Slashdot Log In
21 Million German Bank Accounts For Sale
Posted by
kdawson
on Mon Dec 08, 2008 09:28 PM
from the black-marks dept.
from the black-marks dept.
anerva writes "Black market criminals are offering to sell details on 21 million German bank accounts for €12M ($15.3M), according to an investigative report (German; Google translation) published Saturday. In November reporters for WirtschaftsWoche (Economic Week) had a face-to-face meeting with criminals in a Hamburg hotel, according to the magazine. Posing as buyers working for a gambling business, the journalists were able to strike a price of €0.55 per record, or €12M for all the data. They were given a CD containing the 1.2 million accounts when they asked for assurances that the information they would be buying was legitimate." 21 million is three in four existing German bank accounts.
Related Stories
Submission: 21 million German bank accounts for sale by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How to pay... (Score:5, Funny)
Couldn't you just buy one to begin with and then use that German bank account to buy the rest?
Re:How to pay... (Score:5, Funny)
And then we can beat the crap out of the office printer and dance to rap music!
Parent
Hmmm... (Score:5, Interesting)
You'd think they'd have gotten the police involved instead of trying to scoop a story...
Nah, guess not.
Re:Hmmm... (Score:5, Funny)
The police are too busy raiding game developer buildings with shotguns and listening in on Skype calls.
Parent
Re:Hmmm... (Score:5, Informative)
No, they're referring to this raid on Crytek with the riot police:
http://www.quartertothree.com/game-talk/showthread.php?t=31767
Parent
Re: (Score:3, Insightful)
That's not their job or function in society.
Re:Hmmm... (Score:5, Informative)
Uhm... no? No such thing as Good Samaritan laws here.
Good Samaritan laws have nothing to do with reporting crime, they're laws that shield those who try to help injured people from civil liability for anything that goes wrong. They're a response to the problem of people refusing to help because they're afraid they'll get sued.
Parent
Re:Hmmm... (Score:4, Informative)
You'd think they'd have gotten the police involved instead of trying to scoop a story...
From the article:
Wie so viele Kontonummern illegal in Umlauf gelangen konnten, muss in den nächsten Wochen die Staatsanwaltschaft Düsseldorf klären. Die WirtschaftsWoche übergab den Ermittlern am vergangenen Donnerstag die CD mit den 1,2 Millionen Datensätzen und Kontonummern.
which roughly means:
How that many account number reached circulation illegally is to be clarified over the next weeks by the prosecuting authorities of Düsseldorf. Reporters of the WirtschaftsWoche handed the CD with the 1.2 million data sets and account numbers to the investigators last Thursday.
So, they firstly contacted the responsible branch of jurisdiction and after that published the article.
Parent
On your marks (no pun intended) (Score:5, Insightful)
Re:On your marks (no pun intended) (Score:5, Informative)
bank account and routing numbers never was considered secure. the only thing protecting your bank account (weakly) from fraud is a paper trail.
Parent
Re:On your marks (no pun intended) (Score:5, Funny)
> In theory, if the banking system were known to be compromised in such a huge way, and
> there were no way of knowing if your own bank account was compromised or not, shouldn't
> there be a massive bank run?
This is Germany. There will be no bank run until it is properly planned, organized, and regulated.
Parent
Re: (Score:3, Informative)
None of that is truly secret information in the first place. Every business prints its address, bank account number and bank routing number on each of its invoices. When you buy something on eBay, the seller will usually give you his name, address and bank account number and bank routing number: It's the information you need to send him the money.
There is a way of transferring money which is called "Lastschrift" or "Bankeinzug". Basically the recipient tells his bank that the sender has agreed to let the re
Gotta love the germans (Score:5, Funny)
Re:May I introduce you to rule 36? (Score:5, Insightful)
OK, so you're saying that government isn't going to protect us, so the answer is to demand that financial institutions be held accountable to laws passed by a government that you said won't protect us?
