A good amount of money has been stolen from my bank account bypassing the double factor authentication.

ZioMario said:
In your opinion, if I bring to the bank employee the visual and paper evidences of the phishing dynamic, will this make easier to be refunded or not ?
Click to expand...
If you get them to some IT specialist of your bank, and not some ordinary customs counter clerk, and it's something yet unkown, the bank may thank you for the information, because it may help to improve their security. But if there was something new, they will ask you.
Anyway they will not compensate your loss unless it was clearly their fault.

To look at it in detail would go way beyond the scope of some forum's post. Also the whole point may completely change by a insignificant seeming detail of the complete story yet not told here.

However, a brief plot of the situation summarizes like this:
By rules of law in constitutional states the one who is responsible for the damage is responsible to compensate.

That would be in this order:
1. The one who did the damage by his own will. In this case that would be the thief. If she is caught, found guilty, and convicted. Even if the thief is found and pointed out for sure this still can be problematic, e.g. if he is in another country where yours has no legal act.

2. The one who did not act responsibly to prevent the damage.
2.1 That would be you. Because you are responsible yourself for how you handle the security measures the bank offers you for your online banking transactions, like keep your secret pin number secret, use up-to-date software, don't install any untrustworthy software, not click on links in email of dubious senders etc.
A bank may also say:"We clearly say in our terms of conditions to use latest version of Internet Explorer, or Firefox on a Windows 10 or 11 system, because that's what our software is designed for. If you use otherwise, it's up to you to know what you're doing and why." (This example alone already shows, the topic is way too much to be treated with one post within a technical-only forums in the absence of legal expertise.)
You signed this terms in some way when you did the contract with your bank. Maybe those changed over time, e.g. by those "Our users terms of conditions changed. By doing nothing you agree to and accept it"-things. But they are part of the contract you have with your bank anyway. The bank will plead on. And unless you can prove you did no mistake - which I find nearly impossible - you have no chance whatsoever.

2.2 The bank will become responsible, only when there is prove they made the mistake: e.g. you can prove the theft was only possible because of a security gap in their banking software, and you did nothing wrong.
Good luck with that.

To put it even shorter:
If cash from your wallet is stolen, as long as you don't find and convict the thief there is nobody else you can hang for but youself.

As many others here already said:
As long as you're not your countrie's #1 billionaire they will not involve Secret Services, Navy, nor Air Force to help your case. Just report the offence to the police, and to your bank, as you already did, let those do their job, wait for and do what they ask, and hope for the best - while I would not get my hopes up.

Frankly as long as it's less than many thousands €, and the thief is no easy to find stupid script kiddy in Europe I see no real chance you get your money back.
It sounds harsh, but discard it.
Take it as a lesson to put your personal security measures to the test, improve those, and become more careful in the future - which you will anyway, of course.
 
ZioMario said:
In your opinion, if I bring to the bank employee the visual and paper evidences of the phishing dynamic, will this make easier to be refunded or not ?
Click to expand...

Depends on what the bank does usually in this cases. They might have a small claims department that will engage in a bit of long running process. Example, if the kiddy bought Steam game, they will contact Steam and Steam won't have any questions whether the transaction was illicit if they are contacted via official means by the bank. They are going to refund the sale and close the kiddys account, ban him.
 
Maturin said:
Frankly as long as it's less than many thousands €, and the thief is no easy to find stupid script kiddy in Europe I see no real chance you get your money back.
It sounds harsh, but discard it.
Click to expand...

Its a normal system. If I go now to neighborhood store, take some beverage out of the fridge, and blatantly walk away, sit across the store and mock the clerk while drinking it, do you know what happens if clerk dials the police? Nothing unless the stolen goods are about 80e or more.

I mean, they will maybe inform the local patrol, they might write down your description so they're aware of some small thief, but they can't do anything more - they're not allowed to deploy units on the field unless damage is larger than some sum in some case. And in case of petty thefts, 80 eur is the limit.
 
Ouch. In US, banks are supposed to have insurance against this - Chase bank actually spells it out that if you bring evidence of unauthorized transactions on your account, you do get the money back - up to the insured amount, usually $100,000.

This policy got the banks to be especially aggressive with security - because in US, banks know they will be on the hook if they lose customer's deposits if they fail to verify customer's identity and whether the customer actually authorized the transaction. Dunno what it's like outside of US.
 
^ that example is the worst example possible. Read up on it. McDonalds was clearly at fault, they did a smear campaign against the poor woman and now half of world believes USA "lawsuit culture" screwed over McDonalds.
 
