Slashdot Mirror
21 Million German Bank Accounts For Sale
anerva writes "Black market criminals are offering to sell details on 21 million German bank accounts for €12M ($15.3M), according to an investigative report (German; Google translation) published Saturday. In November reporters for WirtschaftsWoche (Economic Week) had a face-to-face meeting with criminals in a Hamburg hotel, according to the magazine. Posing as buyers working for a gambling business, the journalists were able to strike a price of €0.55 per record, or €12M for all the data. They were given a CD containing the 1.2 million accounts when they asked for assurances that the information they would be buying was legitimate." 21 million is three in four existing German bank accounts.
Couldn't you just buy one to begin with and then use that German bank account to buy the rest?
You'd think they'd have gotten the police involved instead of trying to scoop a story...
Nah, guess not.
StarTrekPhase2 - The Five Year Mission Continues!
In theory, if the banking system were known to be compromised in such a huge way, and there were no way of knowing if your own bank account was compromised or not, shouldn't there be a massive bank run? Because everyone wants to withdraw their money right away to minimize the chance that this ridiculous security leak negatively affects them, right? Such a massive erosion of confidence can completely destroy a banking system.
Even their criminality is impressively efficient :-)
I record my sleeptalking
Yah, ho hum. I mean, I bought my first 21 million German bank accounts YEARS AGO. Nothing to see here folks.
This morning the entire banking system in Germany collapsed due to 3 in 4 Germans transferring money out of the country to banks in neighboring countries....
I think the taggers in this story need to learn how to spell "Scheiße"
It is possible that not all of the 21 million work, or are valid. If I were in the criminal's position, I would offer a CD where about 70% were valid. And then when the payment was made, provide a data set that had only a few working accounts and a bunch of garbage.
In any case, it's pretty scary to think that there might that much personal data out there.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
Who wants a mass list anyway, you can't target spam at people just because they're German and they have a bank account, and stealing that many identities begs the question, "why?"
Yeah, who could have use for the equivalent of 21 million valid direct debit cards.
Rule 36 states:
There will always be even more fucked up shit than what you just saw
Now, I've been saying this all along, but nay sayers think the sky will never fall, and that the government is not out to get them. I've got bad news for you: It will, and they are, and if those two problems are not enough there will always be people willing to steal your stuff. period. no exceptions.
The fact that they have not stolen yours yet is merely an oversight on "their" part. It will happen at some point. Security is myth. Do not trust those that want to protect you. The government will never shield you, only pretend to do so. This is a harbinger of dangers to come, and reason to demand with some vigor that your financial institution be held accountable by law for the protection of your information. Yes, I mean that. If they want to do business with my money, I want guarantees. You should too.
Support NYCountryLawyer RIAA vs People
...they analyzed the bank accounts and the combined total in them is less than $1 million?
Every time you write a check, you're giving the recipient your bank address, bank account number ... AND a specimen of your signature. OMG! Quick - millions of people compromised their bank accounts today!
21 million is a lot of accounts. No one person or group has time to abuse all 21 million accounts in a timely fashion. More likely, one would need to rely on the lackadaisical attitude most people have when it comes to security coupled with a low volume approach to the number of transactions to an external account in order to profit from purchasing all 21 million accounts.
The purchaser would also have to consider just how many accounts would be accessible and for how long. It might not be practical to expect to make significantly more than 12 million euros even with 21 million accounts, since most accounts would probably have low balances or have their passwords, etc., changed rather quickly if the account had a high balance.
So to use this many accounts, one would need to set up a number of new accounts in other banks (a few at a time and more than one so that the number of transactions to a given account would not be too high), then siphon a little bit of money off a few stolen accounts to some of the new accounts, withdraw the money, then close the new accounts almost immediately. The amount withdrawn would need to be random and small enough to escape detection for at least a few days. Anything faster would surely raise suspicion and cause automatic transaction blocking (at least, if the banks have some kind of working fraud prevention), especially since the announcement of the stolen data up for sale. I can also imagine adding a fraud check for a slurry of never-seen-before transactions to new accounts. Wire transfers would be quickest, yet they would also stand out more (since a bunch of new wire transfers from accounts which had never made a wire transfer before would be unusual -- the likely case for most accounts).
The 12 million price tag seems like a number arrived at by the thieves after taking into account the difficulties to be faced in exploiting the 21 million accounts while they are still exploitable. It seems likely that any purchaser would in turn sell them again in smaller blocks (a lot safer that way, relatively speaking).
Wonder if we'll ever find out what eventually happens?
The NSA: The only part of the US government that actually listens.
the Linux desktop market share in Germany is only 25%.
