Phone Hack or Luck of The Draw?

[myrdale]

This past week I received a text message that was obliviously a scam. It read funny, "Error from .... Bank".

I decided to click on the link with the full understanding it was a scam. And what do you know, it brings me to a login page for my bank.

What I am curious about is how they matched me with my bank. About a month prior I installed my bank's app on my cell phone for doing the bill pay.

I understand there are vulnerabilities to logging onto public wifi networks. So I don't do it. A friend insist that if I have wifi turned on though people are still able to see a great deal about you (your number, what apps are installed) if they are within the range of your phone's wifi.

Or could this information have been gotten from my debt card some how?

Any thoughts?

[ua_guy]

It could be that your phone is already compromised if you have a habit of clicking on links even knowing they're scams. Or other apps are collecting and sending data about you nefariously. People install so much junk on their phones, it boggles my mind. And if you're using an Android...good luck.

It's probably time to swap your password. Was it really the authentic login page for your bank? Or was it designed to capture your credentials, making you think it was an authentic login page for your bank?

[kork13]

I can readily imagine a handful of possibilities. Having clicked their scammy link, any one of these could be paired with either (a) directed you to a dummy site; or (b) activated a screen logger ... both of which would be designed to capture your login info.

1) Your bank was hacked, and the hackers have your phone number associated with the bank's information.
2) You clicked the link on the scam text message, directed you through a scummy site to read the cookies (or browser history) from your browser ... then brought you back to your bank's page.
3) Do you walk around with your bluetooth constantly turned on? That is a vulnerability that can allow someone to scrape data off your phone just as easily as joining a bad WiFi network.
4) Your bank's app (or another app on your phone) may have a vulnerability that has been exploited, pulling off your data, and allowing you to be targeted.
5) I mean ... luck of the draw is also possible .... but generally unlikely.

That's just a brief look at some possibilities. Most of them center around clicking their link. Even if you know that it's a scam & don't interact with wherever it leads you ... simply clicking that link opens you up to a litany of vulnerabilities -- just opening a compromised link can run you through a series of redirects that can scrape data, install malware, activate a hidden or compromised app on your device, or a variety of other issues. BAD IDEA. You need to scrub your phone, change your passwords, and treat all of your accounts as if they're compromised.

[disneysteve]

Why did you click on the link if you knew it was a scam? That’s exactly what they wanted you to do.

Are you with a major bank? If so this could have been totally random phishing. I got scam messages all the time from major companies but ones with whom I don’t do business so I automatically know it’s fake.

if you bank with a small local place then it could be any of the things mentioned already.

[myrdale]

3) Do you walk around with your bluetooth constantly turned on? That is a vulnerability that can allow someone to scrape data off your phone just as easily as joining a bad WiFi network.

This is what I am most curious about.

[myrdale]

Or was it designed to capture your credentials, making you think it was an authentic login page for your bank?

It was a poorly made form to capture credentials.

[myrdale]

Why did you click on the link if you knew it was a scam?

Much like the cowboy who got naked and jumped on the cactus, it seemed like a good idea at the time.

[myrdale]

People install so much junk on their phones, it boggles my mind. And if you're using an Android...good luck.

I actually run pretty lean on apps. My phone is mostly a phone.

It is mildly annoying any time there is a security update, three or four new apps pop up. I just uninstall and keep moving along.

[kork13]

This is what I am most curious about.

There's alot more out there (Google is your friend), but here's a quick sampling of some of these vulnerabilities.