21 Million German Bank Accounts For Sale

anerva writes "Black market criminals are offering to sell details on 21 million German bank accounts for €12M ($15.3M), according to an investigative report (German; Google translation) published Saturday. In November reporters for WirtschaftsWoche (Economic Week) had a face-to-face meeting with criminals in a Hamburg hotel, according to the magazine. Posing as buyers working for a gambling business, the journalists were able to strike a price of €0.55 per record, or €12M for all the data. They were given a CD containing the 1.2 million accounts when they asked for assurances that the information they would be buying was legitimate." 21 million is three in four existing German bank accounts.

How to pay...

Couldn't you just buy one to begin with and then use that German bank account to buy the rest?

Re:How to pay...

And then we can beat the crap out of the office printer and dance to rap music!

Hmmm...

You'd think they'd have gotten the police involved instead of trying to scoop a story...

Nah, guess not.

Re:Hmmm...

The police are too busy raiding game developer buildings with shotguns and listening in on Skype calls.

On your marks (no pun intended)

In theory, if the banking system were known to be compromised in such a huge way, and there were no way of knowing if your own bank account was compromised or not, shouldn't there be a massive bank run? Because everyone wants to withdraw their money right away to minimize the chance that this ridiculous security leak negatively affects them, right? Such a massive erosion of confidence can completely destroy a banking system.

Re:On your marks (no pun intended)

bank account and routing numbers never was considered secure. the only thing protecting your bank account (weakly) from fraud is a paper trail.

Re:On your marks (no pun intended)

> In theory, if the banking system were known to be compromised in such a huge way, and
> there were no way of knowing if your own bank account was compromised or not, shouldn't
> there be a massive bank run?

This is Germany. There will be no bank run until it is properly planned, organized, and regulated.

Gotta love the germans

Even their criminality is impressively efficient :-)

Re:May I introduce you to rule 36?

OK, so you're saying that government isn't going to protect us, so the answer is to demand that financial institutions be held accountable to laws passed by a government that you said won't protect us?

Re:May I introduce you to rule 36?

The government will never shield you, only pretend to do so. This is a harbinger of dangers to come, and reason to demand with some vigor that your financial institution be held accountable by law for the protection of your information.

Bolding mine, to highlight a serious disconnect in the parent's preaching.

You're suggesting that people demand that banks be held accountable to laws enforced by the very government you said won't protect them?

Tomorrow's News

This morning the entire banking system in Germany collapsed due to 3 in 4 Germans transferring money out of the country to banks in neighboring countries....

ohshiza?

I think the taggers in this story need to learn how to spell "Scheiße"

How to use???

21 million is a lot of accounts. No one person or group has time to abuse all 21 million accounts in a timely fashion. More likely, one would need to rely on the lackadaisical attitude most people have when it comes to security coupled with a low volume approach to the number of transactions to an external account in order to profit from purchasing all 21 million accounts.

The purchaser would also have to consider just how many accounts would be accessible and for how long. It might not be practical to expect to make significantly more than 12 million euros even with 21 million accounts, since most accounts would probably have low balances or have their passwords, etc., changed rather quickly if the account had a high balance.

So to use this many accounts, one would need to set up a number of new accounts in other banks (a few at a time and more than one so that the number of transactions to a given account would not be too high), then siphon a little bit of money off a few stolen accounts to some of the new accounts, withdraw the money, then close the new accounts almost immediately. The amount withdrawn would need to be random and small enough to escape detection for at least a few days. Anything faster would surely raise suspicion and cause automatic transaction blocking (at least, if the banks have some kind of working fraud prevention), especially since the announcement of the stolen data up for sale. I can also imagine adding a fraud check for a slurry of never-seen-before transactions to new accounts. Wire transfers would be quickest, yet they would also stand out more (since a bunch of new wire transfers from accounts which had never made a wire transfer before would be unusual -- the likely case for most accounts).

The 12 million price tag seems like a number arrived at by the thieves after taking into account the difficulties to be faced in exploiting the 21 million accounts while they are still exploitable. It seems likely that any purchaser would in turn sell them again in smaller blocks (a lot safer that way, relatively speaking).

Wonder if we'll ever find out what eventually happens?

mmm... that means that ...

the Linux desktop market share in Germany is only 25%.

