SMS Phishing + Cardless ATM = Profit
Summary: Thieves combined SMS phishing with cardless ATMs to turn stolen bank credentials into cash, and recent arrests in Ohio showed how the scam worked. After Fifth Third Bank customers received texts claiming their accounts were locked, roughly 125 customers entered usernames, passwords, one-time passcodes and PINs on a lookalike site, and the crooks withdrew $68,000 from 17 ATMs in Illinois, Michigan and Ohio in under two weeks, with court documents showing the scheme continued through October 2018 for an additional $40,000.
Why it matters: The phished one-time passcodes were the second factor, so the control most banks rely on to stop account takeover was collected along with the password before a single dollar moved. Four men were arrested, but the withdrawals had already run for months across three states.
Read the original at Krebs on Security ↗
- Topics
- Fraud & Scams
- Related
- ArcticRAT Cybercrime Gang Profiles Victim Finances With AI Cyber Risks · Nov 13, 2026Three People Arrested for AI-Enhanced Impersonation Fraud Cyber Risks · Nov 11, 2026Medicare scam calls, texts and ads: What to watch for this Open Enrollment Cyber Risks · Oct 14, 2026