Slashdot Mirror
21 Million German Bank Accounts For Sale
anerva writes "Black market criminals are offering to sell details on 21 million German bank accounts for €12M ($15.3M), according to an investigative report (German; Google translation) published Saturday. In November reporters for WirtschaftsWoche (Economic Week) had a face-to-face meeting with criminals in a Hamburg hotel, according to the magazine. Posing as buyers working for a gambling business, the journalists were able to strike a price of €0.55 per record, or €12M for all the data. They were given a CD containing the 1.2 million accounts when they asked for assurances that the information they would be buying was legitimate." 21 million is three in four existing German bank accounts.
This sort of thing has been available for years, at the same sorts of prices. Who wants a mass list anyway, you can't target spam at people just because they're German and they have a bank account, and stealing that many identities begs the question, "why?". Maybe Poland is going to invade them back or something :D
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
Couldn't you just buy one to begin with and then use that German bank account to buy the rest?
You'd think they'd have gotten the police involved instead of trying to scoop a story...
Nah, guess not.
StarTrekPhase2 - The Five Year Mission Continues!
"In the Jews' defense, a fool and his money are soon parted." -Oscar Wilde
In theory, if the banking system were known to be compromised in such a huge way, and there were no way of knowing if your own bank account was compromised or not, shouldn't there be a massive bank run? Because everyone wants to withdraw their money right away to minimize the chance that this ridiculous security leak negatively affects them, right? Such a massive erosion of confidence can completely destroy a banking system.
No really. This is SCARY.
Yes Virginia, there are bad people in this world.
Need an automatic screenshot taker? Try here.
Even their criminality is impressively efficient :-)
I record my sleeptalking
This morning the entire banking system in Germany collapsed due to 3 in 4 Germans transferring money out of the country to banks in neighboring countries....
I think the taggers in this story need to learn how to spell "Scheiße"
It is possible that not all of the 21 million work, or are valid. If I were in the criminal's position, I would offer a CD where about 70% were valid. And then when the payment was made, provide a data set that had only a few working accounts and a bunch of garbage.
In any case, it's pretty scary to think that there might that much personal data out there.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Rule 36 states:
There will always be even more fucked up shit than what you just saw
Now, I've been saying this all along, but nay sayers think the sky will never fall, and that the government is not out to get them. I've got bad news for you: It will, and they are, and if those two problems are not enough there will always be people willing to steal your stuff. period. no exceptions.
The fact that they have not stolen yours yet is merely an oversight on "their" part. It will happen at some point. Security is myth. Do not trust those that want to protect you. The government will never shield you, only pretend to do so. This is a harbinger of dangers to come, and reason to demand with some vigor that your financial institution be held accountable by law for the protection of your information. Yes, I mean that. If they want to do business with my money, I want guarantees. You should too.
Support NYCountryLawyer RIAA vs People
sell sell sell
dann kamen sie fur meine Kreditkartennummer- und Provider-Kennworter.
Ich zahlte 10 Euro und aller, den ich erhielt, war Orion Blastar' Konto-LOGON und -kennwort s-Slashdot.
Just kidding, Babelfish doesn't translate it quite right.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
21 million accounts on the wall 21 million accounts you take one down you pass it around 21 million and nine hundred ninety nine thousand and ninety nine accounts on the wall
...they analyzed the bank accounts and the combined total in them is less than $1 million?
Ha Ha! You have a small country !!1!
I want to delete my account but Slashdot doesn't allow it.
Every time you write a check, you're giving the recipient your bank address, bank account number ... AND a specimen of your signature. OMG! Quick - millions of people compromised their bank accounts today!
Information wants to be free. Your information is just a series of bits - and once you allow others to feel your bits you allow them the right to do WHAT THEY WANT to your bits, whether it be burning them to a CD, or moving them to another computer, or sharing them with their friends.
Down with DRM!