I did it last week

I live in Lima Peru. Last week a teller at my bank made me wait 10 minutes while she waited for the safe to open to give me some cash. In the meantime I went to a computer terminal without a keyboard, and access to only a webpage with the bank rates (windows, no start menu, no access to desktop etc). The machine was supposedly locked so that you couldnt navigate away or do anything except scroll the page and click a few links. Well, they forgot do disable right-click. 7 steps later I was able to access their internal network, and had access to a lot of internal information on individual machines. I went to the branch manager and showed him. He was surprised and embarassed, and took note of the steps I took. It was amazing how easy was to do it. The 7 steps were clever, but not impossible.

Hmm...

21 million is three in four existing German bank accounts.

I have for sale EVERY VISA NUMBER EVER ISSUED! From 4000 0000 0000 0000 to 4999 9999 9999 9999! (Note: some numbers may not be valid.)

I will sell them for US $1,000,000 MILLIONS US DOLLARS. Contact me via this website.

Act now and I'll throw in every Master Card ever issued. (5000 0000 0000 0000 to 5999 9999 9999 9999) (Same disclaimer as above.) And no identity thief would be complete without a REAL SOCIAL SECURITY NUMBER to go with it, eh? Guess what? That's right--I'VE GOT THEM ALL TOO! (001-01-0001 to 999-99-9999)

Re:So what

Yah, ho hum. I mean, I bought my first 21 million German bank accounts YEARS AGO. Nothing to see here folks.

Re:So what

lmao.

buying bank accounts in bulk is soo..... 2007...

Re:So what

Who wants a mass list anyway, you can't target spam at people just because they're German and they have a bank account, and stealing that many identities begs the question, "why?"

Yeah, who could have use for the equivalent of 21 million valid direct debit cards.

Exactly

But an account number is not the equivalent of a direct debit card. It's not that easy to withdraw money from an account when all you have is the account number.

Every time you write a check, you're giving the recipient your bank address, bank account number ... AND a specimen of your signature. OMG! Quick - millions of people compromised their bank accounts today!

Re:Exactly

A wire transfer typically costs $25 outgoing and $12 incoming and you need to know the receiver's bank account # & routing number. I seriously doubt that it is used that much by most people.

You probably mean direct deposit/automated withdrawal. Sometimes, these can be a real pain to cancel once authorized. For a "reputable" vendor, I suppose it is OK, but using a VISA/MC debit card is a lot easier to fix.

Re:So what

You have to keep in mind the differences between countries.
In Germany, the most popular way to order stuff online is to give your bank account number to the merchant who will then charge your account.
It works just like a credit card number and stores rarely check if the number (account) really belongs to the person that's making the order.

The only time I have encountered such a check was with Paypal:
they do two small test transactions (just Cents) and you have to ..I actually don't remember right now..either enter the correct amounts into a form on Paypal's site or to send the cents back to prove that you really have access to that account.

Re:So what

Wow, that's so behind. In Norway, there's no way to charge an account without full ID. This means either approving a direct debit by showing up at the bank with your picture ID, or logging on through the (relatively) secure website.

Just allowing anyone to put a charge on a bank account number like that opens up for all sorts of abuse. Tiny transactions can go unnoticed for a long time.

Of course, debit cards in stores aren't really any safer. Nobody has ever checked the signature on one while I've used them. A signature is required when the system for some reason can't contact the bank and verify the PIN. I've used other people's cards just fine (with permission, of course, but the banks might find me signing my name a bit funky ;).

Anything but cash is broken, obviously :(

Re:So what

Plus, in Norway there were Vikings. And Vikings rank only slightly behind Pirates and Ninjas on the Cool-O-Meter (tm, patent pending).

Re:21 million is 3/4 of accounts?

I had the same reaction re the number of accounts. It is small.

However, Germany isn't all that small.

So some back of the envelope calcs:

They claim 21/.75 = 28M bank accounts in Germany

It's got roughly 80M people. Assume something like 2.2 people per househould (dunno what it is in Germany), and you get 36M. You gotta figure each household has at least one. I don't know how things really work in Germany, but I assume they're like the rest of the developed world and you essentially can't function without a bank account.

Then there are businesses. Even very small businesses will run several accounts.

I think the 28M bank accounts is just bullshit. It's gotta be heaps higher.

Surely 100M wouldn't be that big a figure even?

--Q