Running with Linux for over 20 years!
lmao.
buying bank accounts in bulk is soo..... 2007...
You have to keep in mind the differences between countries.
In Germany, the most popular way to order stuff online is to give your bank account number to the merchant who will then charge your account.
It works just like a credit card number and stores rarely check if the number (account) really belongs to the person that's making the order.
The only time I have encountered such a check was with Paypal: ..I actually don't remember right now..either enter the correct amounts into a form on Paypal's site or to send the cents back to prove that you really have access to that account.
they do two small test transactions (just Cents) and you have to
That's 20 (twenty) million and nine hundred ninety nine thousand and ninety nine accounts, douchebag.
Sig this!
...Such as Iceland?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Nice combo-post there. You start with a subtle misunderstanding of the topic, move to a non-sequitur, then finish with a classic "begs the question" dismount.
I live in Lima Peru. Last week a teller at my bank made me wait 10 minutes while she waited for the safe to open to give me some cash. In the meantime I went to a computer terminal without a keyboard, and access to only a webpage with the bank rates (windows, no start menu, no access to desktop etc). The machine was supposedly locked so that you couldnt navigate away or do anything except scroll the page and click a few links. Well, they forgot do disable right-click. 7 steps later I was able to access their internal network, and had access to a lot of internal information on individual machines. I went to the branch manager and showed him. He was surprised and embarassed, and took note of the steps I took. It was amazing how easy was to do it. The 7 steps were clever, but not impossible.
You can reverse the charge within a 6-8 week timeframe with no questions asked, which then puts the burden on the merchant to prove that the charge was legit.
21 million is three in four existing German bank accounts.
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
I will sell them for US $1,000,000 MILLIONS US DOLLARS. Contact me via this website.
Act now and I'll throw in every Master Card ever issued. (5000 0000 0000 0000 to 5999 9999 9999 9999) (Same disclaimer as above.) And no identity thief would be complete without a REAL SOCIAL SECURITY NUMBER to go with it, eh? Guess what? That's right--I'VE GOT THEM ALL TOO! (001-01-0001 to 999-99-9999)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I had the same reaction re the number of accounts. It is small.
However, Germany isn't all that small.
So some back of the envelope calcs:
They claim 21/.75 = 28M bank accounts in Germany
It's got roughly 80M people. Assume something like 2.2 people per househould (dunno what it is in Germany), and you get 36M. You gotta figure each household has at least one. I don't know how things really work in Germany, but I assume they're like the rest of the developed world and you essentially can't function without a bank account.
Then there are businesses. Even very small businesses will run several accounts.
I think the 28M bank accounts is just bullshit. It's gotta be heaps higher.
Surely 100M wouldn't be that big a figure even?
--Q
Need an automatic screenshot taker? Try here. [16software.com]
Is your PrntScrn key broken?
Wow, that's so behind. In Norway, there's no way to charge an account without full ID. This means either approving a direct debit by showing up at the bank with your picture ID, or logging on through the (relatively) secure website.
Just allowing anyone to put a charge on a bank account number like that opens up for all sorts of abuse. Tiny transactions can go unnoticed for a long time.
Of course, debit cards in stores aren't really any safer. Nobody has ever checked the signature on one while I've used them. A signature is required when the system for some reason can't contact the bank and verify the PIN. I've used other people's cards just fine (with permission, of course, but the banks might find me signing my name a bit funky ;).
Anything but cash is broken, obviously :(
Plus, in Norway there were Vikings. And Vikings rank only slightly behind Pirates and Ninjas on the Cool-O-Meter (tm, patent pending).
As trampel pointed out: you have a 6 weeks reveal time frame. What trampel missed is: A real fraudster will have moved the money onwards by then. Which puts the loss to the bank.
Of course: As with riding without a ticket in the end we the honest customers will pay through higher bank/ticket changes.
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
Well, do you also have the personal data belonging to those VISA numbers? Like, say, owner, expiration date, etc? Because that's what this 21M bank account list is all about: it contains not just account numbers, but also all associated identifying data (names, addresses, dates of birth, in some cases even a balance).
Armed with that, criminals can easily charge those accounts and EVERYONE in Germany MUST now check their accounts at least every 6 weeks and issue reverse-charges if they discovered fraudulent activity. And that's not always obvious, because criminals can charge small amounts and label them rather innocuously, so they could go undetected (or rather: unnoticed) for longer than mere 6 weeks.
cpghost at Cordula's Web.
The article says 3 in 4 households, not accounts. Take the exaggeration factor of a newspaper into account and it works out.
If you talk to the Russians...
So you could say, "In Soviet Russia, 21 million German bank accounts buy You!"
