Publications
Partners
Cape Town - The offline world may be subject to an online threat that targets financial information, a security firm has reported.
According to Kaspersky Lab, malware that infects a popular payment system may have dire implications for the offline world.
The scam works by infecting the Boletos system of financial transactions popular in Brazil. Criminals discreetly change payment credentials and redirect money from legitimate accounts.
"In particular they change the bar code and ID code to redirect a payment to a different banking account. Most people would struggle to notice these changes until it’s too late, and that's how the whole scam works: Victims unknowingly transfer the money to a fraudster's bank account when they think they are paying for a legitimate deal," Kaspersky said.
The scheme, while limited to Brazil, potentially could be used to target virtual payment systems anywhere in the world, especially where people are unaware of the risks of transacting online.
Formal economy
Kaspersky found that criminals have been using malware to compromise the payment system since at least 2013 and there is evidence that millions of dollars have been siphoned from people's accounts.
The cyber criminals have also managed to spread the malware through official channels, making it difficult for authorities to trace those responsible.
"In addition criminals were spotted using malicious browser extensions for Chrome, which were successfully distributed through the official Chrome Web Store, and extensions for Firefox," said Kaspersky.
Companies in South Africa and other developing nations have looked to virtual payment services as a way of bringing more people into the formal economy and making it easier to conduct financial transactions.
However, if criminals were able to compromise such a system, it could severely erode trust in the platform.
To protect against the risk, Kaspersky advised companies to issues server generated PDF Boletos rather than HTML ones which could be subject to tampering by criminals.
End users of any virtual payment should carefully examine all documentation and assume suspicion of e-mailed financial documents.
- Follow Duncan on Twitter
