Forest Global Training Partners

Cyber Risks · Krebs on Security

Owners of 1-Time Passcode Theft Service Plead Guilty

Summary: Three U.K. men pleaded guilty to running OTP Agency, a service launched in November 2019 that placed automated calls warning targets of unauthorized account activity and then relayed any one-time passcodes they entered to the thieves' user panel. The U.K. National Crime Agency said more than 12,500 people were targeted by OTP Agency users during the 18 months the service was active, and the site went offline less than a month after the trio's arrest.

Bottom line: The service turned the second factor itself into the attack path, and the NCA's account of the case shows the operators' own Telegram chat as the evidence trail - while Krebs notes other OTP interception services such as SMSRanger are still operating and taking new customers.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related