21 million is a lot of accounts. No one person or group has time to abuse all 21 million accounts in a timely fashion. More likely, one would need to rely on the lackadaisical attitude most people have when it comes to security coupled with a low volume approach to the number of transactions to an external account in order to profit from purchasing all 21 million accounts.
The purchaser would also have to consider just how many accounts would be accessible and for how long. It might not be practical to expect to make significantly more than 12 million euros even with 21 million accounts, since most accounts would probably have low balances or have their passwords, etc., changed rather quickly if the account had a high balance.
So to use this many accounts, one would need to set up a number of new accounts in other banks (a few at a time and more than one so that the number of transactions to a given account would not be too high), then siphon a little bit of money off a few stolen accounts to some of the new accounts, withdraw the money, then close the new accounts almost immediately. The amount withdrawn would need to be random and small enough to escape detection for at least a few days. Anything faster would surely raise suspicion and cause automatic transaction blocking (at least, if the banks have some kind of working fraud prevention), especially since the announcement of the stolen data up for sale. I can also imagine adding a fraud check for a slurry of never-seen-before transactions to new accounts. Wire transfers would be quickest, yet they would also stand out more (since a bunch of new wire transfers from accounts which had never made a wire transfer before would be unusual -- the likely case for most accounts).
The 12 million price tag seems like a number arrived at by the thieves after taking into account the difficulties to be faced in exploiting the 21 million accounts while they are still exploitable. It seems likely that any purchaser would in turn sell them again in smaller blocks (a lot safer that way, relatively speaking).
Wonder if we'll ever find out what eventually happens?
The NSA: The only part of the US government that actually listens.
This is the scariest headline I've read in a long, long time. If this information allows remote access to the accounts then a concerted group effort could _completely_ destroy most German depository institutions by conducting mass withdrawals.
If German banks have reserve requirements similar to American banks (10%) then they would only have enough capitol to cover 1/6th of the potential withdrawals. Not only would this lead the banks not to have any working capitol (the life-blood of every bank. See: 02008 financial crisis), but would leave nothing left over for uncompromised account holders. Deposit insurance notwithstanding, I'm sure you know what would happen if the general public found out about this.
Organized criminals smart enough to buy 24M bank accounts are probably also smart enough to know this and take advantage of the corresponding extortionary power. I seriously cannot believe we are reading about this. If I was in German law enforcement there's absolutely no way I'd let this story see press. The fact that it was undercover reporters and not cops in that meeting amazes me.
I really, really hope that the cops and banks react more swiftly to this story than the German public. I'm also praying that the mechanism by which this information was stolen is limited to Germany...
the Linux desktop market share in Germany is only 25%.
Running with Linux for over 20 years!
...Such as Iceland?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Just adding my bit to the spirit of your post if I may: I want to believe
I live in Lima Peru. Last week a teller at my bank made me wait 10 minutes while she waited for the safe to open to give me some cash. In the meantime I went to a computer terminal without a keyboard, and access to only a webpage with the bank rates (windows, no start menu, no access to desktop etc). The machine was supposedly locked so that you couldnt navigate away or do anything except scroll the page and click a few links. Well, they forgot do disable right-click. 7 steps later I was able to access their internal network, and had access to a lot of internal information on individual machines. I went to the branch manager and showed him. He was surprised and embarassed, and took note of the steps I took. It was amazing how easy was to do it. The 7 steps were clever, but not impossible.
I'm not sure which is more of a security breach:
That the criminals were able to get 3/4 of information for German bank accounts through a call center...
Or that they were were duped into exposing their identity to a bunch of journalists.
21 million is 3 in every 4 bank accounts? What do the rest of the 80+ million population use?
Seriously, is this story a plant to "shove" the German banking system into the same "tornado" that the English, Irish, Americans, etc.. have been experiencing lately? Seriously.. have not the Germans been hanging onto their economy (by a thread I may add) while other EU countries have spiraled? I smell a "fish".. . Get German citizens to withdraw their money from banks and cause yet another country to collapse.. .
