Three men have pleaded guilty to operating OTP.Agency, an online platform that provided social engineering to obtain one-time passwords from customers of various banks and services in the United Kingdom.
See also: WhatsApp: Gives community managers more control
Temporary passwords, also known as OTPs, were part of multi-factor authentication protections, and criminals who signed up for the illegal service could use them to gain access to a victim's bank account and empty it.
Authorities estimate that Callum Picari (22), Vijayasidhurshan Vijayanathan (21) and Aza Siddeeque (19) targeted more than 12,500 people between September 2019 and March 2021, when the UK's National Crime Agency (NCA) shut down the OTP.Agency website.
Picari was the owner and main developer of the platform, while Siddequee was responsible for promoting the site and providing technical support to criminals who purchased subscriptions to the service.
OTP.Agency promised to help provide OTPs for more than 30 online services, including Apple Pay, for weekly subscriptions ranging between £30for the basic plan and £380 for the elite.
See also: Rockwell Automation tells administrators to disconnect ICS devices
A criminal who already had a victim's login credentials to a service would also need the OTP, which OTP.Agency obtained by making automated calls to the victim using text-to-speech technology and requesting the temporary password.
The basic package allowed bypassing multi-factor authentication for bank accounts at HSBC, Monzo and Lloyds, while the top tier unlocked access to Visa and Mastercard. The three individuals also maintained a Telegram where they communicated with more than 2,200 members.
Based on information gathered during the investigation, the NCA believes the three managers could have made up to £7.9 million.
The trio faces charges of conspiracy to commit fraud and conspiracy to manufacture and procure items for use in fraud. OTP.Agency owner Picari is also charged with money laundering.
Under UK law, the first two charges can carry a maximum prison sentence of up to 10 years, while money laundering is punishable by up to 14 years. Exact sentences will be determined by Snaresbrook Crown Court during a hearing scheduled for November 2.
See also: Ransomware gang targets Windows administrators via PuTTy
Multi-factor authentication (MFA) bypass refers to the techniques and methods that attackers use to bypass the additional layer of security provided by MFA systems, such as in the case of OTP.Agency. While MFA significantly enhances security by requiring multiple forms of verification, it is not completely impenetrable. Common tactics for bypassing MFA include social engineering attacks, such as phishing, where users are tricked into revealing their authentication codes, or exploiting vulnerabilities in the authentication process itself. Additionally, some attackers may use tools or malware to obtain authentication tokens or manipulate the MFA workflow.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: bleepingcomputer