Parent
Re:May I introduce you to rule 36? (Score:5, Insightful)
The government will never shield you, only pretend to do so. This is a harbinger of dangers to come, and reason to demand with some vigor that your financial institution be held accountable by law for the protection of your information.
Bolding mine, to highlight a serious disconnect in the parent's preaching.
You're suggesting that people demand that banks be held accountable to laws enforced by the very government you said won't protect them?
Parent
Tomorrow's News (Score:5, Funny)
Re: (Score:3, Funny)
...Such as Iceland?
ohshiza? (Score:5, Funny)
1.2 million out of 21 million (Score:3, Insightful)
It is possible that not all of the 21 million work, or are valid. If I were in the criminal's position, I would offer a CD where about 70% were valid. And then when the payment was made, provide a data set that had only a few working accounts and a bunch of garbage.
In any case, it's pretty scary to think that there might that much personal data out there.
How to use??? (Score:5, Interesting)
The purchaser would also have to consider just how many accounts would be accessible and for how long. It might not be practical to expect to make significantly more than 12 million euros even with 21 million accounts, since most accounts would probably have low balances or have their passwords, etc., changed rather quickly if the account had a high balance.
So to use this many accounts, one would need to set up a number of new accounts in other banks (a few at a time and more than one so that the number of transactions to a given account would not be too high), then siphon a little bit of money off a few stolen accounts to some of the new accounts, withdraw the money, then close the new accounts almost immediately. The amount withdrawn would need to be random and small enough to escape detection for at least a few days. Anything faster would surely raise suspicion and cause automatic transaction blocking (at least, if the banks have some kind of working fraud prevention), especially since the announcement of the stolen data up for sale. I can also imagine adding a fraud check for a slurry of never-seen-before transactions to new accounts. Wire transfers would be quickest, yet they would also stand out more (since a bunch of new wire transfers from accounts which had never made a wire transfer before would be unusual -- the likely case for most accounts).
The 12 million price tag seems like a number arrived at by the thieves after taking into account the difficulties to be faced in exploiting the 21 million accounts while they are still exploitable. It seems likely that any purchaser would in turn sell them again in smaller blocks (a lot safer that way, relatively speaking).
Wonder if we'll ever find out what eventually happens?
mmm... that means that ... (Score:5, Funny)
the Linux desktop market share in Germany is only 25%.
I did it last week (Score:5, Interesting)
Re: (Score:3, Informative)
If you lived in the US, you would be sitting in a jail cell right now facing felony charges FYI. Never help anyone with their computer in the US. It's not worth it.
Eh, that's not always true.
I was stuck in a Wells Fargo branch for a bit 3-4 years ago, and their kiosks would only go to wellsfargo.com. Being the enterprising person that I am, I immediately typed the HTML for a hyperlink into the search box, it worked just fine.
When I got home, I whipped up a quick Proof of Concept that abused JavaScript to d
Hmm... (Score:5, Funny)
21 million is three in four existing German bank accounts.
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
I will sell them for US $1,000,000 MILLIONS US DOLLARS. Contact me via this website.
Act now and I'll throw in every Master Card ever issued. (5000 0000 0000 0000 to 5999 9999 9999 9999) (Same disclaimer as above.) And no identity thief would be complete without a REAL SOCIAL SECURITY NUMBER to go with it, eh? Guess what? That's right--I'VE GOT THEM ALL TOO! (001-01-0001 to 999-99-9999)
It's not just numbers, ya know! (Score:3, Informative)
I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)
Well, do you also have the personal data belonging to those VISA numbers? Like, say, owner, expiration date, etc? Because that's what this 21M bank account list is all about: it contains not just account numbers, but also all associated identifying data (names, addresses, dates of birth, in some cases even a balance).
Armed with that, criminals can easily charge those accoun
Re:So what (Score:5, Funny)
Parent
Re:So what (Score:5, Funny)
lmao.
buying bank accounts in bulk is soo..... 2007...
Parent
Re:So what (Score:5, Funny)
Who wants a mass list anyway, you can't target spam at people just because they're German and they have a bank account, and stealing that many identities begs the question, "why?"
