their online banking system one can:

        Transfer Money & Make Payments
        Transfer to/from a non-Wells Fargo Account
        Add a non-Wells Fargo Account
        Send & Receive Money
        Transfer to Another Country
        Set Up Recurring Transfer
        Set Up Recurring Payment

I'm feeling a strong urge to go back to my credit union.

Re:Banking passwords are overrated (3, Interesting)

Neil Boekend (1854906) | about a year ago | (#42871179)

With mine I can transfer money. However, it's protected way beyond a simple password. I need a "random reader": a simple device that accepts my debet card, requires my PIN and gives me back the one-time key to even see my details. When signing a transaction I need to give the PIN, a one-time key from the webpage and the amount of money before the comma (probably to prevent hijacking).
I feel quite safe with that.

Re:Banking passwords are overrated (1)

krinderlin (1212738) | about a year ago | (#42871991)

Are you in the US? Because I think we're talking Chip & Pin here, and <sarcasm> we Americans decided that was just stupid. Mostly because Europe could never come up with something so innovative.</sarcasm>

Re:Banking passwords are overrated (2)

LQ (188043) | about a year ago | (#42872057)

With mine I can transfer money. However, it's protected way beyond a simple password. I need a "random reader": a simple device that accepts my debet card, requires my PIN and gives me back the one-time key to even see my details. When signing a transaction I need to give the PIN, a one-time key from the webpage and the amount of money before the comma (probably to prevent hijacking).
  I feel quite safe with that.

When setting up a new payee, my UK bank sends a one-time code to my mobile phone that I need to enter via the web. I sort of feel safe with that.

Re:Banking passwords are overrated (0)

Anonymous Coward | about a year ago | (#42871253)

I have used a fair number of different banks over the past couple decades and seen a lot of different online banking systems. Not once have I seen one where you could actually use the online system to arbitrarily move money outside the account owner's accounts.

My bank does. All I need is someone's check routing info and I can send them money. It can be very handy at times, even though it does increase the potential for fraud...

Re:Banking passwords are overrated (1)

blueg3 (192743) | about a year ago | (#42871579)

It puzzles me when I see that people work really hard to come up with difficult passwords for their bank accounts, but not for their personal accounts on their own computers. They really need to think about what value those passwords have to other people - in particular what could someone else do with those passwords if they had them?

The attack scenarios are very different. Most home PCs do not have any remote access service enabled. So your password is safeguarding your computer from someone who is physically present but has neither the time nor the technical skill to bypass it. That's often, but not always, a very rare occurrence. (If it's a laptop and you were prudent enough to use full-disk encryption, that password is actually being useful.) Your banking password is protecting you from anyone who is (a) on the Internet and (b) discovers that your (bank, username) pair is valid.

Re:Banking passwords are overrated (0)

Anonymous Coward | about a year ago | (#42871689)

A lot of users likely have their SSN and DOB in their browser cache somewhere, and almost everyone has their address somewhere in there.

If you already have physical access to their PC, presumably you know their address--you're there!

Re:Banking passwords are overrated (1)

ZiakII (829432) | about a year ago | (#42871733)

Just to add to this I have Navy Federal (NavyFCU) and I can transfer money to accounts with no problem. In fact when ever I need to send a out of state friend money this is usually how I do it. As it beats PayPal as there are no transfer costs for me or for them.

Re:Banking passwords are overrated (1)

AvitarX (172628) | about a year ago | (#42872035)

Do some banks blue our cancelled checks?

mine hides the number in the html interface, but i can pull up checks.

Not password stealing. (2, Interesting)

Anonymous Coward | about a year ago | (#42870917)

First of all, it's not theft if you still have your password. Secondly, if you leave your car unlocked with the engine running and go shopping, will the insurance company pay you back for your loss or call gross negligence? There's a difference between having a reasonable password for banking that's not the same one you use everywhere, and between using "hunter2" for every single place you have an account. And finally, I'm pretty sure banks don't reimburse money stolen from shops. Same goes on here. If someone breaks into the bank, you get your money anyway. If someone breaks into your home, the bank doesn't care.

I dunno... how much is a good fake ID? (2)

way2trivial (601132) | about a year ago | (#42870967)

if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.

so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day

I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks.

I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID

yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.

Re:I dunno... how much is a good fake ID? (1)

s0nicfreak (615390) | about a year ago | (#42871759)

Or you could just use online bill pay to transfer money to a prepaid credit card.

