Forest Global Training Partners

Cyber Risks · Krebs on Security

Account Takeovers Fueling ‘Warranty Fraud’

Summary: Fitbit traced warranty fraud in late 2015 to customer account takeovers, where scammers logged into hijacked accounts, changed the email address to one they controlled, then filed support cases demanding replacement of premium devices like the $250 Surge. Fitbit security chief Marc Bown said the credentials came from password-stealing malware on customer computers and password reuse across sites, and that hacked Fitbit accounts sold for about $2 apiece on forums like Leakforums.

What's compelling: The entire fraud hinged on one weak control: the ability to change an account's email address before any verification, which let an attacker become the customer in the eyes of support. Fitbit's fix was not a new product security feature but risk-scoring every warranty request and training its customer service staff, a reminder that the exploitable surface here was a business process, not the device.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related