14 DAY TRIAL // Customers of Germany’s Deutsche Bank are advised to be on the lookout for fake notifications in which they’re asked to hand over pictures of their TAN (Transaction Authentication Number) list. The information is allegedly needed because the bank is switching to mobile TAN (mTAN) system.
Victims are presented with a phishing website that almost perfectly replicates the one of Deutsche Bank. Here, they’re asked to hand over their online banking credentials and other information, The H informs.
However, since usernames and passwords are not enough for the crooks to gain access to accounts, they also try to convince customers to hand over photos or scans of their TAN lists.
In order to ensure the success of their campaign, the cybercriminals pressure their potential victims by informing them that their accounts would be disabled if they fail to provide the information by the next day.
The attackers are leveraging the fact that many German banks are in the process of switching from iTAN to mobile TAN (mTAN) systems.
TANs are often utilized by financial institutions to protect their customers’ transactions. Many German banks provide their customers with a list of TANs printed out on paper.
Whenever users want to perform a transaction, besides their usernames and passwords, they must also utilize one of the codes from the TAN list.
By convincing people to hand over photographs or scans of their TAN lists, cybercriminals can make sure they have everything they need to empty their victims’ accounts.
Those who receive such emails are advised to verify their legitimacy by contacting the bank. However, the financial institution should never be called or emailed by using the information provided in the unsolicited email.
Although this particular campaign focuses on users from Germany, the customers of any financial institution that uses TANs to secure transactions could also be targeted in a similar way.