"Trusting every aspect of our lives to a giant computer was the smartest thing we ever did.." Homer Simpson
21 million is three in four existing German bank accounts.
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
I will sell them for US $1,000,000 MILLIONS US DOLLARS. Contact me via this website.
Act now and I'll throw in every Master Card ever issued. (5000 0000 0000 0000 to 5999 9999 9999 9999) (Same disclaimer as above.) And no identity thief would be complete without a REAL SOCIAL SECURITY NUMBER to go with it, eh? Guess what? That's right--I'VE GOT THEM ALL TOO! (001-01-0001 to 999-99-9999)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
In November reporters ... had a face-to-face meeting with criminals
So, where were the cops? How do you say "Denny's" in German?
Seriously, most of our local police force is working undercover at the local titty club, buying lap dances.
Have gnu, will travel.
Dude, I don't think Microsoft would stoop that low? Really?
Under the influence of Post-Cyberpunk Gonzo Journalism
Perhaps the GP is referring to the Steve Jackson Games raid that took place here in Austin, TX back in the eighties.
Seth
$5 / month hosted VPS on linux = awesome!
Yes, we switched to Linux. All of us. We can tell because all Germans share a hive mind. That's also why we all use the same bank account (plus 20,999,999 business accounts).
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
As the German tax office paid someone to steal all the banking details of customers of a Lichtenstein bank, they surely have condoned this type of action.
Apparently it's OK if you think someone may owe you money - or owe anyone else money as the details were also sold to other countries.
As trampel pointed out: you have a 6 weeks reveal time frame. What trampel missed is: A real fraudster will have moved the money onwards by then. Which puts the loss to the bank.
Of course: As with riding without a ticket in the end we the honest customers will pay through higher bank/ticket changes.
I would find it to be completely unsurprising to find that the source of this information is someone within the German government, an employee, had collected and made available to criminals this information. It would seem an information pool this large could only come from such a source. Other data compromises, in my view, would seem individually unlikely to product a rate as high as 75% of all.
If I am right in this guess, it would show a strong reason why any government should not be collecting this kind of data on people. Not only is it a certainty that government itself would abuse the information, but employees with access to it would be tempted to abuse it. The government extracts far more trust of its people than it is deserving.
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
Well, do you also have the personal data belonging to those VISA numbers? Like, say, owner, expiration date, etc? Because that's what this 21M bank account list is all about: it contains not just account numbers, but also all associated identifying data (names, addresses, dates of birth, in some cases even a balance).
Armed with that, criminals can easily charge those accounts and EVERYONE in Germany MUST now check their accounts at least every 6 weeks and issue reverse-charges if they discovered fraudulent activity. And that's not always obvious, because criminals can charge small amounts and label them rather innocuously, so they could go undetected (or rather: unnoticed) for longer than mere 6 weeks.
cpghost at Cordula's Web.
I have always had this lingering suspicion that the sudden, unexpected worldwide effect of the"US sub-prime crisis" could actually really be a landslide of compromised accounts by criminals, worldwide. In Canada there was a sudden increase of cases when bank accounts were emptied - sometimes even compromised second time, after the bank red flagged the account. The bank clients I am aware of got full refund. Obviously, this does not help the balance sheet and I actually never heard in the media any related news.
The unprecedented worldwide government intervention to "rescue the banking systems" also points to something else then just the "sudden, unexpected realization how wide-spread the US sub-prime crises really is".
You need a bit more than just the account info. You also need a sucker, having the qualities of stupid, gullible and greedy.
You get that account info. Next, you send out spam asking for people who want to earn a load of money for little, easy work. You are allegedly a big, international company that doesn't have a local office and wants to avoid the horrible local fees they impose on foreign companies (that bastard government wanting to rip you off, ya know?) when they open an account there, so you want to give that person, say, 20% of the transfered amount. Yeah, paying someone 20% of 10k is cheaper than whatever some government charges foreign companies for having an account... I didn't say it makes sense, ok? I said you need someone who is stupid, gullible and greedy.
