Forest Global Training Partners

Cyber Risks · Krebs on Security

The Risk of Weak Online Banking Passwords

Summary: Krebs on Security reports that cyberthieves are using stolen email-and-password lists to test logins at banks, then feeding the working credentials into financial aggregation services like Mint, Plaid, Yodlee and YNAB to view balances and transactions. Yodlee vice president of data strategy Brian Costello said many banks let aggregators skip multi-factor authentication, treating a request from a Yodlee IP as a factor in itself.

What's compelling: A working password can be enough to let an attacker read an account's balances and recent transactions even where the bank offers MFA, and Hold Security's Alex Holden said that access is resold cheaply because it is not final access - the groundwork for SIM swaps, 2FA phishing, or linking the account to attacker-controlled PayPal or Zelle accounts via microdeposit verification.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related