Almost 100,000 Australians' private details exposed in attack on Westpac's PayID

guest · Jun 3, 2019

Almost 100,000 Australians' private details exposed in attack on Westpac's PayID
June 3, 2019
https://www.smh.com.au/business/ban...ttack-on-westpac-s-payid-20190603-p51u2u.html

The private details of almost 100,000 Australian bank customers have been exposed in a cyber attack on the real-time payments platform PayID, which allows the instant transfer of money between banks using either a mobile number or email address.

Unknown to many Australians, PayID operates like a telephone book, allowing anyone to type in a mobile number or email address and have it confirm the name of the corresponding account holder. This allows for what security experts call an "enumeration attack", whereby numbers can be changed at random to find the names and mobile numbers of thousands of Australians.

"On 22 May 2019, Westpac noted that a high volume ([around] 600,000) of NPPA PayID lookups was made from 7 compromised Westpac Live accounts," the memo said. "[Around 98,000] of the lookups successfully resolved to a short name and this was displayed to the fraudster.
Click to expand...

"In this case, the convenience of PayID is clear," he said. "What's less clear is whether users of the service are willing to accept the privacy trade-off.

In February 2018, the NPP was forced to address concerns the service could be used to lookup any Australians' details. It confirmed this was possible [...] "We are aware that a person on Twitter has performed a small number of PayID look-ups and tweeted these details publicly in a bid to start a discussion about PayID and privacy issues," it said then.
"While unfortunate for the individuals involved, the discussion highlights the choice and benefits to be considered by users when they opt in to create a PayID."
Click to expand...

guest · Aug 20, 2019

Aussie banks warn customers after fresh PayID data breach
'Client-side technical issue' blamed for latest disclosure
August 21, 2019
https://www.itnews.com.au/news/aussie-banks-warn-customers-after-fresh-payid-data-breach-529938

Banks have started warning customers of a fresh data breach involving PayID records that was reported to new payments platform overseer NPP Australia late Friday.
NPP Australia said that an undisclosed number of PayID records “and associated data in the Addressing Service were exposed by a vulnerability in one of the financial institutions sponsored into the NPP by Cuscal Limited.”

CBA’s notification said it was “proactively contacting customers whose personal information has been disclosed to a third party through a sophisticated PayID scam”.
It suggested details including mobile numbers, email address, customer name, BSB and account numbers were disclosed.

NPP Australia said the two incidents would lead to tougher security protections for users of the system.
Click to expand...

Minimalist · Sep 2, 2019

Australian banks face secret penetration tests, fines under digital payments crackdown

Australian banks and credit unions will have their transactional systems secretly penetration tested to arrest deficiencies and stop fraud and abuse of institutional infrastructure plugged into to the New Payments Platform after two PayID look-up attacks.
Click to expand...

https://www.itnews.com.au/news/aust...fines-under-digital-payments-crackdown-530485

Log in or Sign up

Almost 100,000 Australians' private details exposed in attack on Westpac's PayID

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Almost 100,000 Australians' private details exposed in attack on Westpac's PayID

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches