SCAM alert re online banking.

http://t.news.uk.msn.com/uk/mind-boggling-scam-targe...

Edited by RobertoS (Tue 30-Apr-13 22:28:36)

Thanks for the link - first I've seen of this one!

Appears to have been around for a while in various forms.
I'm always very wary & watchful with banking and cc sites, so would likely get scared off with any unexpected changes and check with the bank.
Thankfully, I can still phone my local branch and speak to a bank clerk instead of a call centre.

Thanks for the info.

I've seen many emails asking for bank details =\

Yes, but if you read the full article, this one is particularly sophisticated.

And this one has been around for a time as well and has been reported several times.

Barclays has gone as far as you now cannot transfer money to anybody any more to combat this.

You have to go into the branch to set up a payment whitelist and use their pin protect system to transfer on that whitelist using internet banking.

I wonder how many bank losses are down to internet based fraud.

When I logon to my online bank I'm prompted to download 'Trusteer Rapport' software which I haven't because of the bad reviews saying it causes problems.

Do you have an opinion on this and if my account was compromised I'm wondering if my bank could blame me for not downloading the advised security software?

As long as you use a recognised security suite then I think they cannot blame you for any problems you may encounter.

Barclays allow all their internet customers free Kaspersky 3 user licence year after year even if you have an e-saver with £1 in it.

I have always had a multi boot setup where I have one windows install bare bones just for banking just for my peace of mind.

In reply to a post by undecidedadrian:

Barclays has gone as far as you now cannot transfer money to anybody any more to combat this.

You have to go into the branch to set up a payment whitelist and use their pin protect system to transfer on that whitelist using internet banking.

Not so! Nothing's changed!

I can still pay one of my existing payees w/out using any PIN m/c or I can add a new payee using my PIN Sentry m/c; both w/out being ordered to attend my branch.

In reply to a post by XRaySpeX:

Not so! Nothing's changed!

I can still pay one of my existing payees w/out using any PIN m/c or I can add a new payee using my PIN Sentry m/c; both w/out being ordered to attend my branch.

+1

Also described at

http://threatpost.com/ramnit-malware-back-and-better...

with a bit more detail

In reply to a post by zhango:

When I logon to my online bank I'm prompted to download 'Trusteer Rapport' software which I haven't because of the bad reviews saying it causes problems.

Trusteer Rapport can make Windows XP (in particular) extremely slow. As I haven't met anyone who knows how it works - thereby rendering it ineffective - you are well advised to ignore it.

They may have conned the banks into buying it on your behalf, but you don't have to fall for it.

I always refuse Rapport. As far as I could see all it does is things any sensible person does anyway re checking validity of incoming communications. Which means it introduces another possible point of failure, in that it is bound to be hackable itself.

I think it is based on two things. Customers who are gullible when presented with a phish, and customers who don't have any other anti-phishing/Spam detecting software.

Today I received a phone call from a company purporting to be doing a customer satisfaction survey on behalf of what happens to be my bank. Normally I would ask for a number I could call back to after verifying it with my bank. This time I didn't have that inconvenience as I was told it would take 15-20 minutes - impossible for me to spare for such a purpose - so I just politely refused.

Ok thanks - still no supporters for Rapport so I'll give it a miss.

Yet when I wanted to send some money to my dad I was given a message saying to add new payees I had to go into branch to have them added on and that if a payee is not used in 12 months it will expire.

There was nowhere for me to add a new payee online.

In reply to a post by undecidedadrian:

There was nowhere for me to add a new payee online.

Not explicitly but it's there under Make a Payment -> Someone New.

Perhaps you don't have a PIN Sentry?

In reply to a post by zhango:

When I logon to my online bank I'm prompted to download 'Trusteer Rapport' software which I haven't because of the bad reviews saying it causes problems.

Do you have an opinion on this and if my account was compromised I'm wondering if my bank could blame me for not downloading the advised security software?

I use Rapport (on Win XP and 7) - it is lightweight and has not caused any issue or impacted performance one jot. Why don't you try it out, you can always uninstall it.

It does a lot more than check what is in your address bar, and the bank logs whether Rapport was active for each session.

My bank has a formal promise to cover any online fraud so long as reasonable care was taken. It also pushes Rapport. You can work the rest out for yourself : )

In reply to a post by vimto_girl:

I use Rapport (on Win XP and 7) - it is lightweight and has not caused any issue or impacted performance one jot. Why don't you try it out, you can always uninstall it.

Lightweight ? ROTFL. Add up the RAM in use by its multiple processes and do let us know. The time it takes to uninstall itself is a clue how "lightweight" it is.

It's a pile of garbage, they couldn't sell it to the public but have found a gullible corporate market to exploit.

Why don't you try it out ? Because at best it's no benefit and at worst you're making work for yourself.

Thanks for advice v-girl but there are more 'agains't than 'for' so I think I'll leave it alone. Apart from replies on here, I've googled it and nobody like it.

In reply to a post by yarwell:

Lightweight ? ROTFL. Add up the RAM in use by its multiple processes and do let us know. The time it takes to uninstall itself is a clue how "lightweight" it is.

It's a pile of garbage, they couldn't sell it to the public but have found a gullible corporate market to exploit.

Why don't you try it out ? Because at best it's no benefit and at worst you're making work for yourself.

A whopping 32MB in two processes. And a life-wasting 43 seconds to uninstall from click to finish on a low-spec 5400rpm laptop (and at least 15s of that must have been me typing in the security captcha to shut the processes down).

If you don't understand the benefit when it comes to making a claim and it is listed as a recommended security step by your bank ...well good luck

The press agrees

In reference to www.pcpro.co.uk/realworld/359617/is-hsbcs-security-software-more-tr...:

System performance improved after I uninstalled it, and given my existing security software and safe usage strategies that have kept my logins safe so far, I don�t think I�m missing out on much.

The bank would now seem to agree, since it�s stopped bugging me with pop-ups to install the darn thing every time I connect, but what does bug me is that it now offers an option to remember my initial account login whenever I connect. I�d still need to pass date-of-birth and random password character challenges to continue, but it�s ironic that HSBC should on the one hand offer to strengthen security via a third-party app while on the other suggest login autofill, which will weaken security immeasurably. The online Help does remind users not to use autofill if they share a PC, but how many people read that before ticking this time-saving option?

In reply to a post by cheshire_man:

In reply to a post by XRaySpeX:

Not so! Nothing's changed!

I can still pay one of my existing payees w/out using any PIN m/c or I can add a new payee using my PIN Sentry m/c; both w/out being ordered to attend my branch.

+1

+1 from another Pin Sentry user

In reply to a post by RobertoS:

http://t.news.uk.msn.com/uk/mind-boggling-scam-targe...

frankly Roberto, old fruit, I wouldn't trust anybody with a name like "Etay Maor". Much as I tend to discount forum posts/flames from those who are ashamed to give their real names.

In reply to a post by robertdelamare:

In reply to a post by RobertoS:

http://t.news.uk.msn.com/uk/mind-boggling-scam-targe...

frankly Roberto, old fruit, I wouldn't trust anybody with a name like "Etay Maor".

Etay Maor

Senior Product Marketing Manager at Trusteer

Israel
Computer Software

Previous

RSA The Security Division of EMC,
Press-sense,
John Bryce

Education

IDC, Hertzelia

I use Rapport on 4 desktops & 1 laptop. (all Win 7 64bit machines)

They have never given any problems or slowdowns.

Process Lasso, reports processes of:-

RapportMamtService.exe as an average of 0.21% CPU
RapportService.exe as an average of 0.07% CPU

At the present time, they are at 0% CPU

In reply to a post by robertdelamare:

fruit, I wouldn't trust anybody with a name like "Etay Maor". Much as I tend to discount forum posts/flames from those who are ashamed to give their real names.

I don't really understand why you should object to a non-Anglo-Saxon name from the MSN news item, nor do I have a clue what the purpose of the part I have emboldened is supposed to be .

Conversely, isn't it foolish to use your real name as your nick in public?

A survey of the members of this forum, and others, shows they are a rarity.

In reference to en.wikipedia.org/wiki/Itai:

Itai is a Biblical name that appears in the Books of Samuel.

The name can also be written: Itai, Etay

In reference to en.wikipedia.org/wiki/Maor:

Maor
Name meaning: Source of light

32 MB can be more than 10% of available memory so that's not lightweight. It can also be 10% of what the OS is using. Certainly cripples XP netbooks.

Nobody I have met with it installed has the faintest clue what the icon on the right of the address bar is for, nor had they noticed it or it changing colour. So its primary modus operandi is ineffective.

