• Written by Paul Haskell-Dowland, Associate Dean (Computing and Security), Edith Cowan University
Linking your mobile number to your bank account could have unintended consequences. SewCream/Shutterstock.com

When we think of a bank robbery, we might imagine a safe with the door blown open. But nowadays it might be more accurate to picture criminals accessing our bank account online from another country. Bank robbers don’t need balaclavas and shotguns anymore.

Australian banks have long provided convenient ways for customers to transfer funds. But the process of remembering and entering BSB and account numbers is prone to human error. Enter PayID.

PayID allows customers to attach their mobile phone number or email address to their bank account. They can then simply provide these details to other people, providing a convenient way to receive payments.

It can only be used for incoming payments, rather than outgoing ones. So you might think that makes it less of a tempting target for hackers. But that’s not necessarily the case.

Launched in February 2018 by New Payments Platform Australia, an alliance of 13 banks, PayID is reportedly available to more than 52 million account holders across almost all major financial institutions. By February 2019, some 2.5 million PayID identifiers had been created, and 90 million transactions totalling more than A$75 billion had been processed.


Read more: The New Payments Platform may mean faster transactions, but it won't be safer


When entering a PayID mobile phone number to make a payment, the full name of the account holder is displayed, so the person making the payment can ensure they are sending it to the right PayID account.

Shortly after the service launched, Twitter users began pointing out that this means you can enter random phone numbers and, if that number has been linked to a PayID account, the account holder’s name will show up – rather like a phone book in reverse.

Twitter posting of PayID details. @anthonycr0

The following day, on February 17, 2018, NPP Australia acknowledged this issue in a media release, but effectively dismissed users’ concerns:

While unfortunate for the individuals involved, the discussion highlights the choice and benefits to be considered by users when they opt in to create a PayID.

This is not exactly reassuring for bank customers whose details were publicly posted. And developments this year suggest that the underlying problems persist.

Better luck next time?

In June 2019, around 98,000 PayID details were obtained after hackers used several online bank accounts to carry out more than 600,000 PayID lookups over the course of six weeks, reportedly by simply entering phone numbers in sequential order.

It is not clear who was to blame, although there are allegations of a leaked memo pointing the finger at US-based fraudsters.

The exact motive is unclear, but any personal data has value in the underground economy. In this case, the data could potentially be used as part of a more complex phishing scam designed to steal further information from account holders.

Although this is clearly a very simple attack involving nothing more sophisticated than simple trial and error, it appears the PayID system did not detect the large number of lookups – an average of 14,000 per account – or the speed with which they were undertaken.

To give a real-world example, it would be like going into your bank 14,000 times and handing over a different piece of identification each time.

This high volume of lookups should have raised significant security concerns. While legitimate users could be forgiven for needing a couple of tries to punch in the right number, no one should need thousands of attempts.

It should have been a simple security step to add lookup limits and to identify this as highly abnormal behaviour. Yet neither the bank concerned nor NPP Australia had implemented mechanisms to detect or prevent this form of misuse.

After a security breach this size, the banks might reasonably be expected to take urgent steps to prevent it happening again. But it did happen again, two months later.

In August 2019, a further 92,000 PayIDs were exposed. In this case, it was reported that the breach happened within the systems of a financial institution connected to the NPP Australia systems. Worryingly, this breach reportedly revealed users’ full name, BSB and account number.

Banks were quick to reassure customers that this does not allow transactions to be undertaken. However, it did deliver yet more valuable information into the hands of cyber criminals – further enabling phishing opportunities.

While affected customers have been contacted, the only option to remove this risk is to stop using PayID. This is easily done but removes the convenience factor for most bank customers.

What’s the real risk?

Because the system enables payments into accounts, rather than authorising withdrawals from them, the risk may seem minor. Indeed, many in the banking sector have dismissed it as so. But there is a deeper risk.

Phishing is a form of cyber crime in which victims are tricked into revealing confidential information through convincing-looking emails or SMS messages. Unfortunately, there are already examples of this in relation to PayID.

Real examples of PayID-related SMS phishing messages. canstar.com

The approach depicted above is not particularly sophisticated. But imagine a more tailored email message quoting examples of identifiable information (PayID, full name) or, as with the most recent breach, BSB and account number.