Yeah, who could have use for the equivalent of 21 million valid direct debit cards.
Parent
Re:So what (Score:4, Funny)
"Hi, me and my friends want to buy this aircraft carrier. Can we split the check evenly over 21 million debit cards?"
Parent
Exactly (Score:5, Insightful)
Every time you write a check, you're giving the recipient your bank address, bank account number ... AND a specimen of your signature. OMG! Quick - millions of people compromised their bank accounts today!
Parent
Re:Exactly (Score:4, Insightful)
Parent
Re:Exactly (Score:5, Insightful)
A wire transfer typically costs $25 outgoing and $12 incoming and you need to know the receiver's bank account # & routing number. I seriously doubt that it is used that much by most people.
You probably mean direct deposit/automated withdrawal. Sometimes, these can be a real pain to cancel once authorized. For a "reputable" vendor, I suppose it is OK, but using a VISA/MC debit card is a lot easier to fix.
Parent
Re:Exactly (Score:5, Informative)
No, he means exactly that. Wire transfers cost nothing in Europe (at least not in my country) and international wire transfers only require you to use an IBAN account number (which are already standard in some countries) and the SWIFT/BIC code. All this information is typically provided on every bill you get.
National transfers, you only need the account number that you with to wire money to. In most countries, the "bank code" is part of the account number. It most certainly is encoded in the IBAN. (Can you tell, that I implemented the IBAN code for a major bank?) IBAN is a wonderful system: a bit reading material [wikipedia.org]
Parent
Re:Exactly (Score:5, Insightful)
Parent
Re:Exactly (Score:4, Informative)
It take 1 or 3 days because they make interests on your money during this time.
Parent
Re:Exactly (Score:4, Informative)
Three day transfers are not called wires in the US. They are called ACH transfers. They are free - treated the same as checks, using the same clearing house that checks route through. Wires are instantaneous bank-to-bank transfers - you send the money at 9:47 am and it arrives at 9:47 am, usually costing a ridiculous amount of money, $5-$75 depending on your banking relationships.
Parent
Re:Exactly (Score:4, Informative)
A wire transfer typically costs $25 outgoing and $12 incoming
Even Fortis isn't that expensive... Try more something more like â3. And you have the appropriate plan ("Global Club"), you get a number of free wire transfers per quarter.
and you need to know the receiver's bank account # & routing number.
Which surprise most people do. Bank routing numbers (BIC) are published by the banks themselves, and account numbers of people wanting to receive such transfers (shops, charities, admistrations ...) are public too. And if it's family or friends, they can give you their account number easily. Oh, and usually the account number is only enough if you want to put money on an account. If you want to remove money from an account, you'll need something more, such as a password, a signature plus id, etc.
I seriously doubt that it is used that much by most people.
Well, here in Europe, it is used very commonly, for all kinds of things.
Parent
Re:Exactly (Score:5, Funny)
Parent
Re:Exactly (Score:5, Informative)
You then arrange the stealing/pickpocketing of cards. More likely, you request freshly stolen cards from a specialist. Some of those cards are going to marry up with the information you already hold, and may be enough to leverage funds.
Don't believe criminals are this organised? An example from personal experience. Turns out a machine at my other half's work was compromomised with a keystroke/screenshot recorder infection. First we haerd of it was when all our accounts were cleared out - someone had been organised enough to patiently continue recording "please enter X and Y character of your password" long enough to piece together the full password. They'd then used this on a saturday before a bank holiday to transfer all of our funds into another account at the same bank - this clears instantly and has less restrictions. They had then coordinated with someone in the UK who could provide them with a stolen debit card issued by the same bank, transferred our money into that account, and got a stooge to go into the bank just before it shut on saturday and take all that money out in cash - within hours of initial transfer.