When you found your sucker, you use that system to transfer money from the account that you know of to the sucker's account, and inform him that he has to immediately take the money (he may keep his 20%, of course) and send it to you through a way that cannot be reversed. Say, Western Union.
What happens next is that the person whose account you used for the transfer will notice a serious amount of money is missing and has his bank reverse that transaction. His bank will do that, no questions asked.
And the sucker's down 10k (minus the 20% he may keep, of course), because Western Union will at best laugh at him when he wants his money back.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Well, mum's gone to iceland.
As seen with the affair Liechtenstein, the German Tax office is above the law, they can buy this data and nobody will as much as blink that they have thus given new life to the market in stolen data (read: endangering everyone, not just tax escapees who will, instead, emigrate and no longer pay any taxes into German coffers at all). Worse: other nations have bought that data, putting them legally in the same shaky legal boat with the difference that they have at least not acted as a dealer themselves.
AFAIK the US has under Bush applied a similar lack of control to their own laws, but more on the international front (in case you have the memory span of a hamster, it starts with "G" and ends in "Bay"), and they ignore international agreements when it suits them (hence a total lack of trust).
The problem for the sellers in this case is that the German tax office doesn't need *this* data but hey, if they have anything else they'll have it. And resell it.
The good news: at least in the UK I assume the market for stolen data has all but collapsed. All you need there is to check for CDs in the post, papers on trains or stray USB keys lying around in car parks (or hand out chocolate at tube stations, according to a survey I saw a while back).
Next up: government staff offering a new identity to the sellers.. /cynic
Since more than one person asked what you could do with this information, allow me to tell you a few things how the system works here in Europe.
The first possible use I have detailed above, you find some gullible fool, transfer money to him, have him forward money through WU or some other company that doesn't allow reversals and you get money.
If you need more privileges to the account, call their 24 hours service. They will ask you to identify yourself, and for this you need your account number and your name, and since you have forgotten your supersecret phrase, they will ask you for details about your account that only you usually can know, like your balance or the person responsible for you at your bank (every account here has its "personal account assistant", i.e. some person working at the bank responsible for pushing products at you). This allows you to request things mailed to your address (or change your address while you're at it), to get, say, online banking credentials, bank cards (for withdrawal), PIN numbers, replacement Credit cards and so on.
Given a recent demand from the European Union that made our formerly rather secure mailboxes (the snail mail ones) pretty insecure (to enable various hardcopy spammers to dump their junk into our mail), it's trivial to intercept the letters containing that, since they're sent out as standard mail (no signatures necessary).
Of course you can also bypass that and use phone banking, the only risk is that you're actually dealing with a real person which might (just might, they're quite underpaid and thus incredibly motivated to think past what they're paid for) just smell a fish. Or phish, for that matter.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Basically a form of one time password.
http://en.wikipedia.org/wiki/Transaction_authentication_number
e.g.
http://www.germanbanks.org/html/19_consumers/consumers_04_2.asp
While the potential for identity theft is high and the accounts should never have made it out of the banks, the use of PIN and TAN codes reduces the risk somewhat.
Deleted
Sorry Bentov, but that news is about nine months old. :-P
Thats only used for money transfers initiated by the costumer. And as there is proof that it was indeed the account owner transfering the funds (he used his secret TAN&PIN) those transfers are really hard to reverse.
It's the other way round with those Lastschriften (direct debit) easy to initiate by anyone, easy to reverse by the account holder.
bickerdyke
21 million is three in four existing German bank accounts.
Errr.... no?
Germany has about 80 mio. people living in it. Almost everyone who is not a small child has a bank account here. Most kids are given one by their parents somewhere around age 6-10 (depending on the parents) for savings. A lot of people have more than one bank account. One in four sounds more like it.