I think he was talking about CryTek, that emo company that starts to whine and threatens to cut itself every time someone talks about violent videogames.
Justice is the sheep getting arrested while an impartial judge declares the vote void.
I live in Germany. It really is like that here. Some shops (Beate Uhse is one I can name off the top of my head) even give you 14 days to transfer the money.
I just bought a new MacBook from Apple.de using Bank Transfer. Took a day or two longer, but I'm typing it on it now :)
cmd-q.co.uk - some sort of stupid fucking internet bullshit
Yep. That is essentially the system. It is your responsibility to check each month that the charges that were made were in fact authorized. As I understand, they are very good about chargebacks (suprisingly), though I have never had to actually do this. I have used this method of payment primarily with Amazon and with airlines, but it's very often an option. Germans don't particularly like credit cards (partly because German banks don't really "get" them -- most "credit" cards actually automatically suck the full amount of the bill out of your account on the due date... which means you're not worried about exhorbitant interest rates, but you're only barely buying on credit. It's actually more of a delayed debit card.)
Thats only used for money transfers initiated by the costumer. And as there is proof that it was indeed the account owner transfering the funds (he used his secret TAN&PIN) those transfers are really hard to reverse.
It's the other way round with those Lastschriften (direct debit) easy to initiate by anyone, easy to reverse by the account holder.
bickerdyke
Strange, in Poland Paypal withdraws money from your credit card to verify that you are indeed the holder...
No, it's very common in Germany since credit cards are actually pretty uncommon (people can pay with debit cards in stores and you can get cash in forgein countires with German debit cards at Maestro-enabled ATMs).
And debit cards don't have a particular key-card number so these don't work for such transactions.
Furthermore, the payment from the account is actually pretty risk-free. You have several weeks to issue a "charge-back" with no conditions or costs attachted. The transaction fees for these charge-backs usually go with the store which issued the transaction in first place. So as long as you check your account regularily you are pretty much safe.
Because as TFA says it's "3 out of 4 households" that might be affected, not 3 out of 4 accounts.
Murphey's fighting Occam, and we're in the stands.
Pfft. We recently moved to Norway. The envelope of letter that my gf can now fetch the card from the bank was not closed. Additionally, she did no have to show her ID/passport when fetching the card. ;)
I suppose Germans are way more sensitive and bureaucratic
Wow, that's so behind. In Norway, there's no way to charge an account without full ID.
Yes there is. I've been quite scared to learn that it is possible to charge my account using my Maestro card
without its PIN code in Norway. I've been asked "Do you have a PIN code for that card?" regularly when
paying with it all over Norway - apparently, it is quite common for norwegians to have cards without them. In
such a case, the store clerk is supposed to check the ID. Guess how good or how reliably this works, especially
with foreign IDs...
??? WTF? A bank allows ANYONE to debit from your account WITHOUT any authorisation?
No. At least not in theory. The person/corporation/entity charging yout account has to get your permission
to do that first (called "Einzugsermächtigung"). Then, everyone wanting to do such charging has to get it approved
with their bank, which is not completely automatic - non-commercial entities need a very good reason to be
allowed to do that.
However, the existence of such an "Einzugsermächtigung" is not checked by the banks, so if you claim to have one, the default is
to believe you. But this also means that if such a charge happens without one, it can be reversed indefinitely. Banks like to
tell teir custemers that there is a six week limit on this, but this is only valid for charge reversals on charges that were done by
someone actually having the account holder's permission.
The whole system works surprisingly well.
"Hi, me and my friends want to buy this aircraft carrier. Can we split the check evenly over 21 million debit cards?"
All intents and purposes. Not intensive purposes.
I don't think it's that Germans don't "get" them.. it's more that they were invented to circumvent the 17th century backwardness of the US banking system. There wasn't ever any need for them in Germany, and the high charges (for the merchants) are not suited to make them popular if better solutions exist.
Note that you can overdraw your account anyway, so there is no need for the "credit" functionality either.. and since the account is balanced by the next payment from your employer, you are on average less due than with a separate "credit" account of your card.
That's true in 2008 you can actually buy banks themselves in bulk. Gotta love the credit crunch.
Biometrics are foolish.
Today, if someone gets your credit card information, they can make charges in your name. To resolve this, you inform your credit card company that someone is fraudulently using you card. Typically they'll just nix the charges and issue you a new card with a new number.
Throw in biometrics:
Someone gets your biometric information, they can make charges in your name. To resolve this, you inform your biometric-enhanced credit card company company that someone is fraudulently using you biometric information. They just nix the charges and issue you new...fingerprints?
So biometrics do go a long way toward fraud prevention. However, if it actually does occur, you're utterly and permanently fucked.
Question everything