Not worth it [Re:I dunno... how much is a good...] (3, Insightful)

Geoffrey.landis (926948) | about a year ago | (#42872191)

if you got my bank password... you could use online billpay to mail a check and cash it... if it was under a thousand, my bank wouldn't blink.
so scenario.. I get a good set of identity papers, even just a license together for a lady who works all day

Identity papers good enough to fool a bank cost money.

I have, 10 account passwords at different banks and use online billpay to mail out 10 checks for $900 + odd amount checks. I swipe them from the mailbox of the lady who works all day....
I cash them all on the same day- visiting 10 issuing banks...
burn the ID

yes, I see where that could fall apart in a few spots

It sure does. For a profit of $9000 (minus the cost of forged identity papers), you have left your image and paper trail in the security camera of the bank you used to transfer the money, plus ten other banks; plus stealing from the U.S. mail probably over four or five days and hoping that the nosy neighbors weren't watching. You're hoping that none of the ten got their bank statement and noticed the check payment in the three days it takes the check to be mailed. And once the first person complains, the warning about your forged identity is going to go out to all the other banks, and so when you cash check number n, you're hoping that the account holders of checks 1 through n-1 haven't been complained yet. And banks in the US have a three-day hold on availability of funds from checks; so you are going to have to wait and hope not one of ten people noticed the withdrawal.

Suppose it is a 5% probability of getting caught on any one transaction. On the average, you'll make $18,000 before being caught. That is so not worth it.

Or you could just use online bill pay to transfer money to a prepaid credit card.

Except that banks do know that trick and protect against it. It's not hard to put $50 on a prepaid credit card without leaving tracks. Try putting $9000 on a credit card, and they start keeping records of who you are.

Re:I dunno... how much is a good fake ID? (3, Informative)

frinkster (149158) | about a year ago | (#42872007)

yes, I see where that could fall apart in a few spots, but I'm not a professional grifter, a variation of it should be achievable.

My brother-in-law IS a professional grifter, and he has spent more of his adult life in prison than as a free man. I assure you that the scheme you described will not last for very long at all (in the US).

TFA described exactly why you need some idiot "mule" to act as your middleman, and described exactly why that idiot "mule" is the one that ends up losing all the money (the original victim is always made whole). And TFA described why the real bottleneck in financial fraud is in recruiting idiot "mules" and not stealing passwords.

It stands to reason that making it harder to recruit idiot "mules" would have a far greater benefit than making it hard to compromise banking passwords.

Ummm.... (1)

wisnoskij (1206448) | about a year ago | (#42870969)

OK, so say someone steals money from your account.

the thief has made money.
If someone notices the theft I guess you get your money back, at least that is what the article claims.
I guess banks have insurance for this sort of thing, but even if they do they would pay more in insurance payments than they would in actual dollars lost over time; That is how insurance works. So they do lose money, unless they are allowed to make new money when some is stolen. This loss is passed onto you the customer.

Re:Ummm.... (3, Insightful)

gl4ss (559668) | about a year ago | (#42871043)

because there was talk about moles I'm assuming it's usual that it's moved to some gullible idiots account, who takes a fee and forwards the money(nigeria scam sort of) via untraceable method.

so that guy ends up paying the damages.

Re:Ummm.... (0)

Anonymous Coward | about a year ago | (#42871147)

You can see multiple jobs listed for "mules" on craigslist.

Re:Ummm.... (1)

Eskarel (565631) | about a year ago | (#42871707)

Yes, the cost is passed on to you the customer. The whole point of the exercise is that the cost of actually doing something about it(which will also be passed onto the customer) is orders of magnitude higher than the cost of the fraud. They don't actually have insurance for this, it's just cheaper to write it off than it is to fix it.

I think the article misses the point (4, Insightful)

Chrisq (894406) | about a year ago | (#42871007)

The gist of TFA is that since the transfer from the person with the compromised password to the mule is reversed it is the mule that loses out, so the password isn't the bottleneck. (evidently the bottleneck is mule-recruitment and back-end fraud detection). This rather misses the point that it is a potential stopping point. If the account cant transfer money to the mule then the mule can't be persuaded to take commission and send the rest on by Western Union.

Maybe I'm cynical, but it seems to me that this analysis is a big "not my problem" statement by Microsoft. The client-end OS and browser security, which Microsoft has a big share of are not the "real problem" - that lies at mule recruitment and backend fraud detection systems, both areas where Microsoft has little investment.

