Phishing e complici

Luca Sambucci scrive di una particolare email ricevuta, che apparentemente è l’ennesimo tentativo di phishing per carpire dati bancari. Credo però che si sbagli e che l’email serva invece a reclutare intermediari italiani per iltrasferimento di fondi dal truffato al phisher.

Il meccanismo è spiegato bene dall’Honeynet Project:

Further Observations – Fund Transfer

[...] Since foreign currency transfers are monitored by most banks, phishers cannot simply transfer large amounts of money from one country to another without alerting the financial authorities. Phishers therefore have to use intermediaries to transfer money for them – in a two stage process the phisher transfers money from the victim’s bank account to a bank account of an intermediary in the same country. The intermediary then withdraws the money from their bank account (less a percentage remuneration for providing the service) and sends it to the phisher, for example by surface mail. Of course, the intermediary could be caught, but as the phisher’s money is already in transit they do not face too much risk and can easily change to channel their funds through a replacement intermediary. An example email demonstrating some of the financial structures behind phishing attacks is show below:

Hello!
We finding Europe persons, who can Send/Receive bank wires
from our sellings, from our European clients. To not pay
TAXES from international transfers in Russia. We offer 10%
percent from amount u receive and pay all fees, for sending
funds back.Amount from 1000 euro per day. All this activity
are legal in Europe.
Fill this form: http://XXX.info/index.php (before filling
install yahoo! messenger please or msn), you will recieve
full details very quickly.

Le truffe a Fineco, Poste, Unicredit evidentemente generano soldi, che devono essere trasferiti nelle tasche dei truffatori in modo sicuro e difficile da rintracciare: niente di meglio che un intermediario in Italia, che in cambio di una percentuale trasferica i soldi in piccole somme non soggette a vigilanza, ripulendoli.

Aggiornamento: ne parla anche Paolo Attivissimo, aderendo all’ipotesi della ricerca di intermediari.

Segnala presso:

No related posts.

This entry was posted on 16 settembre 2005 at 7:29 and is filed under sicurezza ICT. You can follow any responses to this entry through the RSS 2.0 feed.