End result? We were cleaned out, some innocent who had their card nicked had their bank account abused, and the criminals got our money in cash, untraceably. 6-8 weeks later, we were refunded but it was a long and unpleasant experience that taught me several things:
1) Don't assume your bank has a coherent identity theft/fraud department. Expect to get bounced around outsourced call centers that don't communicate with each other or the police. Don't expect them to be interested in IP logs or anything else you think might help them catch the hackers, either
2) "Organised crime" isn't just a phrase. They're quite advanced now, even outsourcing the donkeywork on the ground to other organisations
3) Two-factor authentication is a Good Thing with online banking
4) Don't do online banking on someone elses' computer
Parent
Re:Exactly (Score:4, Interesting)
Checks have to be hand processed. Mailed in checks haveto have a Person paid to open it and key it in and then hand carried to a bank.
Yet when I pay electronically on the internet where NO costs in labor are had, I am CHARGED a convience fee for doing so.
Only because of Fradulent tactics by businesses and banks are paper checks still in heavy use. If these companies were not blatently trying to rip me off, I'd pay via online all the time. Instead I send them a paper check that costs them more money to process.
Paying my Gas bill is more expensive online with a bank card payment than me sending them a check or even the bill WITH my bankcard info on it for them to process. I refuse to pay $10.00US convience fee to make their life easier and cheaper.
Parent
Re:So what (Score:5, Informative)
You have to keep in mind the differences between countries.
In Germany, the most popular way to order stuff online is to give your bank account number to the merchant who will then charge your account.
It works just like a credit card number and stores rarely check if the number (account) really belongs to the person that's making the order.
The only time I have encountered such a check was with Paypal: ..I actually don't remember right now..either enter the correct amounts into a form on Paypal's site or to send the cents back to prove that you really have access to that account.
they do two small test transactions (just Cents) and you have to
Parent
Re:So what (Score:5, Informative)
Wow, that's so behind. In Norway, there's no way to charge an account without full ID. This means either approving a direct debit by showing up at the bank with your picture ID, or logging on through the (relatively) secure website.
Just allowing anyone to put a charge on a bank account number like that opens up for all sorts of abuse. Tiny transactions can go unnoticed for a long time.
Of course, debit cards in stores aren't really any safer. Nobody has ever checked the signature on one while I've used them. A signature is required when the system for some reason can't contact the bank and verify the PIN. I've used other people's cards just fine (with permission, of course, but the banks might find me signing my name a bit funky ;).
Anything but cash is broken, obviously :(
Parent
Re:So what (Score:5, Funny)
Parent
6 weeks reversal (Score:3, Interesting)
As trampel pointed out: you have a 6 weeks reveal time frame. What trampel missed is: A real fraudster will have moved the money onwards by then. Which puts the loss to the bank.
Of course: As with riding without a ticket in the end we the honest customers will pay through higher bank/ticket changes.
Re: (Score:3, Informative)
If they can't, because it's some other bank or because the business would be able to fight it, they ponder what's more hassle: Duking it out with you or with them.
Now guess who's less likely to be able to mount a lengthy legal battle, you or the other bank.
I'm British, but Germany is similar.
We have consumer protection laws that prevent that kind of thing. And also a legal system that isn't quite so in favour of big businesses.
Re:So what (Score:4, Interesting)
Parent
Re: (Score:3, Informative)
Re:21 million is 3/4 of accounts? (Score:5, Interesting)
I had the same reaction re the number of accounts. It is small.
However, Germany isn't all that small.
So some back of the envelope calcs:
They claim 21/.75 = 28M bank accounts in Germany
It's got roughly 80M people. Assume something like 2.2 people per househould (dunno what it is in Germany), and you get 36M. You gotta figure each household has at least one. I don't know how things really work in Germany, but I assume they're like the rest of the developed world and you essentially can't function without a bank account.
Then there are businesses. Even very small businesses will run several accounts.
I think the 28M bank accounts is just bullshit. It's gotta be heaps higher.
Surely 100M wouldn't be that big a figure even?
--Q
Parent
Re: (Score:3, Funny)
Need an automatic screenshot taker? Try here. [16software.com]
Is your PrntScrn key broken?
Re: (Score:3, Funny)