BRIAN ROSS REPORTS
- Like Jay-Z + the Beatles, But Worse
- Update: Help for Homeless Children
- Bush Era, Revised -- and with More Barbeque
- The Tax Woman Cometh
- Paging Mr. Stanford: Antigua Called
- Who Are You Calling Partisan?
- Update: IRS Won't Use Private Debt Collectors
- But Is It Art?
- PMA Scandal a Sore Point for Dems in 2010?
- Down in Flames
- A New Mystery for RNC Chief
- PMA Clients Were Big Givers
- Raided Lobby Firm Still a Force on Capitol Hill
- Stanford Update: Another $143 Mil Found
- Cheney, Hooked on Controversy
TOP BLOTTER CATEGORIES
- Abramoff Lobbying Scandal
- American Al Qaeda
- Avian Flu
- Beirut Hospital Out of Gas
- Cheney
- CIA
- CIA Secret Prisons
- D.C. Madam Affair
- FBI
- Federal Air Marshal Service
- Homeland Security
- Hurricane Katrina
- IRS
- Mark Foley Internet Scandal
- Millionaire Sex Scandal
- Nigerian E-mail Scams
- Norman Hsu, Clinton Fundraiser
- NSA: Wiretapping
- Osama bin Laden
- Payola
- Pharmacy Investigation
- PMA
- Speaker of the House Dennis Hastert
- Stanford
- Steele
- Terror
- Troopergate
- U.K. Airline Terror Plot
- U.K. Bombing Attempts
- Wen Ho Lee
- William Jefferson
- Zarqawi
« Previous | Main | Next »
Russian Criminals Targeting U.S. 401ks and Online Traders
March 20, 2007 5:00 AM
Cybercriminal rings in Russia and Eastern Europe have stolen tens of millions of dollars by breaking into and looting U.S. 401k and online stock trading accounts, FBI and SEC officials tell ABC News.
"You could wake up one morning and find all your money in your retirement account or in your trading account is gone," said John Reed Stark, Chief of Internet Enforcement at the Securities and Exchange Commission.
Read the E-mail Exchange Between a Russian Hacker and an ABC News Intern.
In addition to the Russian rings, authorities have also seen hackers in India, Hong Kong and Malaysia going after similar online accounts.
THE BLOTTER RECOMMENDS
The criminals either cash out the stocks and wire the money to their own account or sell off the stock holdings to buy shares in worthless stock they control, an Internet version of the classic "pump and dump" scheme.
In many cases, American victims have had their user IDs and passwords stolen when they use computers at hotel business centers and other Internet connection points.
Click Here for Full Blotter Coverage.
The FBI says the criminals secretly bug the computers with programs to record every key typed.
"So that when you access your financial account, you are in fact giving the bad guy your account name, your password, your account number and essentially the keys to the kingdom," explained Shawn Henry, Deputy Director of the FBI's Cybercrimes Division.
Victims have included customers of E-trade, Scott Trade, Ameritrade, Fidelity, Merrill Lynch, Charles Schwab and Vanguard.
As part of an ABCNews.com investigation, a Russian speaking ABC News intern logged on to a Moscow-based hackers forum and was offered the user IDs and passwords of six U.S. trading accounts for a cost of $350.
The six accounts had almost $100,000 in value.
The online criminal even offered ABC News a free sample, the user ID and password of an Ameritrade account owned by a man in Fremont, Calif. When contacted, the California man confirmed it was his account and agreed to quickly change his password.
The FBI's Henry offered the following advice to avoid becoming a victim of such Internet theft:
l. Always use a trusted computer when conducting financial transactions.
2. Going into a hotel or an airport or an Internet cafe, assume you may be at risk.
3. Closely scrutinize reports from your online trading firm to make sure the reported trades are ones you authorized.
4. Frequently change your password and when traveling, consider using a special program that will change your password every 10 seconds.
5. Make sure your own computer has anti-virus protection.
March 20, 2007 | Permalink | User Comments (35)
You can follow this conversation by subscribing to the comment feed for this post.
I just watched this on ABC,so if you travel away from home ,computers in Hotels etc can get to you also The fbi says don t leave your computer on when your not using it. Doris H.
Posted by: Doris Haught | Mar 20, 2007 7:56:04 AM
Im glad to hear the News Networks and FBI is making the public more aware of computer fraud. But the real truth, is that computer user's have been fooled into beliveing that the residence Antivirus program on there computer will keep them safe... SO WRONG, The big Antivirus Companys have Lied and they know it... A computer use today Needs Mutiple Protection tools. To keep there computer safe. Im a member of a International computer help group, and we test and use mutiple tools. The public needs to know this if they wish to keep there computers truly SAFE.
Posted by: L.Palmer | Mar 20, 2007 8:07:14 AM
The response from he Federal Retirement Thrift Investment Board (maintains Gov't retirement accounts) about not being liable for losses really upset me. They claim no responsibility but provide minimal security in the format in which they require users to login to their accounts with SSN and a four digit numeric PIN. THIS IS UNACCEPTABLE!! While this goes on in the government, other agencies (FFIEC)that regulate the banking and credit union industry have been enforcing additional authentication requirements to prevent the exact events that this report was about. How ironic is that?
Posted by: W. Trout | Mar 20, 2007 8:56:42 AM
Something to remember when you use a computer on the road
Posted by: alan woodall | Mar 20, 2007 9:27:30 AM
Can you post online the video on Brian Ross' 401K story from GMA this morning?