Re:I think the article misses the point (4, Insightful)

Lehk228 (705449) | about a year ago | (#42871295)

The bank reimburses the individual customers who lose money, (costs go up for everyone but the specific losses are socialized). The cost to improve the password security of every account would exceed the reduction in fraud costs, therefore it is in nobody's interest to spend money on that aspect of security.

Re:I think the article misses the point (3, Insightful)

Anonymous Coward | about a year ago | (#42871323)

I think the article is spot-on. Their point is that anti-fraud resources could be better directed. There is so much hemming and hawing about how insecure passwords are and how they get lost and how they can be cracked when the PW is only the first hoop a would-be thief would have to jump through and a low one at that. The defense has to be the whole system. The article speaks to that briefly:

"If a large lake of credentials is drained by a narrow pipe of mules then reducing the inflow to the lake might have no effect on the net harm done. Enormous energy has been devoted to the task of replacing passwords with something more secure. Yet, there is no clear picture of how much harm this would eliminate."

Re:I think the article misses the point (5, Insightful)

MozeeToby (1163751) | about a year ago | (#42871387)

I think what they are getting at is that criminals have access to X passwords and Y mules, where Y is significantly less than X. Lets say they have 10,000 passwords for every mule that they have, and each mule will perform 10 transactions before they are caught out (or catch on, depending). That means you could reduce the number of leaked/grabbed/cracked passwords by 99% and still have the exact same amount of financial crime; and none of those numbers seem all that far outside of the realm of possibility to me.

But that is about overall crime and statistics. You can still lower your risk of being a victim by choosing strong passwords, keeping a clean pc, etc.

too hard (2)

nten (709128) | about a year ago | (#42871423)

Using their numbers, we would have to introduce security measures that made passwords 1000000% more difficult to obtain, than they currently are, in order to put credentials on par with mules in terms of value. Having N mules available and N+1 passwords available, the amount of crime would be no less than if we had N*10^6 passwords available. They do not mention why we cannot remove the ability for a money owner (mule) to initiate large unrepudiable transactions. They indicated this was usually via western union or moneygram. What harm would we do society by removing those methods? Security is very hard. I don't believe we can make credentials even close to 1000000% more secure, and if we do not, we will only drive up the price of those credentials by an insignificant amount.

Re:too hard (1)

Eskarel (565631) | about a year ago | (#42871685)

Well essentially every libertarian on Slashdot and a whole mess of criminals would complain that you've made it very difficult to move untraceable cash around(which is sort of the point). To be honest I'm not sure this is a particularly big deal since you can still drive around with a big old briefcase full of cash.

Fundamentally though you'd make life harder for people who don't have access to computers and the modern world. In particular you'd make it difficult for immigrants to send money back to their families in whatever third world shit hole they came from. You can make the judgement about whether this is actually a tremendously bad thing(transferring cash from the US economy to somewhere else isn't necessarily great for the US economy, but it's pretty great for the people receiving the money and the people sending it), but the impact would be pretty massive. Not quite as massive as the impact of banning third party check cashing(apparently there are people who are sufficiently poor that having a bank account is a waste of money), but the old school economy is a pretty big thing(isn't it interesting that with all this crying about electronic banking and stolen passwords, most fraud works through mechanisms which have been in place for centuries(western union is basically a telegraphic letter of credit).

Re:too hard (3, Interesting)

krinderlin (1212738) | about a year ago | (#42872117)

I so wish for mod points. Western Union/Moneygram are the "Banks" for people without the ability to now meet new Federal Standards for State Issued ID. The paperwork required today in many states just to get a new "Secure ID" are ridiculously bad if you've done anything other than be born in the last 60 or so years, gotten married, receive physical bills & bank statements, and had those items delivered to your physical address (which assumes you can receive mail at your physical address).

So it isn't just "illegal" immigrants using these services, anymore. It's a large segment of the lower end of society that is being forced to utilize these services so they can pay utility bills with cash, money orders, and move money about to relatives. You're actually causing severe harm getting rid of the cash-based services.

Off topic: Lucky me, I've bypassed the "chain of name changes" requirement by having a Passport. My adoption papers don't even exist anymore thanks to a house fire and an flooded court house basement. I'd be so screwed if it weren't for the fact my employer required me to get a passport 3 years ago.

No it's not.... (2)

mseeger (40923) | about a year ago | (#42871023)

Another headline that may misslead people. Password stealing is not just a banking problem. Attackers may do a lot of damage to a person without needing to extract the money directly.

