DomainTools warns that a sophisticated West Africa-based fraud group is impersonating the Financial Industry Regulatory Authority (FINRA) to target users in the United States, according to researchers at DomainTools. The threat actors are attempting to trick investors into providing sensitive documents in order to verify their identities. Users can avoid falling for these attacks if they’re familiar with FINRA’s legitimate roles.
“This tactic attempts to exploit investor confusion regarding the role of FINRA in how it regulates financial advisors by brazenly claiming that FINRA is their know-your-customer (KYC) and anti-money laundering (AML) provider,” the researchers write. “Within the context of financial services, KYC and AML are anti-fraud procedures where the customer (or client) provides documents to prove their identity. To be clear, FINRA does not provide these services. Instead of using KYC as a necessary process to validate a client or customer’s identity to prevent fraud, this impersonation campaign uses the guise of KYC to commit additional fraud.”
The researchers add that these types of stolen documents can be used for a wide variety of criminal purposes.
“These documents are highly valued in fraud communities,” DomainTools says. “A victim that uploads identity documents to a fraudulent service will likely see those documents sold by or otherwise shared within several cybercrime communities. This represents a significant ongoing fraud risk for victims which may haunt victims for years. And remember, this new identity fraud exists in addition to the existing cryptocurrency ‘investment’ scam which remains the core mode of operation for this fraud ring. By combining these two fraudulent activities together on one financial impersonation website, the fraud rings look to create an ‘air of legitimacy’ to both scams by reinforcing a broader set of information that a possible customer may expect to see.”
New-school security awareness training can enable your employees to recognize social engineering attacks.
DomainTools has the story.
Here's how it works:
