Feeds

Money mules are REAL victims of phishing, says Microsoft iconoclast

WHEN will someone think of the stolen cash handlers?

Protecting against web application threats using SSL

Microsoft has somewhat controversially claimed that money mules are the ultimate victims of phishing emails, rather than the consumers or banks that cyber-crooks target in online banking scams.

Mules act as middlemen who receive funds from compromised bank accounts before sending the bulk of the cash overseas to the organisers of scams, who are often based in eastern Europe and unable to receive funds from compromised accounts directly.

Researchers at Microsoft argue it's these mules - recipients of just a small commission for each fraudulent transfer - who are the real victim of account-takeover scams, not banks or innocent punters.

Whether they are witting or unwitting1 accomplices to cybercrime, money mules are far more likely to be arrested, and when the dust settles, they'll be out of pocket as banks reverse fraudulent transactions.

"Money mules are not merely unwitting accomplices, they are the true victims in credential theft fraud," Cormac Herley and Dinei Florencio of Microsoft Research argue in a paper entitled Is Everything We Know About Password-Stealing Wrong? (abstract below) in the latest issue of IEEE Security and Privacy magazine.

Federal Reserve Regulation E guarantees that US consumers are made whole when their bank passwords are stolen. The implications lead us to several interesting conclusions.

First, emptying accounts is extremely hard: transferring money in a way that is irreversible can generally only be done in a way that cannot later be repudiated. Since password-enabled transfers can always be repudiated this explains the importance of mules, who accept bad transfers and initiate good ones.

This suggests that it is the mule accounts rather than those of victims that are pillaged.

We argue that passwords are not the bottle-neck, and are but one, and by no means the most important, ingredient in the cyber-crime value chain. We show that, in spite of appearances, password-stealing is a bad business proposition.

The argument rests the premise that US consumers are indemnified from losses against their online banking accounts.

Mules fall within the reach of Western police forces - and banks are getting more efficient at detecting and reversing fraudulent transactions, a process that plunges mules' accounts heavily into the red just after they have wired funds to fraudsters.

"The thief is really stealing from the mule, not the compromised account, though that fact does not become clear until the dust settles," the researchers write.

The major problem with this argument is that the victims of phishing fraud are often small business owners. And, in the US at least, bosses are liable for losses on corporate accounts caused by cyber-fraud. Unlike consumers they don't get refunded by banks. So a virus infection on a PC used to do the corporate accounts can mean hundreds of thousands of dollars siphoned out of a business.

Former Washington Post staffer turned security blogger Brian Krebs has chronicled dozens of cases of small businesses left bankrupt in just these circumstances, as can be seen in a archive of relevant stories on his site here.

Herley has become noted in security circles by questioning many aspects of conventional wisdom about information security. For example, he has probed the validity of cybercrime surveys and lambasted many aspects of current thinking on password best practices. This time however his provocative thinking seems to have strayed a little wide of the mark.

As well as painting mules as the ultimate victims of phishing scams, Herley and Florencio suggest that developing better back-end fraud detection or interfering with money mule recruitment is the best way to stamp out banking fraud. That's certainly part of the picture but the researchers go on to describe the focus of banking authentication systems as misplaced, wrongly in El Reg's view. ®

Bootnote

1Money mules range from cynically abused Down Syndrome individuals and innocents taken in by fraudulent work-at-home schemes (of the type chronicled by BobBear here) to willing accomplices, such as the Russian nationals involved in a ZeuS-powered cybercrime ring that was busted by the Feds two years ago. Three of the suspects in the latter case were Russian citizens who came to the US on student visas before allegedly using multiple forged passports to open bank accounts that received funds from compromised accounts.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.