The most important lessons for passwords are:

1. One password, one service. Do not re-use passwords.

2. Prefer long to complex passwords.

Using a sentence that is important to you and modfy it per service.

E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.

If the service allows such, you are beyond any rainbow table and those passwords are easy to remember and customize per service.

Re:No it's not.... (1)

Bigby (659157) | about a year ago | (#42871593)

When most people use more than 2 passwords across all sites, they need to write them down. I know there are tools out there, like hashing for specific sites, but is my 65 yr old mother going to use it? Or are they going to put it in Excel, print it out, and put it in their top drawer?

Re:No it's not.... (1)

mseeger (40923) | about a year ago | (#42871719)

When the question is wether to use a single password on multiple sites or writing all the passwords down, i vote for the second option.

Usually such things can be avoided, if the person is taught a password generating algorithm which modifies the password per site.

But writing them down (the safer with tools the better) is a lot better than re-using passwords all the time.

Re:No it's not.... (0)

Anonymous Coward | about a year ago | (#42872267)

Passwords need security levels. Many sites want strong passwords which do not matter. 1 password for everything unimportant, 1 password for things that impact your reputation, 1 password for finance. Forgotten password button for any site which has some stupid restrictive password policy that forces you to diverge from your commonly used ones.

Re:No it's not.... (1)

s0nicfreak (615390) | about a year ago | (#42871801)

Using a sentence that is important to you and modfy it per service. E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.

But then someone only has to get maybe 2 passwords to figure out your system. Then they have access to EVERYTHING.

Re:No it's not.... (1)

mseeger (40923) | about a year ago | (#42871889)

There are two typical cases:

1. The attacker got your password at a hacked site.

2. The attacker got your password by being on your PC:

In case 1 he has one password, in case 2 he has all passwords. In both cases the weakness you mentioned is not relevant.

It is a weakness, but a rather small one compared to re-using the same password everywhere.

Also it makes it hard for an attacker to decrypt your stored password. To succeed he has to hack two sites which both store the password in plain text. I think we can ignore that probability ;-).

Re:No it's not.... (0)

Anonymous Coward | about a year ago | (#42872051)

E.g. "may the face be with you" for Facebook or "may the search be with you" for Google.

"Why are you wearing that stupid human suit?" was my wifi password for a couple of years.

I figured if it was ever somehow cracked they would leave it alone out of respect or fear.

Pretentious titles (1, Informative)

Synarus (2782873) | about a year ago | (#42871063)

Pretentious titles like this are ridiculous. This story did not prove any of my notions wrong.

Web security is no substitute for Crypto-Auth (2)

dw (5168) | about a year ago | (#42871083)

So the argument is someone steals my password, steals my money, gives it to a money mule... then I get my money back from the bank, and someone that doesn't cost me in the end? Even disregarding the fact that those costs are going to get passed on to me somehow... The inconvenience of having to deal with identity theft is not always minor (and there's probably collateral damage here as well).

My biggest beef with banking is that I don't, but should, have the ability to send money with end-to-end authorization, by way public key crypto. If, say, Amazon could verify that I authorized a purchase using my public key, then network security, and banking security, is irrelevant. Bitcoins have offered a very secure example of how this could work, assuming that you have good local security (your private keys are safe).

Re:Web security is no substitute for Crypto-Auth (2)

balsy2001 (941953) | about a year ago | (#42871363)

A lot of this is a US problem because the banks refuse to update their systems. I live in china and they have an interesting system set up for online purchases (in store is not as rigorous). When you get your card they give you a token (appears kind of like an RSA token, but I don't know the security behind it). To buy something online with that card you have to use your pin, token number, and enter a separate code that they text to your phone at the time of checkout. If set up right this form of on-line purchasing would put a serious dent in fraudulent purchases. Even if they have my card number and access to my account to change the phone number for the text, they don't have the token, unless they also broke into my house. Another example where the US misses the boat is the credit cards with chip and pins. In the states if you have the card you can basically max it out. At least with chip and pin you have to have the pin number for the card to work. The banks just don't care because they pass the losses back to the customers and merchants.