Posted by: Terry | Mar 20, 2007 10:09:09 AM
There's such an easy way to combat this in the U.S.: Stop off-shore software development. And, refuse to do business with any company that endeavors in off-shore software development.
Posted by: Fred | Mar 20, 2007 10:23:08 AM
I'm a Network Admin for a small boutique hotel chain.
IF the hotels have the luxory of having an IT department, they would have properly set up the business center computers to avoid anyone installing rogue software on them.
Using a simple tool by microsoft, I've secured my hotel guests privacy when they access our public computers.
After every user is finished, either they can log off the machine or after 5 minutes of inactivity, the computer logs them off and reboots, effectivly restoring itself back to the way it was on the day i set it up.
Any shortcuts, virus's and spyware, installed software, personal documents are erased.
I've implemented this free download at all of our hotels and so far I have not seen any trouble.
(The only complaint from some guests is that the normal windows experience is very restricted)
Granted, I know not every hotel (even large chains) have an IT staff available for the guests and hotel staff itself, so you should definitly be cautious of where you do your finances.
Posted by: Bill | Mar 20, 2007 11:26:57 AM
What knucklehead would trust a publicly available computer such as found at hotels and Internet cafes for such work?
Posted by: Clark | Mar 20, 2007 11:49:59 AM
Hackers stealing retirement funds?
This has been going on forever.
Of course we used to call them the IRS and congress.
But the damage is the pretty much the same.
Posted by: Zach | Mar 20, 2007 12:05:19 PM
I was almost a victim of this type of hack. Only thing that saved me was that I had set up email notification on my accounts for all transactions. It appears that someone hacked the telephone access, used that access to change my online password, then went online and transferred funds from a mutual fund into a money market. When I received the email on the changes to my account, I contacted the broker, advised I had not initiated these changes, and they immediately suspended access. However, it took me another 3 months, registered letters etc to get the brokerage to reverse the transfers and restore my account.
Apparently, there is a new scam where folks who make bad trades that lose money attempt to call brokerages and claim identity theft in order to reverse the trades... Hard to keep up.
Lesson learned, set up email notification on ALL access to you online accounts, change your ACCOUNT where possible to a alphanumeric account name (rather than SSN), and if your bank or brokerage offers it, go to two factor authentication (not just online password but some other personally set question)
Posted by: Matt | Mar 20, 2007 12:55:31 PM
I think we should just go back to the golden days, where there was more privacy on our lives and less to worry about someone else stealing your nested eggs.
Posted by: Erma | Mar 20, 2007 12:59:32 PM
Forgive my lack of knowledge, but do the same problems apply if your accessing through your own computer at a hotel using wifi or dial-up?
Posted by: Lisa | Mar 20, 2007 2:19:45 PM
It seems investigative journalists are able to track down the very people that are committing the scams, committing fraud, etc....and I feel our government or a mercenary should be able to do the same. Once you find the culprit......the next course of action is simple. After that, you catch a flight home.
Posted by: Dave | Mar 20, 2007 2:50:08 PM
Banks in the UK have changed to a system where you not only enter a User Name and Password but also have to enter several letters in a drop down list from a pre-designated word.
Assume the word is: clinton,
you might be asked for the 2nd and 5th letter.
Yu select these using a mouse on a drop down list.
This makes a keystroke logging program fail.
Also, the next time you log on, the server asks for different letters.
On a similar issue, all UK and most European credit card trasactions now require the entry of a PIN number into a terminal, and NOT a signature, which is not required.
Wake up America and start providing decent financial security.
Posted by: Norman | Mar 20, 2007 3:02:39 PM
This is all dependant upon who provides internet services to the hotels. Yes even your own computer could be vulnerable on certain networks.
Some hotels will only contract services from companies that offer more than adequate protection for your own computer as well as business center computers. The issue here is that ALL hotels need to be made aware of these issues and ensure that their service providers are doing all that they can to protect their guests.
Posted by: Sean | Mar 20, 2007 3:44:25 PM
You have to be careful in todays world. With more and more services being done through the internet, criminals are finding out it is much easier to get someones data and money through a key logger program or a phishing trick. On top of my Norton antivirus, I also use WebRoot anti spam and logger program to block and scan for any type of trojan progams
Posted by: Buck Johnson | Mar 20, 2007 6:59:22 PM
Will ABC blame Bush for this too lol
Posted by: sl | Mar 20, 2007 10:12:41 PM
Our Company sells, manages and monitors guest use computers for top hotels around the country. The foundation of our offering is security, privacy and reliability. Through our proprietary client management software, our systems are locked down to prevent hackers from loading any key stroke software and we electronically shred all guest user data upon ending their session. We proactively monitor and update our systems 24x7x365. My advice is that hotels provide their valuable guests with a high quality service such as ours and that hotel guests needing secure public access computers stay at a hotel offering our secure guest use computers.
Victor Alikin
Posted by: Victor | Mar 21, 2007 1:10:26 AM
I am a director of MIS for a large upscale hotel chain, who we wont mention. The point being most of these business centers are run by 3rd party companies. While most have software remedies like mentioned above, hardware is never locked down or secured. Very easily someone could slip in put a hardware device that records credit card information as well as echo key strokes. NO hotel is 100% safe from this. Best advise is use your head or bring your own laptop to use on travel.
Posted by: KK | Mar 21, 2007 1:00:19 PM
If I take my computer to a hotel, log on to read my newspaper or check the email but do not log on to scottrade or my financials.... can they still track my password and wipe me out?
Or is it only if I log on to financial website with password.
I'm scared. Please tell me.
Posted by: Brigie | Mar 21, 2007 1:25:31 PM
Post a comment