If the bank recommended wearing a baseball cap with a plastic turd on the peak as a security measure would you also advocate that ? It would be as effective.

Old he may be, but fruity ? Nah !

In reply to a post by undecidedadrian:

Barclays has gone as far as you now cannot transfer money to anybody any more to combat this.
You have to go into the branch to set up a payment whitelist and use their pin protect system to transfer on that whitelist using internet banking.

I do hope your other posts on this forum have more factually accurate content in them.
'cos this one has none.

Don't you meant 1%?

My bank has a formal promise to cover any online fraud so long as reasonable care was taken. It also pushes Rapport. You can work the rest out for yourself : )

I'm with vimto girl on this. I installed Rapport when my online bank offered it last year because I think 'reasonable care' requires compliance with bank recommendations.

I had no problems installing it and I don't think it makes any difference to performance. Being a technical idiot I don't understand how or if it works; but I'm long enough in the tooth to know that the financial "industry" will dive through the tiniest loophole to avoid payment, be it phantom cash withdrawals from ATM, equally mysterious debits from accounts, or the Great Insurance Scam.

Non-installation of Rapport is just such a loophole. In fairness, I have had excellent service for the six years since I joined my bank.

I did email my bank to ask them if installing Rapport was a condition but didn't get a conclusive answer - they said this:
"We also offer free 'Rapport' security software protection that works alongside your anti-virus software to give added online protection.
The word 'offer' would make it difficult to refuse a claim for fraud wouldn't it?
My bank does allow me to use a computer in a public place such as a library and just asks me to do common sense stuff like logging-off properly etc.
If it was essential that Rapport was used then surely they would ask me to only use pc at home?

if security was critical they would issue you a bootable CD like the US Govt does and say you can only do your banking with that.

In reply to a post by gomezz:

Don't you meant 1%?

no, 32M is 10% of 320M. Windows XP running on a laptop with 512M of ram for example.

I did a test install of Rapport - added 30% to boot and shutdown time (1m and 18s resp) and was 1st and 3rd in the RAM use of running processes (#2 was McAfee endpoint AV).

How common is that these days? 3GB is much more common especially as it is the easiest and cheapest way of improving performance on an older laptop running an older OS such as I am doing here.

Edited by gomezz (Fri 03-May-13 10:47:09)

How common is that these days?

Very common in use. Of the three laptops I have worked on in the last 2 days two had exactly that. A lot of home computers are getting on a bit and were bought at a time when standard RAM was pretty low.

Netboks / nettops seem to have a particular issue with Rapport, beyond what you would expect the RAM load to do (typically they have 1G of RAM) perhaps it's something to do with the Atom chip.

In reply to a post by yarwell:

if security was critical they would issue you a bootable CD like the US Govt does and say you can only do your banking with that.

Which wold be a bit difficult with my latest HP 1202ea.

Or a tablet or mobile.

bootable SD card or USB stick then - same effect.

This is one of those cases where you have to draw the line somewhere when designing something that can run easily on antiquated kit.

Not antiquated. One of the laptops was a current work issue to an employee, the other produces a monthly magazine locally. Real world computing.

Certainly needs to carry a warning about lower spec hardware if it's being pushed at people by banks.

Should someone be doing personal banking on a company computer? Not a risk I would take.

In reply to a post by gomezz:

Should someone be doing personal banking on a company computer? Not a risk I would take.

More secure than most computers in that it's maintained, updated and has usage restrictions. It's their laptop provided by their employer, not a shared computer.

As someone can walk into a bank branch and take out your money I don't find the tension around online banking security at all compelling.

In reply to a post by yarwell:

not a shared computer

An unknowable given that at some point it may be returned and re-allocated to someone else.

Is this sort of thing still taxable as a benefit in kind?

Who is paying for the broadband connection as well?

In reply to a post by RobertoS:

Is this sort of thing still taxable as a benefit in kind?

Who is paying for the broadband connection as well?

Are you a Revenue snitch ? LOL

I don't know if home use of a work laptop is a taxable benefit in kind, as I left the wage slave environment last millennium. I do recall they were even providing tax incentives to provide employees with laptops at one point.

I do know lots of people with company provided broadband, a few of whom also have their own connection as well.

'Twas more a joke than a serious post . But a genuine consideration. It isn't every couple where the chief bridesmaid was an Inspector of Taxes LOL.