Re:Web security is no substitute for Crypto-Auth (2)

Sique (173459) | about a year ago | (#42871947)

You overlook one of the most important aspects of TFA:
Many transactions can be reversed, and it's especially simple to reverse easy to repudiate transfers.
So yes, all customers of the bank will pay their share for the increased security, fraud detection and the cost associated with reversing repudiated transaction, but the money actually retransferred does not come from the bank or the bank's customers.
Thus, what an account password thief has to do to empty a bank account is to initiate an untraceable and thus non-reversable transfer. One often used way is the use of a money-mule: An easily repudiatable transfer comes from the original victim's account, the money-mule withdraws the money (minus the "commission") and then initiates a second, non-repudiatable and non-reversable money transfer, e.g. via Money Transfer or handing the physical money bills to someone else.
If the original victim notices the theft, the first transfer is repudiated, and the money is retransferred from the money-mule's account, while the money-mule has no chance to reverse the second transaction, because this one is non-repudiatable. Thus the money-mule bears the actual cost of the fraudulent money transfer, the original victim gets the money back.
Fraudulent money transfers with stolen passwords don't actually steal from the person whose password was stolen (except this person for some reason doesn't reverse the transfer), they steal from the persons who are hired to play money-mules. And they are the actual bottle necks here. There is no point in having the passwords to accounts amounting several million dollars, if you have only a single money-mule, and this one will transfer less than $10,000 at once. It probably won't transfer the money a second time because of being already bankrupted by the first transfer going bad.

It's really even worse than that (5, Interesting)

Anonymous Coward | about a year ago | (#42871135)

About a year ago, I had my debit card stolen by a bartender, who used it to buy plane tickets for a vacation. Even though I *paid* for the tickets, the airline (*cough* Jet Blue *cough*) refused to give me the name of the passengers listed on the ticket. That in itself stunned me. Then it got worse.

I went through the bank, saying I could ID the person with 99% certainty (since the bartender was talking about not being able to pay for tickets at the bar that night). They of course referred me to the fraud department. The fraud department then of course referred me to File 13. Not one care was given to the matter. When I pushed on the issue, they asked why I cared, my account had been reimbursed. When I said it was the principle of the matter, they laughed and said the bank would simply write-off the loss and everybody wins.

It was then I realized the banks may actually *want* the fraud.

And I now trust my mattress more than any bank these days.

Re:It's really even worse than that (3, Informative)

Eskarel (565631) | about a year ago | (#42871771)

They don't want the fraud. It's simply more expensive to fix it than it is to lose the money and given that it's only money being lost for the most part(identity theft is a very different sort of issue with much broader consequences), no one gives a flying fuck. Sure there's a principle involved, but in the end is it righteous to spend tens of thousands of dollars chasing down a guy who stole a few hundred? Especially when you had dick all when it came to evidence. You hearing the guy whinging about not being able to afford a plane ticket shouldn't even be enough to get a warrant let alone an arrest and proving that the guy the tickets were bought for is the guy who bought the tickets isn't really all that cut and dry either.

Re:It's really even worse than that (3, Funny)

mlts (1038732) | about a year ago | (#42871807)

Mattresses seem to be the banking instrument of the future:

1: No overdraft fees.
2: No fees on withdrawals.
3: No fees due to having a balance under x amount.
4: Accessible 24/7, not just "banker's hours".
5: No need to worry about a username/password.
6: No ID theft can slurp your balance dry.
7: Assets can only be frozen if your heater fails.
8: Interest rate is about the same as most CDs.
9: Computer glitches won't make the balance disappear.
10: No need to give all your personal info when starting a new account.

Re:It's really even worse than that (2)

ub3r n3u7r4l1st (1388939) | about a year ago | (#42871867)

11. No protection against physical burglary
12. No protection against devaluation
13. No protection against overnight invalidation of your currency (which can happen under martial law)
14. Paper burns
15. Family replace mattresses without you knowing it, throwing everything
16. Family inside job / theft

Re:It's really even worse than that (1)

PPH (736903) | about a year ago | (#42872125)

11. You can have multiple mattresses in various countries and keep the IRS from sniffing around in them.

Online security for banks is a joke. (5, Informative)

140Mandak262Jamuna (970587) | about a year ago | (#42871535)

I have made many posts asking for two level access. First level password is good for looking at balances and bills etc. And you need the second level password to actually move money or cash it out. But each financial institution does it its own way. The final decision seems to be made by some old coot who gets mortally afraid of computers, who has a bevy of secretaries who print their emails and put them in folders, whose on line skills match that of Donald "I save classified docs in my unsecured personal laptop" Rumsfeld or David "gee I will exchange mail using drafts folder, no one will think of it ha ha ha" Petraeus.

