A scam operation called “Estate” has attempted to trick nearly a hundred thousand people into handing over multi-factor authentication codes over the past year, according to Zack Whittaker at TechCrunch.
The scammers target users of Amazon, Bank of America, Capital One, Chase, Coinbase, Instagram, Mastercard, PayPal, Venmo, Yahoo and more.
“Since mid-2023, an interception operation called Estate has enabled hundreds of members to carry out thousands of automated phone calls to trick victims into entering one-time passcodes,” Whittaker writes.
“Estate helps attackers defeat security features like multi-factor authentication, which rely on a one-time passcode either sent to a person’s phone or email or generated from their device using an authenticator app. Stolen one-time passcodes can grant attackers access to a victim’s bank accounts, credit cards, crypto and digital wallets, and online services.”
Allison Nixon, Chief Research Officer at Unit 221B, told TechCrunch, “These kinds of services form the backbone of the criminal economy. They make slow tasks efficient. This means more people receive scams and threats in general. More old people lose their retirement due to crime — compared to the days before these types of services existed.”
Multi-factor authentication offers a crucial layer of defense against hackers, but users need to be aware that social engineering attacks can still bypass these measures.
“[W]hile services that offer using one-time passcodes still provide better security to users than services that don’t, the ability for cybercriminals to circumvent these defenses shows that tech companies, banks, crypto wallets and exchanges, and telecom companies have more work to do,” Whittaker says.
New-school security awareness training can help your employees defend themselves against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
TechCrunch has the story.