Grass is not greener on the other side. FTC data shows consiredable amount of money customers lost in fraud.
But this is, as with many legal stuff, a bit hard to argue over. I tried to find gov site addressing this, found bank of atlanta page. I think that's enough here:

In the US, current regulations under the Electronic Fund Transfer Act do not require banks to reimburse consumers for APP fraud since the payments are technically authorized—
Click to expand...

Since this was APP fraud it's likely that US bank would refused to do so (doesn't mean they couldn't). Usually credit cards have an extra insurance linked to them.
 
_martin said:
do not require banks to reimburse consumers for APP fraud since the payments are technically authorized
Click to expand...
Once at a gas station in Mexico I authorized a fraudulent transaction by replying my bank's SMS to confirm it. Eventually my bank reimbursed it. One of my arguments was the fact that the SMS content was something like "Do you authorize this transaction of $1234?", and "$" is used for Mexican peso! That was a reasonable amount for the gas in peso. They charged me that amount in USD.
 
Good for you, that's that "do not require but may do so" part of the sentence. And that's why I said it's hard to argue over it. Law may say one thing but bank may do more to protect their clients.
 
I still don't understand how they got the CVC of your card. That part is a mystery to me... I wonder if they have made this hack in multiple stages over some weeks...?
 
eternal_noob said:
Yes, the USA is a bit special in this regard. You even get millions of $$$ if you are too stupid to drink hot coffee.

Liebeck v. McDonald's Restaurants - Wikipedia

en.wikipedia.org en.wikipedia.org

This wouldn't be possible in Europe.
Click to expand...
This is 30 years old by now. Regulations regarding frivolous lawsuits have changed. If you wanna shake down somebody like McDonald's - good luck figuring out how. It pays to read the fine print and realize in blunt terms what's possible, what's not, and in whose favor the rules of today are written.
 
blackbird9 said:
I still don't understand how they got the CVC of your card. That part is a mystery to me... I wonder if they have made this hack in multiple stages over some weeks...?
Click to expand...

Exactly. It is written only to the back of the card and I haven't shared it with anyone or wrote it anywhere.
 
Not all transactions require CVV (card verification value), it could be he tried his luck.
Click to expand...

So,this is a point where the bank has not adopted an important security measure. I'm not a lawyer,but my rationale tell that they are responsible for not having adopted the security code for every transaction. Don't u think ? As I think that they are responsible for forcing customers to use an Android app instead of a hardware token,that's more secure than the first one.

So,no,I can't be called responsible for the 100% for what happened. I'm for 50%,60%,the rest belongs to the bank.
 
If you want to dig into it here's a good start. Look for low value transactions and exemptions from strong customer authentication.
But for the conversation here saying some payments are excluded is enough and it's a feature.

As this is technical forums it would be interesting to see that phishing page (I don't see that being against the rules).
When I re-read your post I was a bit confused with the a) statement. It seems like you've seen your money lost when you logged in back then. That means you had to be scammed earlier.
 
Going back to trying to use secure DNS to protect against being directed to spoofed websites, I found this interesting forum thread on using Tor to provide DNS service, in place of cloudflare, quad9 etc (at least, I think that's what she is suggesting). Quite interesting, I haven't tried this, I don't know anything about tor, or how advisable doing this would be. Perhaps it provides an alternative to things like cloudflare though, if cloudflare is suspect.

S

Thread 'How to make local_unbound using DNS from the tor network, which is heavily encrypted.'

By following these instructions, is possible to obtain an encrypted DNS connection for internal local network or local computer running FreeBSD. The local_unbound package allows to hash DNS queries on the local machine, this prevents DNS from querying the site addresses, which is another security feature.

What is needed:
Computer with local unbound package. It is installed by default, so is not nessesy to install it.
TOR package

First, we install the tor package
Code: 
 pkg install tor

Because tor requires a packet filter to operate, and most importantly, it checks the permissions...
  • Like

Does anyone have any views on whether doing this would be a good or bad idea?
 
I don't use my phone to authorize logins or bank transfers. I don't have a bank app installed on my phone either. So if someone takes my phone or even steals it, they won't be able to do anything about my online banking.I only use FreeBSD and a special profile in my web browser just for banking.Does your bank offer hardware keys? Transaction tokens for authorization?
 
Mine has a hardware key... like you, I have nothing on the phone. I guess I'm luckier than the OP; at the present time, anyway. Yes, if my phone is stolen, they can find nothing out from the phone.
 
You must log in or register to reply here.
Back
Top