Coupled with the correct branding and reassuring words of your bank, it would be easy to convince an unsuspecting user of the need to “login to change your PayID for security reasons”. Just a few minutes of creativity on a computer can produce convincing results.

The image shown below was created to show how easy this process is. It uses genuine branding, but the “login” button could easily be set to direct users to a website designed to steal login credentials.

Mock-up of a potential PayID-related phishing email.

With the ME Household Financial Comfort Report indicating that almost 50% of households have at least A$10,000 in savings, there is a clear incentive for cyber criminals to target our bank accounts. As with any phishing attack, it only takes a few people to succumb to make the enterprise worthwhile.


Read more: Banks can't fight online credit card fraud alone, and neither can you


Although bank customers can do little more than think twice before responding to messages, the real power is with the banks. Simply being alert to unusual patterns of behaviour would have prevented these security breaches.

This is not new territory for financial institutions, who routinely look for unusual patterns in credit card transactions. Perhaps it is time to apply these same concepts in other scenarios and better protect Australia’s banking customers.

Paul Haskell-Dowland does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.

Authors: Paul Haskell-Dowland, Associate Dean (Computing and Security), Edith Cowan University

Read more http://theconversation.com/payid-data-breaches-show-australias-banks-need-to-be-more-vigilant-to-hacking-123529

How to Create A Legal Will Online

A will is an essential legal document that clearly states the desires of someone after the person passes away. With a will, you can successfully choose the beneficiaries of your properties and e...

News Company - avatar News Company

Roborock Launches Long Lasting Cordless Stick Vacuum

Leading technology and robotics company Roborock has launched the first cordless vacuum cleaner in the world to use a Lithium-Ion Polymer Battery. Roborock’s H6 uses a lightweight battery w...

Belinda Luby - avatar Belinda Luby

Why It’s A Good Idea to Plan for Your NDIS Meeting

For those wanting to find the supports they need for their disability, the NDIS is an excellent way to receive a tailored plan to help you manage your circumstances in the best way possible. Whe...

News Company - avatar News Company

Why writing down your thoughts is beneficial

In times of sadness, you often wish to write down everything coming in your mind. You think about different things to get out of sadness, like calling your beloved ones or going out. These ideas...

Paresh Patil - avatar Paresh Patil

Digital currency and online trading

First of all, digital currency refers to a currency that is traded as electronic data that does not have banknotes or coins. When it comes to data, you might wonder if you can send Bitcoin as if yo...

Thomas Carey - avatar Thomas Carey

AVOID THESE COMMON MISTAKES WHEN SENDING MONEY ONLINE

What if people saved just a few dollars on each of the thousands of money transactions people make every year? With the ongoing globalisation and widely available internet connection we tend to con...

News Company - avatar News Company

Discount Drug Stores introduce drive thru services for customers

With COVID-19 presenting more challenges than ever for customers needing to access pharmaceutical services, Discount Drug Stores has expanded its drive-thru option at select stores to provide a flex...

Red Havas - avatar Red Havas

Fun beginner hobbies (that need no skill)

When I was in my very early teens, I was convinced I was put on this planet to become the next Bruce Lee. After begging my parents for lessons, I eventually joined no less than four different ma...

Jennifer Martinez - avatar Jennifer Martinez

Australians House Size Drop: Things to Know

For some time now, the size of homes in Australia has been on the decline. Homeowners are choosing to build smaller spaces, not relying on larger, oversized homes. If you are planning on moving to A...

Jason Smith - avatar Jason Smith

Viw Magazine

Taking A Look Into The World Of Single Dating

No-one dreams of being alone one day, there isn’t a little girl or boy hoping to never meet someone and living their lives with no-one to share it with. We all want that person we can run to, count on in tough times, and be the first one we t...

News Company - avatar News Company

Free Educational Apps for Students

Before improved technology, smartphones were viewed as bad habits in the lives of the students. No parent nor teachers wished their students to access phones because their education would be severely affected. However, with time, mobile app dev...

Elizabeth Horrell - avatar Elizabeth Horrell

Financial Frustration - 5 Things To Consider Before Touching Your Super After The COVID-19 Crash

Though your main focus throughout the COVID-19 pandemic has likely been the health and welfare of your friends, family, and the community at large, you’ve probably also noticed that your super account has taken a hit. Additionally, the govern...

News Company - avatar News Company



News Company Media Core

Content & Technology Connecting Global Audiences

More Information - Less Opinion