Fidelity. Made me choose all numeric password because alphabets would confuse their old retirees who use phone based transactions. I was shocked and wanted to disable phone based transactions on my account immediately. Was told to take a hike. They can't disable it without disabling on-line access as well. Was forced to continue the account because our company 401K is with these morons. Have not checked recently if it has changed.

ETrade They used to be good. They had the concept of a "trading password" on top of a regular password. Exactly what I wanted. You need to provide the trading password to actually do trade or cash out money or transfer funds. They took it away! I called to complain. They gave me a free RSA dongle. These jokers imagine their customers having an RSA key fob for each account. Cant ditch them. Our company stock purchase plan is with them.

Schwab would give a RSA fob if I asked. But don't know how it works with Quicken. Will upgrade to latest quicken and see if it is supported. Even then I don't fancy dangling around with key fobs.

PNC Bank if you setup an all numeric username it would also serve as your phone banking user id. But you need all numeric password to use it with phones. Thank you PNC! I set up an all numeric username and a alphanumeric password. So phone transactions are not possible. With VOIP and caller-id spoofing phone banking is as vulnerable as on line banking. At least let me cut down one attack surface.

Why cant they give me two level passwords? Why cant they implement a two factor authentication like google does with cell phones? Why cant they send a text message on every transaction so that I would be alerted by any fraudulent activity?

Re:Online security for banks is a joke. (0)

Anonymous Coward | about a year ago | (#42871781)

My bank calls/texts me with a one-time use password if I want to log in from an unverified computer. Customer Bank. It always struck me as overkill.

No, STEALING, is wrong. (5, Funny)

VortexCortex (1117377) | about a year ago | (#42871595)

That's wrong terminology! Passwords are not Stolen!

Look, if you have a car and I steal that car then you don't have a car anymore.
If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.

Re:No, STEALING, is wrong. (1)

canadiannomad (1745008) | about a year ago | (#42871817)

If you have a password, and I get a copy of it, then you still have your password! We can both use the password, IT'S NOT STEALING.

Haha, I love it!

So I suppose copying passwords should be legal... Just transferring funds and identity theft need to be covered...

Summary: (1)

140Mandak262Jamuna (970587) | about a year ago | (#42871659)

Cashing out using stolen passwords is very difficult. If it was easy, customers themselves would transfer money in an untraceable manner and falsely claim fraud. The thief steals from the money mule, not the bank customer. Customers do not suffer direct harm, the indirect costs are not noticed.

Banks always benefit from CC fraud (1)

ub3r n3u7r4l1st (1388939) | about a year ago | (#42871903)

Each fraudulent charge comes with a chargeback fee against the merchant when it is discovered, no matter the amount, and that's profit for the bank and the processing network.

Fake Mules Make Passwords Important (0)

Anonymous Coward | about a year ago | (#42871949)

The article presumes that mules are recruited instead of created and thereby shoulder the risk. However, if the mules' accounts are fabricated through a fraudulent account creation (using stolen SSANs, identity theft, etc.), then the mule and the thief can be one in the same.

When the thief is the mule, then the risk is foisted back on the bank(s) and passwords absolutely matter.

Horseshit (0)

Anonymous Coward | about a year ago | (#42871959)

"The article concludes that banks have no interest in shifting liability to consumers"

Chip-and-pin was supposed to be a security upgrade that they could use to justify shifting liability. Someone needs to provide more than an MS paper conclusion to convince me that this isn't the case.

Real problem is lack of notice (1)

gurps_npc (621217) | about a year ago | (#42871961)

The real problem with password stealing is that they don't tell you when it happens - and they CAN. Just list the last 3 times you logged in, with IP addresses. You can even add in the word (new) to an IP address that has not showed up before.

Assertion is wrong. (0)

Anonymous Coward | about a year ago | (#42872055)

"article concludes that banks have no interest in shifting liability to consumers"

Article is completely wrong.

Chip and Pin is entirely to make it the customer's fault.

They have no interest in making THEMSELVES liable.

Passwords are only one part of security (1)

Drewdad (1738014) | about a year ago | (#42872187)

Relying on just a password is not secure, IMO. Just as my house has a door lock AND a security system, my bank account has a password AND monitoring. I get alerts for transactions over a certain amount, and I get daily balance updates so that I can catch any unusual activity. Sure, set up a good password. But then monitor your account, and possibly your credit rating.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...