$5M Bank Con - Schneier on Security

Arik • October 12, 2005 7:53 AM

…but technology can help the people be more secure by providing them with information verification tools and workflow tools.

Thom • October 12, 2005 8:09 AM

@Arik

Only if they know, or understand, the that technology to any degree. Too many have no comprehension of what that technology entails, and believe “some one else” is making sure everything is safe and tidy.

Steve • October 12, 2005 8:28 AM

It’s not important to the story, but the title is wrong – at current reates a 5M Euro con is a $6M con.

Paul • October 12, 2005 8:57 AM

Ah, no patch yet for the id10T vulnerability.

Lee • October 12, 2005 9:39 AM

Technology is irrelivant if the bank manager is stupid enough to give away that amount of cash in a toilet after a phone conversation with someone who CLAIMED to be a chief exec. Even if the bank had no procedure for this kind of thing, you would expect good old common sense to play a part somewhere, i.e. contacting the Chief Exec after the call,through official channels, so you could authenticate the phone call was real.

Peter Hentges • October 12, 2005 9:42 AM

This sounds remarkably similar to the story about someone calling fast-food joints posing as a cop and getting the employees to do some pretty remarkable things:

http://www.courier-journal.com/apps/pbcs.dll/article?AID=/20051009/NEWS01/510090392

Andre Leplume • October 12, 2005 9:45 AM

In related news, the Bush administration has begun lobbying the French government to install currency-detection scanners outside all Parisian lavatories.

slim • October 12, 2005 10:07 AM

I think this story doesn’t wash. It’s very easy to chalk things like this up to “idiocy”, but I feel like this whole “secret agent” thing is a cover story for the bank employee.

Collusion anyone?

Stephen • October 12, 2005 10:09 AM

Sounds just like all the podunk towns in the US getting night vision goggles and stun guns with anti-terrorism grant money — everyone wants to play movie spy.

jammit • October 12, 2005 10:27 AM

This theft is morally and ethically wrong. Why didn’t I think of it? On the surface it seems to be a new idea in theft, but it’s still basically impersonation. Whether I pose as a cop, anti-terrorist agent, or MR NUKUMA from NIGERIA, I’m still impersonating. The banks were just simply wrong.

ac • October 12, 2005 10:57 AM

It’s also worth noting that he used “anti-terrorism” as his cover story. This is noteworthy because it granted his requests a certain need for urgency and secrecy that he would not have had posing as “standard” law enforcement.

By training people to unquestioningly comply with all terrorism-related requests from nameless, faceless bureaucrats, we are also training them to be suckers for this sort of scheme (and this is arguably the whole point).

Chris S • October 12, 2005 11:20 AM

Heck, I don’t even trust names and addresses of referrals in proposals. I go out and do at least some minimal research to try and verify that the organization, name, and phone number I am about to trust are legitimate.

For that much money, I would do that — and then call the initial contactee back based on information I felt I could trust!

These organizations also need to have better policy controls on this sort of action. Bank managers should expect NOT to be the first contact in a funding sting.

Clive Robinson • October 12, 2005 11:51 AM

@slim

Unfortunatly this sort of thing is a lot more common than you would think.

In the UK a man was recently found guilty and imprisoned, what he had done was to pretend to be a M15/M16/SIS operative, and con people out of their savings. In more than one case he effectivly imprisoned a person by convincing them they where a terorist target.

We all scoff when we here about these cases, but being a con man is obviously still a profitable way of living…

I just wonder how many Con-Men are going to take advantage of the “Climate of Fear” that our politicians are pushing, to con more people.

Davi Ottenheimer • October 12, 2005 12:34 PM

“Security is a people problem, not a technology problem”

Agreed. Computers don’t make mistakes, people do…

From another perspective criminals love opportunity, and technology creates the kind of change/transformation that increases opportunities for fraud unless properly reviewed and controlled.

One would think the banks would have some kind of control in place to check or even double-check requests to hand over large sums of cash to someone.

The story reminds me of Kevin Kline in the movie French Kiss. Sadly, I don’t think his character was based on just one or two incidents, but a whole phenomenon of smooth-talking romance language scam artists.

Probitas • October 12, 2005 3:04 PM

Great point,ac. Is the compliance of the one mark really any more ridiculous than the idea of so many Americans rushing out to buy rolls of plastic and duct tape as a defnese against chemichal and biological weapons? We are all so whipped into a patriotic fervor that we will blindly follow just about any directive if the person sounds like a government official. (And how difficult can that be, considering who we elect?)

Robbin' Hood • October 12, 2005 4:02 PM

@ jammit

“This theft is morally and ethically wrong.”

Please let me know which thefts are morally and ethically RIGHT. Those are the ones that interest me!

The_Spide • October 12, 2005 4:35 PM

@Paul’s

Ah, no patch yet for the id10T vulnerability.

I tried to read that the same way one would read i18n and l10n (internationalization and localization) …

I got as far as id-ten-t and thought you meant Identity vulnerability then relised my mistake.

:p

Stefan • October 12, 2005 4:57 PM

That branch manager should be the one put behind bars, as well as whatever jackass hired her.

Thomas Sprinkmeier • October 12, 2005 5:01 PM

@Davi,

“One would think the banks would have some kind of control in place to check or even double-check requests to hand over large sums of cash to someone.”

If I remember correctly, if the FBI hands a library a summons for the lending habbits of their customers they (the librarians) are expressly forbidden from even contacting a lawyer to verify the warrant.

These kinds of rules create the mindset of unquestioning obediance necessary for this kind of fraud.

david • October 13, 2005 2:42 AM

my favourite part about the whole story is that the police have arrested his wife AND mother-in-law, whilst he seems to have got away with the cash. Now that is what I call a RESULT!!!

Anonymous • October 13, 2005 8:38 AM

Who’s writing the screenplay?

Ari Heikkinen • October 13, 2005 6:20 PM

Yeah, when someone commits a crime arrest his wife and mother-in-law.. Good thinking!

Stephane • October 14, 2005 5:42 AM

In french news, they say it’s not a one man job.. They talk about a gang of 3 women and 2 man (Giblert and his brother)

Something pretty annoying is these conmen knew the existence of the real transactions..

Schneier on Security

Comments

Ah, no patch yet for the id10T vulnerability.

Leave a comment Cancel reply