And that's just private accounts. I can't even guess at the number of bank accounts that companies have.
Assorted stuff I do sometimes: Lemuria.org
My money's still there.
*reloads*
Scheiße!!!
The TAN/PIN system is only used for money transfers, not for any debit direct payments.
Have a look here to get an idea of what he's suggesting: [http://shafee.net/blog/?page_id=295]
All you need to do is to generate the numbers and then throw out the ones that fail the checksum and viola, you have a list of valid numbers. What you don't have is the details to go with it, which is why it's a joke.
Having said that, CC security IS a bit of a joke. I know of a *perfectly* safe CC that goes beyond the "card present" requirement for security and does not need a secure terminal infrastructure because the card itself is safe. And it doesn't need installation (i.e. it doesn't matter if the system used for transmission is edge-to-edge infested with every trojan and MITM attack known to man), nor does it have postal theft risk as it does not need pre-customisation like an "ordinary" CC does.
It does, however, still need some time to be distributed so I don't expect that thing to make a dent in CC fraud until well into 2010. If VISA and Mastercard accept it to start with..
Insert
21 million is three in four existing German bank accounts.
Certainly not. Germany has over 80 million inhabitants, and it is very common even for
"ordinary people" to have more than one account. And that's not counting all the corporate accounts,
small businesses with accounts at every local bank, etc.
Of course, this doesn't mean there isn't a problem. It is estimated that the data of more than 80% of
german bank accounts can be pruchased on the black market. But this would be way over a hundred million accounts.
Sounds like a story the government could feed the press in order to catch people. Similar to government run websites that look like terrorist or kiddy porn sites.
Maybe, maybe not
Think would bother you if you only stole $1 from every account once a month?
actually that's the good scenario -- for the bad scenario s/3 in 4 Germans/massive criminal scam/ ... :)
Ha! I moved everything to Iceland just in time.
and here's this one gold bar, I'm sure you can tell that it's real gold. Yessiree, real gold. That whole box in the truck. But of course, all you can check is the one bar.
These are, after all, criminals that you are talking about. Who is to say that they were not also con artists?
However, if you assume that even half the account IDs on the disk were valid, that's still in the neighborhood of 2% of all German accounts (if the 21 mil = 3/4 number holds true).
Those thieves should be super rich by now.
Selling a CD Rom to a news crew was just the beginning, I bet.
They are probably selling the other 120 copies they'd made of that CD Rom to other people/groups in other countries all this past week.
These are thieves. after all_
If it has tires or tits, it will give you problems.
In India also Wire transfer does not cost anything.
What is sheer idiocy is storing them in a central database like the US and UK do - I agree with you 100%.
That is one single point of failure: change the record and you are indeed screwed. However, have them as means to access a local resource (like a biometric card that holds the prints as a has ON THE CARD ITSELF and doesn't send them onwards) is a good idea.
There's also the use of biometrics. For identification it sucks, because of the granularity you WILL get eventually identical results (as an example, if I use hair color as metric I will start to get repeats after I've done about 5 people - and here too I have some people that do not register at all because they're bald). This is also why big databases are simply useless. It's as useful as assuming that everyone called George Bush is/was a president..
However, for authentication it works as you need a much lower granularity to guarantee exclusivity. All I need to confirm is that for a given situation there is a high probability that I have indeed the right physical person. That works, because I pair that with a username or account.
And here endeth today's lesson. Sorry if it was a bit lecturish, but the distinctions above are critical to evaluate the use of biometrics in context. Whoever wants to store biometrics in a big database needs to explain to me first why he thinks treating me as a criminal in advance of a crime is acceptable. And that's the same question YOU should ask - as that precedes all this "if you don't have anything to hide you won't mind" nonsense that is spouted so often as an argument why it might be acceptable. It isn't.
Insert